POPIA Information Notice

1. Responsible party

MRM Technologies (Pty) Ltd
Trading as: Encircle
Registration number: [●]
Email: hello@encircle.co.za

2. Information Officer

Name: [Information Officer name]
Email: privacy@encircle.co.za
Registered with the Information Regulator: [registration number]

3. Personal information collected

We collect and process the following personal information:

• Name, email address, job title, and organisation name
• Platform usage data (assessment answers, document uploads, feature interactions)
• Billing and subscription information
• Technical data (IP address, browser, device)
• Personal information contained in documents you upload (which may include information about directors, employees, or third parties)

4. Purpose of processing

Personal information is processed for the following purposes:

• Providing access to and operation of the Encircle Platform
• Generating governance assessments, scores, and remediation tasks
• Account management and user authentication
• Billing and subscription administration
• Customer support and communications
• Legal and regulatory compliance
• Platform security and fraud prevention
• Product improvement (using aggregated, de-identified data)

5. Legal basis for processing

We process personal information on the basis of:

• Contract (POPIA §11(1)(a)): processing necessary to deliver the subscribed services
• Legitimate interest (POPIA §11(1)(f)): platform security, fraud prevention, product improvement
• Legal obligation (POPIA §11(1)(c)): compliance with applicable South African law
• Consent (POPIA §11(1)(a)): for marketing and optional communications

6. Sharing of personal information

We share personal information only with:

• Cloud hosting and infrastructure providers under written operator agreements
• Payment processing providers (card details are not stored by us)
• Email and analytics service providers
• Encircle Network professionals — only when you explicitly request an introduction
• Legal and regulatory authorities when required by law

We do not sell personal information to third parties.

7. Cross-border transfers

Some processing may occur outside South Africa (e.g., cloud infrastructure). Where personal information is transferred across borders, we ensure compliance with POPIA §72 through appropriate contractual safeguards.

8. Retention

Personal information is retained for as long as your account is active and for a reasonable period thereafter, or as required by applicable law. Maximum retention period: 3 years after account closure, unless a longer period is legally required.

9. Your rights

As a data subject under POPIA, you have the right to:

• Access the personal information we hold about you (§23)
• Correction of inaccurate or incomplete information (§24)
• Deletion of your personal information in certain circumstances
• Object to processing
• Complain to the Information Regulator

Submit requests to: privacy@encircle.co.za

10. Information Regulator

You have the right to lodge a complaint with the Information Regulator of South Africa:
Website: justice.gov.za/inforeg
Email: inforeg@justice.gov.za