1. Who we are
MRM Technologies (Pty) Ltd (“Encircle”, “we”, “us”) is a responsible party as defined in the Protection of Personal Information Act 4 of 2013 (POPIA). We operate the Encircle governance intelligence platform.
Our Information Officer is responsible for ensuring POPIA compliance. Contact details are at the end of this policy.
2. What personal information we collect
We collect and process the following categories of personal information:
- Account information: name, email address, job title, and organisation name when you register.
- Usage data: how you interact with the Platform — pages visited, features used, assessment answers, documents uploaded.
- Documents you upload: governance policies, board minutes, compliance evidence, and other documents you submit through the Platform. These may contain personal information about directors, employees, or third parties.
- Communication records: emails and messages you send to us.
- Payment information: billing contact details. Card payments are processed by our payment provider and we do not store card numbers.
- Technical data: IP address, browser type, device identifiers, and access logs.
3. Why we process your information
We process your personal information for the following purposes:
- Providing and improving the Platform (performance of contract).
- Creating and managing your account.
- Generating governance scores, assessments, and remediation tasks.
- Communicating with you about your account, updates, and support.
- Billing and subscription management.
- Improving our AI features and framework mappings (using aggregated, de-identified data).
- Complying with our legal obligations.
- Detecting and preventing fraud and security incidents.
4. Legal basis for processing (POPIA conditions)
We process personal information on one or more of the following grounds:
- Contract: processing is necessary to deliver the Platform services you have subscribed to.
- Legitimate interest: improving platform security and functionality.
- Legal obligation: to comply with applicable South African law.
- Consent: for marketing communications (you can withdraw consent at any time).
5. How we share your information
We do not sell your personal information. We share it only in the following circumstances:
- Service providers: cloud hosting, analytics, email delivery, and payment processing providers who process data on our behalf under written operator agreements.
- Professional advisors: auditors and legal counsel under confidentiality obligations.
- Encircle Network partners: only if you explicitly request an introduction to an auditor or advisor through the Platform.
- Legal requirements: if required by law, court order, or regulatory authority.
- Business transfers: in the event of a merger, acquisition, or sale of assets, subject to the acquiring party maintaining equivalent privacy protections.
6. International transfers
Some of our service providers are located outside South Africa. Where personal information is transferred to a third country, we ensure that adequate safeguards are in place as required by POPIA §72, including contractual protections equivalent to those required under POPIA.
7. How long we keep your information
We retain your personal information for as long as your account is active and for a reasonable period thereafter to comply with our legal obligations, resolve disputes, and enforce our agreements. On account closure, we will retain data for a maximum of 3 years unless a longer period is required by law.
8. Security
We implement appropriate technical and organisational security measures to protect your personal information against unauthorised access, loss, or destruction. See our Security page for details.
9. Your rights
Under POPIA, you have the right to:
- Request access to the personal information we hold about you (POPIA §23).
- Request correction of inaccurate or incomplete information (POPIA §24).
- Request deletion of your personal information in certain circumstances.
- Object to processing based on legitimate interest.
- Withdraw consent for marketing communications at any time.
- Lodge a complaint with the Information Regulator of South Africa.
To exercise any of these rights, email our Information Officer at privacy@encircle.co.za. We will respond within 30 days.
10. Cookies
We use essential cookies required for the Platform to function, and analytics cookies to understand how the Platform is used. You can control non-essential cookies through your browser settings. Disabling certain cookies may affect Platform functionality.
11. Changes to this policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or in-Platform notification. The effective date at the top of this page shows when the policy was last updated.