GovClerk Privacy Policy

1. Introduction

GovClerk (Pty) Ltd ("GovClerk", "we", "us", "our") is committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, store, and share your information when you use our services.

This policy applies to both of our products and their respective websites:

• GovClerkMinutes at https://govclerkminutes.com — our AI-powered meeting minutes generation platform.
• GovClerk Portal at https://govclerkpartners.org — our public transparency portal for government organisations.

These websites are collectively referred to as "our Sites" and the services provided through them as "our Services."

By using our Services, you consent to the data practices described in this Privacy Policy. If you do not agree with any part of this policy, please discontinue use of our Services.

2. International Users

Depending on your location, one or more of the following frameworks apply to you:

• South Africa — the Protection of Personal Information Act (POPIA). See Section 3.
• United Kingdom and European Union — the UK GDPR and the EU General Data Protection Regulation (GDPR). See Section 4.
• California and other US states — the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA). See Section 5.
• Australia — the Privacy Act 1988 (Cth) and the Australian Privacy Principles. See Section 6.
• New Zealand — the Privacy Act 2020 and the Information Privacy Principles. See Section 7.

If you are located in a jurisdiction not listed above, we still apply the core privacy protections and data subject rights described throughout this policy as our baseline commitment to all users, regardless of where you are based.

Regardless of your location, GovClerk does not sell your personal information to third parties, for cash or any other valuable consideration. This is true across all regions we serve — see Section 10 for details on how we share information.

3. POPIA Compliance (South Africa)

GovClerk acts as a Responsible Party under POPIA. This means we determine the purpose of and means for processing your personal information and are accountable for ensuring that processing complies with the Act.

Information Officer

Our designated Information Officer, responsible for overseeing compliance with POPIA and handling data-related enquiries, is:

Cliff
Email: cliff@govclerkminutes.com

Your Rights Under POPIA

As a data subject under POPIA, you have the following rights:

• The right to access your personal information held by us.
• The right to request correction of inaccurate, irrelevant, excessive, out-of-date, incomplete, misleading, or unlawfully obtained personal information.
• The right to request deletion or destruction of your personal information.
• The right to object to the processing of your personal information.
• The right to lodge a complaint with the Information Regulator of South Africa.

See Section 13 for full details on how to exercise these rights.

4. GDPR Compliance (UK and EU)

For UK and EU users, GovClerk generally acts as the data controller for personal data collected directly through our Sites (such as account and billing information), and as a data processor on behalf of our GovClerk Portal customers in respect of meeting data they submit for processing.

Legal Basis for Processing

We rely on the following legal bases to process your personal data under the GDPR:

• Contract — processing necessary to provide our Services to you.
• Consent — for marketing communications and non-essential cookies, which you may withdraw at any time.
• Legitimate interests — for improving our Services, security, and fraud prevention, balanced against your rights and freedoms.
• Legal obligation — where processing is required to comply with law.

Your Rights Under GDPR

As a data subject under the GDPR, you have the following rights:

• Right of access — you may request a copy of the personal data we hold about you.
• Right to rectification — you may request that we correct inaccurate or incomplete personal data.
• Right to erasure ("right to be forgotten") — you may request that we delete your personal data, subject to certain legal exceptions.
• Right to restriction of processing — you may request that we limit how we use your personal data in certain circumstances.
• Right to data portability — you may request a copy of your personal data in a structured, commonly used, machine-readable format, and request that we transmit it to another controller where technically feasible.
• Right to object — you may object to processing based on legitimate interests, including profiling, and to processing for direct marketing purposes at any time.
• Right not to be subject to automated decision-making — including profiling that produces legal or similarly significant effects concerning you.
• Right to lodge a complaint — with your local supervisory authority (see below).

International Data Transfers

Where we transfer personal data of UK or EU individuals outside the UK or EEA (for example, to our cloud hosting provider), we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs) or the UK's International Data Transfer Addendum, to ensure your data continues to receive an adequate level of protection.

Supervisory Authority

If you are in the UK, you may lodge a complaint with the Information Commissioner's Office (ICO). If you are in the EU, you may lodge a complaint with the data protection authority in your member state.

How to Exercise Your Rights

To exercise any of the rights listed above, please contact our Information Officer at cliff@govclerkminutes.com. We will respond without undue delay and in any event within one month of receiving your request, as required by the GDPR.

5. CCPA Compliance (California/US)

The categories of personal information we collect are described in Section 8 (Information We Collect), and the purposes for which we use it are described in Section 9 (How We Use Your Information).

Your Rights Under CCPA

As a California consumer, you have the following rights:

• Right to know — you may request that we disclose the categories and specific pieces of personal information we have collected about you, the sources of that information, and the purposes for collecting it.
• Right to delete — you may request that we delete personal information we have collected from you, subject to certain legal exceptions.
• Right to opt-out of sale or sharing — you may direct us not to sell or share your personal information. As described below, GovClerk does not sell or share personal information, so there is nothing to opt out of today.
• Right to correct — you may request that we correct inaccurate personal information we maintain about you.
• Right to non-discrimination — we will not discriminate against you for exercising any of your CCPA rights.

Do Not Sell or Share My Personal Information

GovClerk does not sell or share personal information for cross-context behavioural advertising, and has not done so in the preceding 12 months. Because we do not sell or share personal information, we do not currently operate a "Do Not Sell or Share My Personal Information" link. If you would like to submit a request out of an abundance of caution, or have questions about our data practices, contact us using the details below and we will honour your request.

How to Exercise Your Rights

To submit a verifiable consumer request, please contact us at cliff@govclerkminutes.com or support@govclerkminutes.com. We may need to verify your identity before fulfilling your request. We will respond within the timeframes required by the CCPA.

6. Australian Privacy Act 1988

Your Rights Under the Australian Privacy Act

As an individual protected by the Australian Privacy Act, you have the right to:

• Access the personal information we hold about you.
• Request correction of personal information that is inaccurate or out of date.
• Deal with us anonymously or under a pseudonym where it is lawful and practicable to do so.
• Be notified of a data breach that is likely to result in serious harm, in accordance with the Notifiable Data Breaches scheme.
• Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) if you believe we have mishandled your personal information.

How to Exercise Your Rights

To exercise any of the rights listed above, please contact us at cliff@govclerkminutes.com.

Office of the Australian Information Commissioner (OAIC)

If you are not satisfied with our response, you may contact the OAIC: https://www.oaic.gov.au

7. New Zealand Privacy Act 2020

Your Rights Under the New Zealand Privacy Act

As an individual protected by the New Zealand Privacy Act, you have the right to:

• Access the personal information we hold about you.
• Request correction of personal information that is inaccurate or out of date.
• Be notified if a privacy breach has occurred that has caused, or is likely to cause, serious harm, in accordance with New Zealand's mandatory breach notification requirements.
• Complain to the Office of the Privacy Commissioner if you believe we have mishandled your personal information.

How to Exercise Your Rights

To exercise any of the rights listed above, please contact us at cliff@govclerkminutes.com.

Office of the Privacy Commissioner (New Zealand)

If you are not satisfied with our response, you may contact the Privacy Commissioner: https://www.privacy.org.nz

8. Information We Collect

Personal Information

We may collect the following personal information when you register or use our Services:

• Full name
• Email address
• Phone number
• Workplace or organisation name
• Job title or role
• Billing information (processed securely via PayStack)

Meeting Data (GovClerkMinutes)

When you use GovClerkMinutes, we collect and process:

• Meeting recordings (audio and/or video)
• Transcripts generated from recordings
• Meeting minutes and summaries
• Agendas and templates
• Speaker labels and identification data

Portal Data (GovClerk Portal)

When you use GovClerk Portal, we collect and process:

• Organisation settings and configuration
• Portal configurations and branding settings
• Published meeting documents and records
• Live broadcast data

Technical Information

We automatically collect certain technical information when you visit our Sites:

• IP address
• Browser type and version
• Device information
• Cookies and similar tracking technologies
• Usage data (pages visited, features used, time on site)
• Referring URLs

Communication Data

We collect information from communications you have with us, including:

• Support messages and tickets
• WhatsApp conversations
• Email correspondence

9. How We Use Your Information

We use the information we collect for the following purposes:

• To provide and maintain our Services (GovClerkMinutes and GovClerk Portal).
• To process your meetings: transcription, minutes generation, and speaker identification.
• To manage your account and subscriptions.
• To process payments securely via PayStack.
• To communicate with you, including support responses, service updates, and marketing communications (with your consent).
• To improve our Services and develop new features based on usage patterns.
• To comply with our legal obligations under applicable law, including POPIA, GDPR, CCPA, the Australian Privacy Act, and the New Zealand Privacy Act.
• To send notifications about your GovClerk Portal (for Portal users), including meeting publications and live broadcast alerts.

10. How We Share Your Information

We do NOT sell your personal information to third parties for marketing or any other commercial purpose. This applies regardless of where you are located.

We may share your information in the following limited circumstances:

Service Providers

We work with trusted third-party service providers who assist us in operating our Services. These providers are contractually bound to process your data only in accordance with our instructions and applicable law:

• AI Transcription Services — for meeting transcription and minutes generation.
• Cloud Hosting (AWS) — for secure data storage and infrastructure.
• Email Delivery (Postmark) — for transactional and service-related emails.
• Payment Processing (PayStack) — for subscription and billing management.
• Analytics (PostHog) — for usage analytics to improve our Services.
• CRM (Brevo) — for customer relationship management.

Legal Requirements

We may disclose your information if required to do so by law, regulation, or valid legal process (such as a court order or subpoena), or if we believe in good faith that such disclosure is necessary to protect the rights, property, or safety of GovClerk, our users, or the public.

Business Transfers

In the event of a merger, acquisition, or sale of all or a portion of our assets, your personal information may be transferred to the acquiring entity. We will notify you via email or a prominent notice on our Sites prior to any such transfer.

With Your Consent

We may share your information for other purposes when you have explicitly authorised us to do so.

GovClerk Portal — Public Documents

Meeting documents published to your public GovClerk Portal are accessible to the general public by design. This is the core purpose of the transparency portal — enabling government organisations to share meeting records with citizens and stakeholders. Please ensure you only publish documents you intend to make publicly available.

11. Data Storage and Security

We take the security of your personal information seriously and implement appropriate technical and organisational measures to protect it:

• Data is stored on secure cloud infrastructure provided by Amazon Web Services (AWS).
• Data is encrypted at rest and in transit using industry-standard encryption protocols.
• Access controls and user authentication are managed via Clerk.
• We conduct regular security assessments to identify and address vulnerabilities.
• Our data handling practices align with SOC 2 compliant standards.

Despite our best efforts, no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security. By using our Services, you acknowledge and accept this inherent risk.

12. Cookies and Tracking

We use cookies and similar tracking technologies to enhance your experience on our Sites. Cookies are small text files stored on your device that help us recognise you and remember your preferences.

Essential Cookies

These cookies are necessary for authentication and session management. They cannot be disabled as they are required for our Services to function.

Analytics Cookies

We use PostHog to collect anonymised analytics data that helps us understand how users interact with our Sites and improve our Services.

Marketing Cookies

We use Meta Pixel for advertising purposes to measure the effectiveness of our marketing campaigns. These cookies are only placed with your consent.

Managing Cookies

You can control and manage cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of our Services. For more information, refer to your browser's help documentation.

13. Your Rights Under POPIA

As a data subject, you have the following rights under POPIA and we are committed to facilitating the exercise of those rights:

• Right to be informed — You have the right to know what personal information we collect and how we use it (as set out in this policy).
• Right of access — You may request a copy of the personal information we hold about you.
• Right to correction — You may request that we correct any inaccurate or incomplete personal information.
• Right to deletion — You may request that we delete your personal information, subject to our legal obligations to retain certain data.
• Right to object — You may object to the processing of your personal information in certain circumstances.
• Right against automated decision-making — You have the right not to be subject to a decision based solely on automated processing that significantly affects you.
• Right to lodge a complaint — If you are unhappy with how we handle your personal information, you may lodge a complaint with the Information Regulator of South Africa (see Section 20).

How to Exercise Your Rights

To exercise any of the rights listed above, please contact our Information Officer at cliff@govclerkminutes.com or our support team at support@govclerkminutes.com. We will respond to your request within a reasonable time and in accordance with POPIA.

If you are located outside South Africa, see Section 2 (International Users) for the rights and contact details that apply under GDPR, CCPA, the Australian Privacy Act, or the New Zealand Privacy Act.

14. Data Retention

• We retain your personal information for as long as your account remains active.
• Meeting recordings and transcripts are retained for as long as you maintain your subscription.
• Following account deletion or subscription cancellation, your data will be purged within 30 days, subject to any legal obligations.
• Some information may be retained for a longer period if required by applicable law or regulation.

15. Children's Privacy

Our Services are not directed to anyone under the age of 18. We do not knowingly collect personal information from children under 18 years of age. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us immediately at cliff@govclerkminutes.com and we will take steps to remove such information from our systems.

16. International Data Transfers

Your personal information may be processed in countries outside South Africa, including the United States, where our cloud hosting provider (AWS) operates data centres. Where such cross-border transfers occur, we ensure that appropriate safeguards are in place as required by POPIA, including contractual protections to ensure your data receives an equivalent level of protection to that afforded within South Africa.

For UK and EU users, cross-border transfers are additionally safeguarded using mechanisms such as Standard Contractual Clauses, as described in Section 4 (GDPR Compliance).

17. Third-Party Links

Our Sites may contain links to third-party websites or services. We are not responsible for the privacy practices or content of those sites. This Privacy Policy applies solely to information collected by GovClerk through our Sites and Services. We encourage you to review the privacy policies of any third-party sites you visit.

18. Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time. Significant changes will be communicated to you via email to the address associated with your account, or by placing a prominent notice on our Sites. Such changes will take effect 30 days after notification to allow you time to review the updated policy.

Non-material changes or clarifications will take effect immediately upon posting. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

19. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the way we handle your personal information, please contact us:

GovClerk (Pty) Ltd
Information Officer: Cliff
Email: cliff@govclerkminutes.com
Support: support@govclerkminutes.com
WhatsApp: +27 66 425 9236
Websites: https://govclerkminutes.com | https://govclerkpartners.org

20. Information Regulator of South Africa

If you are not satisfied with how we have handled your personal information or your complaint, you have the right to lodge a complaint with the Information Regulator of South Africa:

The Information Regulator (South Africa)
Email: complaints.IR@justice.gov.za
Website: https://inforegulator.org.za

If you are located outside South Africa, see Section 2 (International Users) for the supervisory authority relevant to your region.