Privacy Policy
Your privacy and personal information are paramount to us.
Effective Date: May 31, 2025
Introduction and Purpose
Thwala Attorneys ("we," "our," or "us") is committed to protecting your privacy and safeguarding your personal information in accordance with the Protection of Personal Information Act, 4 of 2013 (POPIA), and other applicable South African laws. This Privacy Policy outlines how we collect, use, disclose, store, and protect your personal information when you engage with our website, utilise our legal services, or communicate with us. We understand the importance of maintaining the confidentiality and integrity of your information, especially within the attorney-client relationship. Please read this Privacy Policy carefully to understand our practices regarding your personal information.
Information We Collect and How We Collect It
Personal Information You Provide to Us
We collect personal information that you voluntarily provide to us when you inquire about or retain our legal services, subscribe to our newsletters, or contact us. This may include, but is not limited to:
- Identity Data: Name, surname, date of birth, identity number/passport details, and marital status.
- Contact Data: Email address, postal address, residential address, and telephone numbers.
- Financial Data: Bank account details, payment information for billing purposes, and financial history relevant to your legal matter.
- Legal Matter Information: Details pertaining to your legal case, including sensitive personal information as defined by POPIA, such as health information, criminal records, or trade union membership, where relevant to the legal services we provide.
- Communication Data: Any information you provide in correspondence with us, including emails, letters, and records of phone calls.
- Employment Data: Occupation, job title, and employment history, if relevant to your legal matter.
Information Collected Automatically
When you visit our website, we may automatically collect certain information about your device and Browse activity through cookies and similar technologies. This helps us improve our website and your user experience. This information may include:
- Technical Data: Internet Protocol (IP) address, browser type and version, time zone setting, browser plug-in types and versions, operating system, and platform.
- Usage Data: Information about how you use our website, including pages viewed, time spent on pages, navigation paths, and referring website addresses.
- Device Data: Information about the device you use to access our website, including hardware model, unique device identifiers, and mobile network information.
For more details on how we use cookies, please refer to our Cookie Policy (if applicable - consider adding a separate Cookie Policy page).
How We Use Your Personal Information
We use the personal information we collect for the following legitimate purposes, based on legal grounds as required by POPIA:
Provision of Legal Services
To provide you with comprehensive legal representation, advice, and related services, fulfilling our contractual obligations to you.
Communication and Client Management
To communicate with you regarding your legal matter, respond to your inquiries, provide updates, and manage our client relationship effectively.
Billing and Financial Administration
To process payments for our services, issue invoices, manage accounts, and comply with financial regulations.
Legal and Regulatory Compliance
To comply with our legal and regulatory obligations, including those imposed by the Legal Practice Council, court orders, and other applicable laws.
Service Improvement and Analysis
To analyse website usage and trends to improve our website's functionality, content, and the overall user experience.
Security and Fraud Prevention
To ensure the security of our systems and protect against fraudulent activities or unauthorized access to information.
Legal Basis for Processing Personal Information
We process your personal information based on the following legal justifications as outlined in POPIA:
- The processing is necessary for the performance of a contract to which you are a party (e.g., providing legal services).
- The processing is necessary for compliance with a legal obligation to which we are subject (e.g., FICA requirements, regulatory reporting).
- You have given your express consent to the processing of your personal information for one or more specific purposes.
- The processing is necessary for the pursuit of our legitimate interests or the legitimate interests of a third party to whom the information is supplied, provided that such interests are not overridden by your fundamental rights and freedoms.
- The processing is necessary for the protection of your legitimate interests or the legitimate interests of a third party.
Information Sharing and Disclosure
We are committed to maintaining the confidentiality of your personal information. We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following limited circumstances and strictly for the purposes for which it was collected or as legally required:
- With your explicit consent: We will only share your personal information with third parties when you have provided us with clear and informed consent to do so for a specific purpose.
- For legal and regulatory compliance: To comply with court orders, subpoenas, legal processes, governmental regulations, or requests from regulatory bodies such as the Legal Practice Council.
- To service providers and operators: With trusted third-party service providers who assist us in operating our business and providing our services (e.g., IT support, accounting, document management). These parties are bound by strict confidentiality agreements and POPIA compliance requirements and are only authorised to use your information as necessary to perform their services for us.
- In connection with your legal matter: As necessary for the effective representation of your legal matter, which may include sharing with opposing counsel, courts, experts, or other relevant parties involved in your case, strictly in accordance with legal professional privilege and your instructions.
- Business transfers: In the event of a merger, acquisition, or sale of all or a portion of our assets, your personal information may be transferred to the acquiring entity, subject to their commitment to protect your privacy in a manner consistent with this policy.
Trans-border Flow of Personal Information
We generally process personal information within South Africa. However, should it be necessary to transfer your personal information to a recipient in a foreign country for the purpose of providing legal services (e.g., international litigation, cross-border transactions), we will ensure that such transfers comply with POPIA's requirements. This includes verifying that the recipient country has similar data protection laws or that the transfer is based on a binding agreement that ensures adequate levels of protection. We will always inform you and obtain your consent where required before any such transfer takes place.
Data Security and Retention
We implement robust technical and organizational security measures to protect your personal information against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include, but are not limited to, encryption, firewalls, secure servers, access controls, and regular security audits. Our staff are trained on data protection principles and are bound by strict confidentiality obligations.
While we strive to use commercially acceptable means to protect your personal information, no method of transmission over the internet or electronic storage is 100% secure. Therefore, we cannot guarantee absolute security. In the event of a data breach, we will comply with our legal obligations under POPIA, including notifying affected individuals and the Information Regulator where required.
We retain your personal information for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. This period is determined by the nature of the information, the legal services provided, and any applicable legal or regulatory retention periods (e.g., FICA, Legal Practice Act).
Your Rights Under POPIA
As a data subject, you have specific rights concerning your personal information under the Protection of Personal Information Act (POPIA). You have the right to:
Right to Access
Request access to the personal information we hold about you. We will provide this information in a clear and understandable format.
Right to Correction/Rectification
Request the correction or update of any inaccurate, incomplete, or outdated personal information we hold about you.
Right to Deletion/Erasure (Restriction of Processing)
Request the destruction or deletion of your personal information, where permitted by law and where we no longer have a legal basis or legitimate interest to retain it.
Right to Object to Processing
Object to the processing of your personal information, particularly if the processing is for direct marketing purposes or based on legitimate interests that are overridden by your rights.
Right to Lodge a Complaint
Lodge a complaint with the Information Regulator of South Africa if you believe your rights under POPIA have been infringed.
Right to Withdraw Consent
Withdraw your consent at any time where we are relying on consent to process your personal information. This will not affect the lawfulness of any processing carried out before you withdraw your consent.
To exercise any of these rights, please contact us using the details provided in the "Contact Us" section below. We may require specific information from you to help us confirm your identity and ensure your right to access your personal information or to exercise any of your other rights.
Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please do not hesitate to contact us.
Thwala Attorneys
Suite No.4 Commerce & Industry Chambers, 235 Meyer Street, Germiston, 1401, South Africa
Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect changes in our practices, technology, or legal requirements. When we make significant changes, we will notify you by posting the revised Privacy Policy on this page and updating the "Effective Date" at the top. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. Your continued use of our services or website after any changes signifies your acceptance of the updated Privacy Policy.