POPIA Policy

This policy explains how PGH Attorneys collects, uses, stores, shares, and protects personal information.

We process personal information in accordance with the Protection of Personal Information Act, 4 of 2013, and other laws that apply to our practice.

This policy applies to clients, prospective clients, website visitors, suppliers, service providers, correspondents, job applicants, and other persons whose personal information we process.

PGH Attorneys is the responsible party for the personal information that it determines the purpose and means of processing.

Our Information Officer may be contacted through our public contact details.

We may process:

1. names, identity numbers, registration numbers, and contact details;
2. addresses, employment details, financial information, tax information, and banking details;
3. information provided in enquiries, mandates, consultations, correspondence, affidavits, pleadings, contracts, and other legal documents;
4. information required for FICA, client onboarding, conflict checks, and risk assessments;
5. information obtained from public records, courts, tribunals, regulators, CIPC, deeds records, credit bureaus, tracing tools, verification providers, SearchWorks, WinDeed, and similar lawful sources;
6. website usage information, including device, browser, IP address, and cookie-related information;
7. recruitment information, where a person applies for work; and
8. any other information reasonably required for legal services, compliance, administration, or lawful business purposes.

Where necessary and lawful, we may process special personal information, including information about health, finances, criminal allegations, race, trade union membership, family circumstances, children, or legal disputes.

We may collect personal information:

1. directly from you;
2. from clients, witnesses, opponents, correspondents, attorneys, advocates, experts, service providers, courts, tribunals, regulators, and public bodies;
3. from public registers and lawful verification or aggregation services;
4. through our website, email systems, forms, and communication platforms; and
5. through service providers who assist with hosting, IT, cybersecurity, document management, administration, analytics, or compliance.

We process personal information to:

1. respond to enquiries;
2. assess whether we can assist;
3. conduct conflict checks;
4. complete client onboarding, FICA checks, and risk assessments;
5. take instructions and provide legal services;
6. prepare advice, agreements, correspondence, pleadings, affidavits, notices, opinions, and other legal documents;
7. communicate with clients, prospective clients, suppliers, service providers, courts, regulators, and other persons;
8. brief advocates, experts, correspondents, sheriffs, tracers, investigators, auditors, accountants, and other professional service providers;
9. comply with court rules, professional rules, FICA, POPIA, PAIA, tax laws, accounting duties, and other legal obligations;
10. manage billing, accounting, records, and practice administration;
11. send legal updates, invitations, and similar communications where lawful;
12. consider employment applications;
13. secure, maintain, and improve our website, IT systems, and records;
14. detect, prevent, and respond to fraud, cyber incidents, unlawful conduct, or misuse of our systems; and
15. protect our rights, our clients’ rights, and the rights of third parties.

We process personal information only where POPIA or another law allows us to do so.

Depending on the circumstances, we may process personal information because:

1. you have consented to the processing;
2. processing is necessary to perform a contract or to take steps before entering into a contract;
3. processing is necessary to comply with a legal obligation;
4. processing protects a legitimate interest of ours, our clients, you, or a third party;
5. processing is necessary for legal advice, legal claims, litigation, dispute resolution, investigations, or regulatory processes; or
6. processing is otherwise required or permitted by law.

Where we rely on consent, you may withdraw that consent. Withdrawal does not affect processing that took place before withdrawal, or processing that may continue on another lawful basis.

We do not sell personal information.

We may share personal information where necessary and lawful with:

1. our directors, partners, attorneys, candidate attorneys, consultants, and employees;
2. advocates, correspondent attorneys, experts, investigators, sheriffs, tracers, auditors, accountants, and other professional advisers;
3. clients and persons involved in legal matters, where appropriate;
4. courts, tribunals, regulators, law-enforcement bodies, professional bodies, and public bodies;
5. FICA, identity-verification, CIPC, deeds, credit bureau, tracing, and compliance service providers;
6. banks, payment providers, and other financial institutions;
7. website, hosting, email, cloud, cybersecurity, document-management, analytics, and administration service providers; and
8. any other person where disclosure is required or permitted by law.

We do not disclose privileged or confidential information unless authorised, required by law, required for the proper conduct of a matter, or otherwise permitted by professional duties.

Where a service provider processes personal information for us, we require appropriate confidentiality, security, and processing safeguards.

Service providers may process personal information only for authorised purposes and must protect it against unauthorised access, loss, disclosure, alteration, or destruction.

Some of our systems or service providers may be located outside South Africa or may store information outside South Africa.

Where we transfer personal information outside South Africa, we will do so only where POPIA permits it and where appropriate safeguards are in place.

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, unless a longer period is required or permitted by law.

Retention periods may depend on legal, professional, regulatory, tax, accounting, litigation, risk-management, and record-keeping requirements.

When personal information is no longer required, we will delete, destroy, de-identify, or archive it in a lawful and secure manner.

We take reasonable and appropriate technical and organisational measures to protect personal information against loss, unauthorised access, unlawful processing, disclosure, alteration, or destruction.

These measures may include access controls, secure storage, confidentiality undertakings, cybersecurity safeguards, staff training, service-provider controls, and incident-response processes.

No website, email system, or electronic communication is completely secure. You should take care when sending information through the internet.

Subject to POPIA, PAIA, legal privilege, professional duties, and other applicable laws, you may have the right to:

1. ask whether we hold your personal information;
2. request access to your personal information;
3. request correction of inaccurate or incomplete personal information;
4. request deletion of personal information where we are no longer entitled to retain it;
5. object to certain processing of your personal information;
6. withdraw consent where processing is based on consent;
7. object to direct marketing; and
8. complain to the Information Regulator.

We may refuse, limit, or defer a request where the law permits or requires us to do so, including where legal privilege, client confidentiality, litigation, professional duties, or statutory retention obligations apply.

We may send legal updates, invitations, newsletters, or similar communications where you have consented to receive them or where the law otherwise permits us to do so.

You may opt out at any time by using the unsubscribe link in the communication or by contacting us.

We will not use your personal information for unlawful direct marketing.

Our website is not directed at children.

We will not knowingly collect personal information from a child through the website without the consent of a competent person, unless the law permits us to do so.

Where we process children’s personal information in the course of legal services, we will do so only where necessary and lawful.

You may contact us through our public contact details if you have a question or complaint about the way we process personal information.

You may also complain to the Information Regulator.

We may update this policy from time to time.

The latest version will be published on our website.

Related website notices are available in our Privacy Policy, Cookie Policy, and PAIA information page.

Public contact details: info@pgh.africa, +2761-464-3479.