Privacy Policy

1. Who is responsible

FlexiMetaDoc (Pty) Ltd, registration 2025/073742/07, is responsible for personal information it uses for its own accounts, billing, security, support and business administration. Contact the Information Officer through hardus.vandyk@fleximetadoc.com and use the subject “Privacy / Information Officer”.

For documents, survey responses and workflow data controlled by a customer organisation, that organisation is normally the responsible party and we are its operator. Its own collection notice should identify its purposes and contact. We assist with requests concerning that data under its lawful instructions. You may still contact us if you do not know which organisation controls a record.

2. Information, sources and purposes

• Account and contact details supplied by you or your organisation: names, business contact details, authentication identifiers, membership and optional profile information, to create and administer access.
• Customer content and processing results: forms, responses, uploaded documents, extracted fields, workflow instructions and execution records, as needed to provide the selected service. Contents may include information about other people; the customer must identify the lawful purpose and restrictions.
• Billing details and payment references supplied by you, your organisation or the payment provider, for invoicing, reconciliation, authorised collection and financial records. Do not send card credentials to support.
• Technical and security records generated by use: IP address, browser/device information, timestamps, authentication and access events, request and error information, for operation, security, incident investigation and evidence.
• Support correspondence, rights requests and communications, for assistance, dispute resolution and compliance. Optional product research or marketing must have its own lawful basis.

Information necessary to create an account, carry out an order or secure the service is required for those purposes; withholding it may prevent the relevant service. Optional information is identified as such. We do not collect every category for every person.

3. Legal grounds and limits

We assess the ground for each purpose under POPIA: consent where appropriate; steps requested before a contract or performance of a contract; compliance with law; and legitimate interests of the data subject, us or another party where lawful and balanced against the person’s interests. Consent to this notice is not a substitute for that assessment. We use information only for the stated purpose or compatible further processing permitted by law.

You may withdraw consent for future consent-based processing without affecting prior lawful processing. Other lawful obligations may continue. Special personal information and children’s information require an applicable POPIA authorisation, suitable safeguards and, where necessary, consent of a competent person. Customers must not upload such information merely because a field or file-upload feature exists.

4. Recipients, AI providers and transfers

Depending on the service, recipients may include authorised customer users; hosting, infrastructure, communications, payment, support and AI providers; professional advisers; and authorities where disclosure is lawful. Access is limited to the purpose and appropriate confidentiality and security obligations. Customer-selected integrations may process information independently under their own notices.

AI features may transmit the submitted content and required context to the provider used for that feature. The provider, processing purpose, relevant location and retention or training restrictions must be established for the deployment before sensitive or regulated content is processed. Platform acceptance is not permission for unrelated model training. We do not claim that every AI provider has identical retention or training practices.

Processing outside South Africa is subject to POPIA section 72: an adequate law, binding rules or agreement, or another applicable statutory basis. We must assess onward transfers as well. An EU contractual clause alone is not a universal assurance of POPIA compliance. Any GDPR safeguards apply only where that law applies. Contact hardus.vandyk@fleximetadoc.com for the recipients and locations relevant to your service. No local-only residency is promised by this notice.

5. Security and incidents

We must apply reasonable, appropriate technical and organisational measures to protect confidentiality and integrity, identify foreseeable risks, maintain safeguards and review them. Controls depend on the service and deployment. This notice is not an ISO, SOC, PCI or other certification, a universal encryption-at-rest assurance, or a promise that incidents cannot occur.

Where we act as operator, we must notify the responsible party immediately when we have reasonable grounds to believe its personal information has been accessed or acquired by an unauthorised person. Where we are responsible party, we notify the Information Regulator and affected data subjects as soon as reasonably possible as required by POPIA section 22, subject to lawful exceptions or authorised delay. We do not wait for a completed investigation or apply a GDPR-only 72-hour or high-risk threshold in place of POPIA. Report concerns to hardus.vandyk@fleximetadoc.com.

6. Retention and deletion

We retain information only for as long as its purpose or an applicable legal, contractual or evidential requirement permits. Customer content follows the agreed service retention and deletion instructions; financial and company records follow their applicable statutory periods; security logs and support records follow documented operational needs; legal holds preserve relevant evidence. There is no single retention period for every record.

When retention is no longer authorised, information must be deleted, destroyed or de-identified so it cannot be reconstructed in an identifiable form. Backup removal may follow protected rotation cycles; information retained during that period remains restricted. Closing an account does not automatically erase another organisation’s records, outstanding financial records or evidence that must lawfully be kept. Ask us for the schedule and restrictions relevant to your records.

7. Your rights and requests without an account

You do not need an account, a paid subscription or access to our request tracker to exercise your rights. Email hardus.vandyk@fleximetadoc.com identifying the records, the right you wish to exercise and a safe reply method. We ask only for proportionate proof of identity or authority and provide a secure route if further evidence is necessary.

• Request confirmation whether we hold personal information and access to it under POPIA section 23 and the applicable PAIA procedure. A request for confirmation is free; any permitted access or reproduction fee must be explained before it is incurred.
• Request correction or deletion of inaccurate, irrelevant, excessive, outdated, incomplete, misleading or unlawfully obtained information, or destruction of records we are no longer authorised to retain, under section 24. See correction requests.
• Object to eligible processing under section 11, or request restriction in the circumstances in section 14(6), including disputed accuracy or processing. See restriction and objection. Direct-marketing objections can be made at any time.
• Challenge qualifying solely automated decisions under section 71. Where required, you must have an opportunity to make representations and receive sufficient information about the underlying processing logic. See automated-decision requests.
• Request an available data export through data export requests. POPIA does not create a general GDPR-style portability right; GDPR article 20 applies only when its jurisdictional and substantive conditions are met.

We explain the applicable process, any lawful restriction and the response. PAIA requests are normally decided within 30 calendar days, with a further lawful extension of up to 30 days where justified and notified; other POPIA requests are addressed within the applicable reasonable period. Submission is a request receipt, not proof of fulfilment. The access-to-information page links the prescribed forms and complaint route.

8. Marketing and browser storage

We send unsolicited electronic direct marketing only where POPIA section 69 permits it, including valid consent or the limited existing-customer exception for our own similar offerings with the required opt-out opportunities. Each marketing communication must identify the sender and provide a free, effective way to object. Service and security notices are separate from optional marketing. A privacy acknowledgement or platform contract is not marketing consent.

The Cookies and Similar Technologies notice explains essential and preference storage and the conditions for optional tracking. Where consent is required, optional tracking must not start beforehand, and withdrawal must be respected.

9. Complaints and notice changes

Contact hardus.vandyk@fleximetadoc.com with a concern or complain directly to the Information Regulator (South Africa). Current complaint guidance and forms are available on its website and eServices portal. Our internal process is not a precondition to a statutory complaint.

We update this notice when processing changes and give appropriate notice of material changes. New purposes or consent requirements must be addressed before processing starts; a website update does not itself authorise them.

Service providers and retention information

Optional first-party newsroom measurement uses random browser identifiers, article/page paths, referral hostnames, reading time and interactions only after you opt in. It is separate from account security and service logs. Use your analytics choice to allow or withdraw it; withdrawal removes the stored newsroom identifiers and stops future browser events.

The Processing and Retention Schedule identifies supported provider routes, data categories and retention controls. Read the schedule with the service-specific order and instructions. A supported integration is used only where selected and enabled; provider-specific processing locations, downstream recipients, retention and transfer safeguards must be established for that service.