1. What this summary is
1.1Every law firm must sign Clerify’s Data Processing Agreement (“DPA”) before it uses the platform with real Client Data. POPIA requires a written contract between a Responsible Party and an Operator (sections 20 and 21), and this is that contract.
1.2This page is a plain-English summary of the key terms. It is not the agreement. The signed DPA prevails if there is a difference. The DPA is signed electronically together with the Order Form and forms part of the Terms of Service.
Who is who: The law firm is the Responsible Party (the role that is called the data controller in other countries). Clerify is the Operator (the role that is called the data processor in other countries).
2. Roles and instructions
2.1The law firm decides why and how personal information is processed and is responsible for the lawfulness of that processing.
2.2Clerify processes Client Data only on the law firm’s documented instructions, which are the DPA, the Terms of Service and the law firm’s configuration and use of the platform. If Clerify believes that an instruction breaches the law, it will say so and may decline to carry it out.
2.3Clerify will not use Client Data for its own purposes. It will not sell it and will not use it for advertising, profiling, product analytics or training machine-learning models.
3. What is processed
| Item | Detail |
|---|---|
| Subject matter | Secure client intake, FICA document collection, identity verification and document exchange for the law firm’s matters |
| Duration | The term of the subscription, plus a 30-day export period, followed by deletion |
| Data subjects | The law firm’s clients and prospective clients, their representatives, and the directors, trustees, shareholders and beneficial owners of entities |
| Personal information | Names, ID and passport numbers, dates of birth, contact details, proof of address, entity documents, matter information, consent records and audit records |
| Special personal information | Biometric information used for identity verification, and any special personal information that a data subject enters into a form. Children’s information may be processed in family-law matters. |
4. Security measures
4.1Clerify maintains the following measures, which meet the requirements of sections 19 and 21 of POPIA:
| Area | Measure |
|---|---|
| Hosting | Amazon Web Services, Africa (Cape Town) region, in South Africa |
| Encryption at rest | AES-256-GCM, with a unique key for each file and envelope encryption of those keys under a separately stored master key |
| Encryption in transit | Encrypted connections for all traffic to and from the platform |
| Access control | Role-based, least-privilege access; two-step access for document recipients (email address plus one-time PIN) |
| Document protection | Recipient-specific watermarking; validation that rejects illegible uploads |
| Audit | Immutable, time-stamped audit trail of uploads, views, downloads and deletions |
| Segregation | Each law firm’s Client Data is kept separate from every other law firm’s |
| People | Confidentiality undertakings for all personnel; access only where needed for support, security or legal compliance |
| Deletion | Crypto-shredding: the key for a file is destroyed together with the file, which makes every encrypted copy unreadable |
| Resilience | Encrypted backups; an incident response process |
5. Sub-operators
5.1The law firm gives Clerify general authority to use the sub-operators below. Clerify has a written agreement with each that requires protection equivalent to POPIA, and remains responsible for their performance.
| Sub-operator | Service | Location |
|---|---|---|
| Amazon Web Services | Hosting and storage | South Africa (Cape Town) |
| Didit | Identity verification, liveness and facial comparison | Outside South Africa, including Spain and the United States |
5.2Biometric information is captured and processed in real time by Didit. Clerify does not store the selfie, the liveness video or the facial template on its servers, and keeps only the verification outcome. Clerify will give the law firm at least 30 days’ notice before it appoints a new sub-operator or changes where one processes information. The law firm may object on reasonable data protection grounds.
5.3Where information is sent outside South Africa, Clerify will rely on section 72 of POPIA, namely a binding agreement that provides substantially similar protection, the data subject’s consent, or contractual necessity.
6. Security compromises
6.1Clerify will notify the law firm immediately after it has reasonable grounds to believe that Client Data has been accessed or acquired by an unauthorised person, and in any event within 48 hours of becoming aware of it.
6.2The notice will describe, as far as it is known, what happened, what information is affected, what Clerify has done to contain the compromise, and what the law firm can do. Clerify will help the law firm to notify the Information Regulator and the data subjects as section 22 of POPIA requires. The law firm is responsible for making those notifications.
7. Data subject requests and assistance
7.1If a data subject asks Clerify for access to, correction of or deletion of their information, Clerify will refer the request to the law firm within 5 business days and will not respond to it directly unless the law firm instructs it to.
7.2Clerify will give the law firm reasonable help to respond to requests, to carry out any assessment that POPIA requires, and to deal with the Information Regulator.
8. Records that FICA requires
8.1The law firm is an accountable institution and stays responsible for its FICA records. Clerify keeps Client Data on the law firm’s behalf. FICA allows an accountable institution to appoint a third party to keep records for it, but the accountable institution remains responsible, and may have to notify the Financial Intelligence Centre or its supervisory body of that appointment. The law firm is responsible for giving that notice, and Clerify will supply the particulars it reasonably needs.
8.2FICA requires customer due diligence records to be kept for at least five years after the end of the business relationship. The law firm must decide how long Client Data is kept and must export anything it needs before the subscription ends.
9. Audits and information
9.1Clerify will give the law firm the information it reasonably needs to check that Clerify is complying with the DPA. The law firm may audit Clerify’s compliance once a year, or after a security compromise, on at least 14 days’ notice, during business hours, remotely where possible, and without access to other clients’ data. Each party bears its own costs.
10. Return and deletion
10.1When the subscription ends, Clerify will keep Client Data available for export for 30 days. After that period, and unless the law requires Clerify to keep it, Clerify will delete the Client Data using crypto-shredding. Backup copies become unreadable when the keys are destroyed and expire in the ordinary backup cycle. On request, Clerify will confirm in writing that deletion is complete.
10.2The law firm may instruct Clerify to delete specific matters or documents at any time.
11. Liability, term and governing law
11.1Liability under the DPA is subject to the limits and exclusions in the Terms of Service. The DPA lasts as long as Clerify processes Client Data for the law firm. It is governed by the laws of South Africa, and the High Court of South Africa, Gauteng Division, has jurisdiction.
12. How to sign
12.1To request the full DPA for review, or to arrange signing, contact Anga Ngcebetsha at anga@forteintake.com or on +27 71 877 2496.