1. Who we are and what this policy covers
1.1This Privacy Policy explains how Clerify (Pty) Ltd, registration number 2026/594082/07 (“Clerify”, “we”, “us” or “our”), processes personal information. It is written to meet the requirements of the Protection of Personal Information Act 4 of 2013 (“POPIA”) and to work alongside the Financial Intelligence Centre Act 38 of 2001 (“FICA”).
1.2Clerify provides a secure client intake and identity verification platform to South African law firms. Because of how the platform works, we act in two different roles, and your rights depend on which role applies:
| Whose information | Our role | Who is responsible for it |
|---|---|---|
| Information that people submit to a law firm through Clerify, such as ID numbers, proof of address, entity documents and biometric verification | Operator under POPIA. We process it only on the law firm’s instructions. | The law firm (the Responsible Party) |
| Information about the law firm’s own staff and account, billing records, support requests and visitors to our website | Responsible Party under POPIA | Clerify |
1.3In plain terms: when you complete a form or identity check sent to you by your attorney, your attorney decides why and how your information is used, and Clerify is the secure technology that carries and protects it. Your attorney is the Responsible Party, which is the role that laws in other countries call the data controller.
1.4Clerify is not a law firm and does not give legal advice.
2. Our Information Officer
2.1Clerify’s Information Officer is Anga Ngcebetsha, who can be contacted at anga@forteintake.com or on +27 71 877 2496. Questions, requests and complaints about this policy can be sent to that address.
3. The information we collect
3.1Information that law firm clients and their own clients submit through the platform (we are the Operator). Depending on the form and the matter, this can include:
(a)identity information: full names, South African identity number or passport number, date of birth, nationality, gender, marital status and the information on an identity document;
(b)contact information: email address, telephone number, residential and postal address;
(c)proof of address and other supporting documents, such as bank letters, utility bills and municipal accounts;
(d)entity information that FICA requires for juristic persons: company and trust registration documents, trust deeds, resolutions, and the identity details of directors, trustees, shareholders and beneficial owners;
(e)matter information that the person enters into an intake form, such as details of a divorce, maintenance, debt, employment, property or commercial matter, which can include information about children and other family members;
(f)biometric information: a selfie image, a short liveness check and the facial measurements that the verification provider derives from them (see section 5);
(g)consent and audit records: the version of each notice shown, the time and date of consent, and secure audit records of when a document was uploaded, viewed, downloaded or deleted; and
(h)technical information that is needed to secure the session, such as IP address, device and browser type, and timestamps.
3.2Information about law firm users and accounts (we are the Responsible Party). This includes names, work email addresses, telephone numbers, job titles, firm details, login records, support correspondence and billing records.
3.3Information about visitors to our website (we are the Responsible Party). When someone completes the contact form we collect their name, firm name, email address, telephone number, the reason for the enquiry and their message. Our website and hosting providers also receive technical information, such as the IP address and browser type, when a page is loaded. We do not run advertising or analytics trackers on our website.
3.4Special personal information. Biometric information is special personal information under section 26 of POPIA. Some matter information, such as health or criminal-behaviour details that a person chooses to enter into a free-text field, may also be special personal information. We process special personal information only as section 27 of POPIA permits, as explained in section 5.
3.5Children. Clerify’s platform is not directed at children. A family-law matter may nonetheless require a parent or guardian to enter information about a child. The law firm is responsible for making sure that the conditions in sections 34 and 35 of POPIA are met before it asks for that information.
4. Why we process information and on what basis
4.1As Operator, we process information only to provide the platform to the law firm that has engaged us, namely to deliver forms, collect documents, run identity verification, store the information securely, maintain the audit trail and delete the information when instructed. We do not decide what to collect, we do not use the information for our own purposes, and we do not sell it. We do not use it for advertising, profiling, product analytics or training machine-learning models.
4.2The law firm’s grounds. Law firms collect this information to comply with their duties under FICA (identifying and verifying clients, understanding who owns and controls an entity, and keeping records), to open and run a matter, to act in the interests of their clients, and to meet their professional obligations. The grounds that POPIA recognises for this include section 11(1)(b) (necessary to carry out actions for the conclusion or performance of a contract), section 11(1)(c) (necessary to comply with an obligation imposed by law) and section 11(1)(f) (legitimate interests).
4.3As Responsible Party, we process the information described in sections 3.2 and 3.3 to provide and bill for the service, to respond to enquiries, to keep the platform secure, to meet our legal obligations, and to protect our legal rights. Our grounds are section 11(1)(b) (contract), section 11(1)(c) (legal obligation) and section 11(1)(f) (our legitimate interest in running and securing a legal technology business). Where the law requires consent, we ask for it.
4.4We collect information directly from the person it concerns wherever we can. We process only information that is adequate, relevant and not excessive for the purpose, as sections 10 and 13 of POPIA require.
5. Biometric information and identity verification
5.1To help law firms verify identity as FICA requires, the platform integrates an identity verification service provided by Didit, which is a third-party sub-operator that we have appointed. The verification can include reading an identity document, capturing a selfie, performing a liveness check and comparing the face on the selfie with the face on the document.
5.2How biometric information is handled by Clerify. The selfie, the liveness check and the facial measurements are captured and processed in real time by Didit. Clerify does not store the selfie image, the liveness video or the facial template on its own servers. Clerify receives and stores only the outcome of the verification, such as whether the check passed, the extracted document details and the reference number of the verification session. That outcome is stored encrypted, as Client Data, in South Africa.
5.3How biometric information is handled by Didit. Didit processes the biometric information on the law firm’s behalf and on Clerify’s instructions. Didit is a company based in Spain, with a United States affiliate, and it processes information outside South Africa. Didit does not process the information for its own purposes and keeps it only for the periods in its published retention policy and as configured for Clerify. Didit’s own policies are available at didit.me.
5.4Lawful ground. POPIA prohibits the processing of biometric information unless a ground in section 27 applies. The platform asks each person for their explicit, informed consent before the biometric step begins, and the law firm also relies on the fact that the processing is necessary to establish, exercise or defend a right or obligation in law, namely its duty to identify and verify its clients under FICA.
5.5You can say no. Consent to the biometric check is voluntary. If you do not want to complete it, you can decline and ask your law firm to verify your identity by another method that it accepts, such as in person. You can withdraw your consent at any time by contacting your law firm or us. Withdrawal does not affect processing that already took place and does not affect any record that the law firm must keep by law.
5.6No decision with legal consequences about you is made solely by automated means. A failed or unclear verification is reviewed by a person at the law firm, who decides what happens next.
6. Clerify as Operator and the law firm as Responsible Party
6.1When a law firm uses Clerify, POPIA requires a written contract between the two. Our Data Processing Agreement is that contract (sections 20 and 21 of POPIA). A summary is at clerify.co.za/dpa.
6.2The law firm, as Responsible Party, decides why and how personal information is processed. It is responsible for: (a) having a lawful ground for collecting the information; (b) giving each person the notice that section 18 of POPIA requires; (c) obtaining and recording consent for the biometric check, or relying on another ground in section 27; (d) deciding how long the information is kept, bearing in mind its FICA record-keeping duties; (e) responding to access, correction and deletion requests; and (f) notifying the Information Regulator and the people affected if a security compromise occurs.
6.3Clerify, as Operator, must: (a) process the information only on the law firm’s instructions and not for its own purposes; (b) treat the information as confidential; (c) apply the security measures in section 10; (d) tell the law firm immediately if it has reasonable grounds to believe that the information has been accessed or acquired by an unauthorised person; (e) bind its sub-operators to equivalent duties; (f) help the law firm to respond to requests from data subjects; and (g) return or delete the information when the law firm instructs us or the subscription ends.
6.4FICA allows an accountable institution to appoint a third party to keep records on its behalf, but the accountable institution stays responsible for those records. Clerify keeps Client Data on the law firm’s behalf, and the law firm remains responsible for FICA compliance.
7. Where information is stored and who can see it
7.1Storage in South Africa. Client Data is stored in the Amazon Web Services Africa (Cape Town) region. Clerify does not routinely copy Client Data to any other country.
7.2Encryption. Every uploaded file is encrypted at rest with AES-256-GCM, using a unique key for each file. Those keys are themselves encrypted under a master key (envelope encryption) that is stored separately from the data it protects. Information is encrypted in transit.
7.3Access. Access to Client Data is limited to the law firm’s authorised users and to the small number of Clerify personnel who need it to provide support or respond to a security incident. Recipient access to documents is protected by an email address and a one-time PIN, and downloaded documents can be watermarked with the recipient’s details. Every access is recorded in the audit trail.
7.4Sub-operators and service providers. We use the following providers to deliver the platform:
| Provider | What it does | Where it processes information |
|---|---|---|
| Amazon Web Services | Cloud hosting and storage of Client Data | South Africa (Cape Town) |
| Didit | Identity document checks, liveness and facial comparison | Outside South Africa, including Spain and the United States |
| Formspree | Delivers submissions from the contact form on our website to us. It does not receive Client Data from the platform. | United States |
| Netlify | Hosts the public marketing website | Global content delivery network, including the United States |
| Google Fonts | Delivers the typefaces used on our website. Your browser sends your IP address to Google when the page loads. | Global |
7.5Transfers outside South Africa. Where information is sent outside South Africa, we do so only as section 72 of POPIA permits: where the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection that is substantially similar to POPIA; where the person has consented; or where the transfer is necessary to perform a contract. We have concluded written agreements with our sub-operators that require them to protect personal information to a standard equivalent to POPIA and to process it only on our instructions.
7.6We may also disclose information where the law requires or permits us to do so, for example in response to a court order, or to the Financial Intelligence Centre, the Information Regulator, the police or another authority with the legal power to demand it. FICA may prohibit us from telling anyone that a report has been made.
7.7If Clerify’s business is sold or merged, personal information that we hold as Responsible Party may be transferred to the successor, which must continue to protect it under this policy. Client Data stays under the instructions of the law firm that is the Responsible Party.
8. How long we keep information
8.1We keep personal information only as long as we need it for the purpose for which it was collected, or as long as the law requires, as section 14 of POPIA says.
8.2Client Data (we are the Operator). The law firm decides how long Client Data is kept. FICA requires the law firm, as an accountable institution, to keep customer due diligence records for at least five years after the end of the business relationship, and the law firm may have other legal or professional reasons to keep records for longer. The platform therefore keeps Client Data for as long as the law firm’s subscription is active and the law firm has not instructed us to delete it.
8.3When a subscription ends. Clerify keeps Client Data available for the law firm to export for 30 days after the date that the subscription ends. After that, we delete it using the process in section 9. The law firm is responsible for exporting any record that it must keep before the export period ends.
8.4Deletion on instruction. A law firm may instruct us at any time to delete a matter, a document or a person’s information, unless the law requires it to be kept. We carry out valid deletion instructions promptly.
8.5Our own records. The table below shows how long we keep information for which we are the Responsible Party.
| Information | How long we keep it |
|---|---|
| Account and billing records | For as long as the account is active and then for the period that tax and company law require, which is up to seven years |
| Website enquiries | For up to 24 months after the last contact, unless the person becomes a client, in which case the account records rules apply |
| Support correspondence | For the life of the account and 12 months afterwards |
| Security and access logs | For a limited period that is long enough to detect and investigate security incidents |
8.6We may keep information for longer where we have to preserve it because of a legal hold, a dispute or an investigation, but only for as long as that reason applies.
9. Deletion and crypto-shredding
9.1When Client Data has to be deleted, we use a process called crypto-shredding in addition to ordinary deletion.
9.2Every file is encrypted with its own unique key, and those keys are protected by a master key. To delete a file, we destroy its encryption key and delete the encrypted file. Once the key has been destroyed, the encrypted data cannot be read or recovered by anyone, including Clerify, whether or not an encrypted copy still exists.
9.3This matters for backups and replicas. Encrypted backup copies of a deleted file cannot be decrypted once its key has been destroyed, and they expire in the ordinary backup rotation cycle.
9.4On request, Clerify will confirm in writing to the law firm that deletion and crypto-shredding have been completed.
9.5Deletion does not apply to records that the law firm has exported and holds itself, or to information that the law requires us to keep.
10. How we protect information
10.1Sections 19 to 21 of POPIA require us to secure personal information with appropriate technical and organisational measures. Our measures include:
(a)hosting in South Africa on Amazon Web Services infrastructure;
(b)AES-256-GCM encryption for every file at rest, envelope encryption of the file keys, and encryption in transit;
(c)separation of each law firm’s Client Data from every other law firm’s;
(d)role-based access controls and least-privilege access for our personnel;
(e)a two-step access control for document recipients, namely an email address plus a one-time PIN;
(f)recipient-specific watermarking of delivered documents;
(g)an immutable, time-stamped audit trail of uploads, views, downloads and deletions;
(h)validation of uploaded documents so that illegible files are rejected; and
(i)confidentiality undertakings from our personnel and written data protection agreements with our sub-operators.
10.2No system is perfectly secure. If we have reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will act as follows. For Client Data, we will notify the law firm immediately, as section 21 of POPIA requires of an Operator, so that the law firm can notify the Information Regulator and the people affected. For information that we hold as Responsible Party, we will notify the Information Regulator and the people affected as soon as reasonably possible, as section 22 of POPIA requires.
11. Your rights under POPIA
11.1If you are the person whom the information is about (a data subject), you have the following rights:
(a)Access. You may ask whether we hold personal information about you and ask for a copy of it (POPIA section 23).
(b)Correction. You may ask us to correct or update personal information that is inaccurate, irrelevant, out of date, incomplete, misleading or obtained unlawfully (section 24).
(c)Deletion. You may ask us to delete or destroy personal information that we are no longer authorised to keep (section 24). Records that the law requires to be kept, such as FICA records, cannot be deleted before the legal period ends.
(d)Objection. You may object, on reasonable grounds, to the processing of your personal information, and you may object at any time to processing for direct marketing (sections 11(3) and 69).
(e)Withdraw consent. Where we rely on your consent, you may withdraw it at any time, without affecting processing that has already taken place (section 11(2)(b)).
(f)Be told about a security compromise. You are entitled to be told if your personal information has been accessed or acquired without authority (section 22).
(g)Complain. You may complain to the Information Regulator, and you may bring a civil claim for damages (sections 74 and 99).
11.2How to exercise your rights. If your information was collected through a law firm, please ask the law firm first, because it is the Responsible Party and decides how your information is used. If you send the request to us instead, we will forward it to the law firm within 5 business days and tell you that we have done so. We will help the law firm to respond. For information that we hold as Responsible Party, send your request to our Information Officer. We will respond within 30 days, and we may ask you to confirm your identity first. The law allows a prescribed fee to be charged for access requests in some cases.
11.3Information Regulator. If you are not satisfied with our response, you may complain to the Information Regulator (South Africa), at 33 Hoofd Street, Forum III, 3rd Floor, Braampark, Braamfontein, Johannesburg, email POPIAComplaints@inforegulator.org.za, or enquiries@inforegulator.org.za for general enquiries. The Regulator’s website is inforegulator.org.za.
12. Direct marketing
12.1We send direct marketing by electronic communication only as section 69 of POPIA permits, namely where the person has consented, or is an existing client and the message concerns our similar services. Every marketing message tells the recipient how to opt out, and we stop when asked to.
13. Cookies
13.1Our platform uses only strictly necessary cookies to authenticate your session and keep it secure. We do not use advertising or third-party tracking cookies. Details are in our Cookie Policy.
14. Changes to this policy
14.1We may update this policy as our services or the law change. We will publish the new version on this page with a new “last updated” date. If a change materially affects how we use personal information that we hold as Responsible Party, we will also tell the people affected in an appropriate way.
15. Contact us
15.1For privacy questions, requests or complaints, contact Clerify (Pty) Ltd, attention the Information Officer, Anga Ngcebetsha, at anga@forteintake.com or on +27 71 877 2496.