1. About this policy

This policy explains how ChambersPro (Pty) Ltd collects, uses, shares and protects personal information. It is issued in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA") and, where applicable, the Electronic Communications and Transactions Act 25 of 2002.

It should be read with our Terms and Conditions.

2. Who is responsible

Responsible party	ChambersPro (Pty) Ltd
Registration number	2026/522824/07
Physical address	1 Mount Quray Street, Suite E005, Midlands Office Park East, Midstream Estates, Pretoria, 1692
Information Officer	Irma Esther Naidoo
Email	lex@chamberspro.com
Telephone	+27 72 808 0997

3. Two very different kinds of information

This distinction matters, so we set it out plainly.

Category	Who controls it
Your information Your name, email, practice details, billing records, how you use the Service.	We are the responsible party. This policy governs it.
Your matter content Client details, pleadings, affidavits, consultation recordings, transcripts, notes — everything you put into your matters.	You are the responsible party. We are only your operator and process it on your instructions. This is governed by clause 14 of the Terms and Conditions, which is the written operator contract POPIA section 21 requires.

In other words: we decide how to handle your account information. You decide how your clients' information is handled, and we simply follow your instructions and keep it safe.

4. What we collect about you

4.1 Information you give us

• Registration: full name, email address, password (stored only as a cryptographic hash, never in readable form), practice or chambers name, professional role, and telephone number where you provide it.
• Billing: your chosen Plan, billing history, and the reference Payfast returns to us. We never receive or store your full card number, expiry date or CVV — those are captured by Payfast directly.
• Correspondence: the content of support emails and any information you volunteer in them.

4.2 Information we collect automatically

• Technical: IP address, browser type and version, device and operating system, and timezone.
• Usage: pages visited, features used, dates and times of access, and error reports. We use this to keep the Service working and to decide what to improve.
• Security: login attempts, including failed ones, and the IP addresses they came from.

4.3 What we do not collect

We do not collect special personal information about you as our customer, we do not buy personal information from data brokers, we do not track you across other websites, and we run no advertising networks or advertising trackers.

5. Why we process it, and on what lawful basis

Purpose	Lawful basis under POPIA
Creating and running your account	Necessary to perform our contract with you (s11(1)(b))
Taking payment and keeping billing records	Necessary to perform our contract (s11(1)(b)) and to comply with tax and company law (s11(1)(c))
Providing support	Necessary to perform our contract (s11(1)(b))
Keeping the Service secure and investigating misuse	Our legitimate interests (s11(1)(f))
Improving and troubleshooting the Service	Our legitimate interests (s11(1)(f))
Service messages — billing notices, security alerts, changes to terms	Necessary to perform our contract (s11(1)(b))
Optional product news and marketing	Your consent (s11(1)(a)), withdrawable at any time
Complying with a court order or legal duty	Legal obligation (s11(1)(c))

Supplying your name, email and billing details is mandatory — we cannot open or run an account without them. Everything else is voluntary, and declining it will not affect your access to the Service.

6. Marketing

We only send marketing to you if you have opted in, or if you are an existing customer and the message concerns a similar service, as permitted by section 69 of POPIA. Every marketing email carries a working unsubscribe link, and you can opt out at any time by emailing us. Opting out never affects your subscription or your support.

7. Who we share it with

We do not sell personal information. We never have and we will not.

We share information only with the service providers we need to run the Service:

Provider	What it does	Where
Supabase	Database, login and file storage	Outside South Africa (European Union — Ireland)
Payfast	Payment processing and card handling	South Africa
Anthropic	Artificial intelligence for document summaries and legal research, where you use those features	Outside South Africa
AssemblyAI	Transcription of consultation recordings you choose to upload	Outside South Africa
Email provider	Sending account, billing and support email	Cloud infrastructure

We may also disclose information where we are compelled by law, a court order or a lawful demand from a regulator; where necessary to establish, exercise or defend a legal claim; or to a purchaser if our business is sold, in which case we will notify you beforehand and this policy will continue to apply until you are given a new one.

If we receive a legal demand for information relating to your matters, we will notify you before disclosing it, unless the law forbids us from doing so, precisely so that you can assert privilege on your clients' behalf. See clause 13.2 of the Terms.

8. Sending information outside South Africa

Section 72 of POPIA restricts transfers of personal information out of the country. Some of our providers process data outside South Africa, as marked in the table above.

We rely on section 72(1)(a) — each such provider is bound by a written agreement imposing standards of protection substantially similar to POPIA's conditions for lawful processing — and, where the transfer arises from your use of the artificial intelligence or transcription features, on section 72(1)(b), being your instruction to us to perform that processing.

We do not use the contents of your matters to train any artificial intelligence model, and our providers are contractually barred from doing so with content submitted through our account.

9. How long we keep it

Information	Retention
Account information	For as long as your account is active
Your matter content after cancellation	60 days, then permanently deleted (clause 9.3 of the Terms)
Trial data where you never subscribe	30 days after the trial ends
Billing and tax records	5 years, as required by the Companies Act 71 of 2008 and the Tax Administration Act 28 of 2011
Security and access logs	12 months
Support correspondence	3 years
Marketing preferences and opt-outs	Indefinitely, so we can honour your opt-out

Where we are obliged to keep records by law, we keep them for that period even if you ask us to delete them, and we restrict processing to that legal purpose alone.

10. How we protect it

• All traffic to and from the Service is encrypted in transit using TLS.
• Stored data and uploaded files are encrypted at rest.
• Passwords are stored only as salted cryptographic hashes and are never readable by us.
• Database-level access rules isolate each subscriber's data, so no subscriber can reach another's.
• Access by our personnel is restricted to what is necessary, and we do not read the substance of your matters except as described in clause 13.2 of the Terms.
• We take regular encrypted backups.
• We review access and security arrangements periodically.

No system can be guaranteed perfectly secure. If a security compromise affects your personal information, we will notify you and the Information Regulator as required by section 22 of POPIA, without undue delay and in any event within 72 hours of becoming aware of it.

11. Your rights

Under POPIA you have the right to:

• Be told whether we hold personal information about you, and to access it (section 23);
• Correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (section 24);
• Object to processing based on legitimate interests, on reasonable grounds (section 11(3));
• Withdraw consent at any time, where processing rests on consent;
• Opt out of direct marketing at any time (section 69);
• Not be subject to a decision based solely on automated processing that has legal consequences for you (section 71). We make no such decisions;
• Data portability — you can export your data from within the Service at any time; and
• Complain to the Information Regulator.

11.1 How to exercise them

Email lex@chamberspro.com. We will respond within 30 days. We may ask you to verify your identity first. There is no charge, unless a request is manifestly unfounded or excessive, in which case we will tell you the reasonable fee before doing the work. Formal access requests under the Promotion of Access to Information Act 2 of 2000 may be made on Form 2 to our Information Officer.

12. Cookies and similar technologies

We use only what the Service needs to function:

Type	Purpose
Strictly necessary	Keeping you logged in, maintaining your session, and security. The Service cannot work without these.
Preference	Remembering settings such as light or dark mode.

We use no advertising cookies, no third-party tracking pixels and no cross-site trackers. You can block cookies in your browser, but you will not be able to stay logged in.

13. Children

The Service is for legal practitioners and is not directed at children. We do not knowingly collect personal information about anyone under 18 as a customer. If you believe we have, contact us and we will delete it.

14. Changes to this policy

We may update this policy. The current version is always published here with its effective date. Where a change is material we will notify you by email at least 30 days before it takes effect.

15. How to complain

Please raise it with us first at lex@chamberspro.com. We acknowledge within 2 business days and aim to resolve within 15 business days.

If you are not satisfied, you may complain to:

The Information Regulator (South Africa)	JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 PO Box 31533, Braamfontein, Johannesburg, 2017 Email: complaints.IR@justice.gov.za Website: inforegulator.org.za