de Broglio Attorneys Inc.

1. Introduction

1.1 de Broglio Attorneys Inc. ("de Broglio", "we", "us" or "our") is sensitive to the personal nature of the information provided to us and is committed to processing personal information lawfully, reasonably and securely.

1.2 This Privacy Policy explains what personal information we collect, how and why we process it, when we may share it, how long we retain it and the rights available to data subjects under the Protection of Personal Information Act 4 of 2013 ("POPIA") and other applicable law.

1.3 This Policy applies to clients and prospective clients; claimants and their dependants; witnesses and other persons connected with a matter; visitors to our offices and websites; users of ClientZone; job applicants; suppliers and service providers; and people who communicate or otherwise interact with us.

1.4 Providing personal information does not constitute blanket consent to all processing described in this Policy. We process information only where a lawful justification exists, including consent where appropriate, the conclusion or performance of a contract or mandate, compliance with a legal obligation, protection of a legitimate interest, or pursuit of our or a third party's legitimate interests, subject to POPIA.

1.5 This Policy applies to websites, campaign pages and digital services operated by or on behalf of de Broglio, including www.onlinelaw.co.za, www.accidentclaim.co.za, www.personalinjury.co.za and associated subdomains or landing pages.

1.6 The latest version of this Policy will be available on our websites. The effective date and last-updated date appear at the end of this Policy.

2. Who is responsible for your information

2.1 The responsible party is de Broglio Attorneys Inc., registration number 2014/256723/21.

2.2 Principal place of business: 127 Jan Smuts Avenue, Parkwood, Johannesburg, 2196, South Africa.

2.3 Information Officer: Brumilde Jones.

2.4 Privacy and POPIA enquiries: brumilde@onlinelaw.co.za | +27 11 446 4200.

3. How we collect personal information

We may collect or obtain personal information:

• directly from you, including when you complete an online form, request a callback, send a WhatsApp message or email, telephone us, visit our offices, instruct us or use ClientZone;
• from a person acting for you, a family member, guardian, employer, witness or other person involved in your claim or enquiry;
• in the course of assessing, opening, administering or conducting a legal matter;
• from public records, courts, the Road Accident Fund (RAF), government departments, law-enforcement bodies, medical institutions, healthcare practitioners, insurers, employers and other lawful sources;
• when you interact with our websites, social-media platforms, online advertisements or campaign content;
• from cookies, analytics, advertising and communications technologies, subject to applicable law and your choices; and
• when you apply for employment or seek to provide goods or services to us.

Where information is not obtained directly from you, we will take reasonably practicable steps to provide any notification required by POPIA, unless an applicable exception permits otherwise.

4. Personal information we may process

Depending on the nature of our interaction or the legal matter, we may process:

• identity and personal details, including names, identity or passport numbers, date of birth, nationality, marital status, photographs, signatures and language preferences;
• contact details, including addresses, telephone numbers, email addresses and relevant social-media or messaging details;
• claim and accident information, including accident circumstances, police and statutory records, witness information, vehicle details, correspondence, statements, evidence, pleadings and legal opinions;
• medical, disability and injury information, including medical records, diagnoses, treatment history, medico-legal reports, photographs and information concerning physical or mental health;
• financial, employment and loss information, including earnings, tax, banking, payment, invoice, benefits, dependency and loss-of-support information;
• information about children, guardians, dependants, deceased persons and family relationships where relevant to a legal matter;
• records of calls, emails, messages, meetings, instructions, consents and interactions with us;
• recruitment, employee, supplier and professional-service information; and
• technical and usage information, including device and browser information, IP address, approximate location derived from IP address, referral source, pages viewed, dates and times, form activity, advertisement interactions and campaign attribution.

We seek to avoid collecting information that is not reasonably required. Initial website enquiry forms should not be used to send extensive medical records, identity documents or other highly sensitive documents unless we specifically request them through an appropriate channel.

5. Special personal information and children

5.1 Legal matters handled by de Broglio may require the processing of special personal information, particularly health information and information relating to alleged offences or proceedings. We process this information only where permitted by POPIA and other applicable law, including where necessary for the establishment, exercise or defence of a right or obligation in law and subject to legal professional confidentiality.

5.2 We may process the personal information of children when it is relevant to a claim or legal service and where a competent person has consented, the processing is necessary for the establishment, exercise or defence of a right or obligation in law, or another lawful authorisation applies.

5.3 We apply additional care and access controls to medical information, information concerning children and other sensitive matter information.

6. Why we process personal information

We may process personal information to:

• respond to enquiries and callback requests and communicate with prospective clients;
• conduct an initial assessment of whether we may be able to assist and, where appropriate, conduct identity and conflict checks;
• enter into, perform and administer a legal mandate and provide legal and related services;
• investigate, prepare, negotiate, issue, pursue, defend, settle or enforce claims and legal proceedings;
• arrange medical, medico-legal and other expert assessments and obtain relevant records;
• communicate with clients and provide case, appointment and claim updates, including through ClientZone, email, SMS, telephone or WhatsApp where appropriate;
• manage payments, trust and business accounts, invoices, audits, insurance and financial reporting;
• comply with legal, professional, regulatory, tax, record-keeping and reporting obligations and prevent fraud or unlawful conduct;
• operate, secure, maintain and improve our offices, websites, systems, services and communications;
• measure the effectiveness of campaigns, advertisements, content and enquiry channels, and understand aggregate website and lead performance;
• manage recruitment, staff, suppliers, experts and other professional relationships; and
• establish, exercise or defend legal rights and protect the safety, rights and property of clients, staff and others.

7. Website enquiries and campaign leads

7.1 When you submit a callback, contact or claim-assessment form, or contact us through WhatsApp, telephone, email or a campaign page, we use the information to receive, assess, allocate and respond to your enquiry. Submission of an enquiry does not, by itself, create an attorney-client relationship or oblige de Broglio to accept a mandate.

7.2 Unless a field is marked as required, providing the information is voluntary. If you do not provide information reasonably required to understand or respond to an enquiry, we may be unable to assess it or contact you.

7.3 Information collected through separate de Broglio websites and campaigns may be combined where reasonably necessary to identify duplicate enquiries, respond consistently, assess campaign performance, maintain accurate records and provide legal services.

8. Disclosure to other parties

8.1 Subject to legal professional privilege, confidentiality duties and applicable law, we may disclose relevant personal information to:

• the RAF and its representatives;
• courts, tribunals, sheriffs, law-enforcement bodies, government departments, regulators and other authorities;
• medical practitioners, hospitals, medico-legal experts, therapists, actuaries, accident reconstruction experts, investigators and other experts;
• advocates, correspondent attorneys, tracing agents, interpreters, translators and other professional advisers;
• employers, insurers, banks, auditors and payment or financial service providers where relevant;
• our information-technology, cloud-hosting, CRM, document-management, email, SMS, telephone, WhatsApp, cybersecurity, analytics, advertising and website service providers acting as operators;
• a lawful successor or prospective acquirer in connection with a genuine restructuring or transfer, subject to appropriate confidentiality safeguards; and
• other persons where you direct or authorise us to disclose the information, or where disclosure is otherwise permitted or required by law.

8.2 We require operators processing personal information on our behalf to act under appropriate written arrangements, process information only with our knowledge or authorisation, preserve confidentiality and implement appropriate security safeguards.

9. International transfers

Some technology, communications, cloud, analytics or professional service providers may process or store information outside South Africa. We transfer personal information outside South Africa only where the requirements of section 72 of POPIA are met, including through an adequate foreign legal framework, binding corporate rules or a binding agreement providing substantially similar protection, consent where appropriate, or another lawful basis permitted by POPIA.

10. Security and security compromises

10.1 We implement reasonable and appropriate technical and organisational safeguards designed to protect personal information against loss, damage, unauthorised destruction, unlawful access or unlawful processing. Measures may include access controls, authentication, staff confidentiality and training, backups, monitoring, secure hosting and appropriate operator agreements.

10.2 No internet transmission or storage system can be guaranteed to be completely secure. This does not limit any duty or liability that cannot lawfully be limited.

10.3 Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and affected data subjects as soon as reasonably possible, subject to the timing and other requirements of POPIA and any lawful direction delaying notification.

11. Information quality and minimisation

We take reasonably practicable steps to ensure that personal information is complete, accurate, not misleading and updated where necessary, having regard to the purpose for which it is processed. You may help us by informing us when your information changes. We limit collection and processing to information that is adequate, relevant and not excessive for the applicable purpose.

12. Retention and destruction

12.1 We retain personal information for no longer than is necessary to achieve the purpose for which it was collected or subsequently processed, unless retention is required or authorised by law, professional rules, a contract, a lawful dispute or the establishment, exercise or defence of legal rights.

12.2 Retention periods differ according to the information and matter concerned. Client and legal-matter records may be retained for the periods required by applicable law, professional duties, prescription considerations, insurance requirements and legitimate evidential needs. Enquiry, recruitment, financial, security and marketing records may have different retention periods.

12.3 When retention is no longer authorised or required, we will delete or destroy the information, or de-identify it where appropriate, in a manner that prevents its reconstruction in intelligible form.

13. Cookies, analytics and advertising

13.1 Our websites may use cookies, pixels, tags and similar technologies. Some are necessary for security, navigation, forms and essential site functions. Others help us measure usage, attribute enquiries to campaigns, improve content and assess advertising performance.

13.2 Where required, non-essential analytics and advertising technologies will be used only in accordance with the choices you make through the applicable cookie banner or settings. Rejecting non-essential cookies will not prevent access to essential website functions.

13.3 Further information about the principal technologies, providers, purposes and durations used on a website may be provided in the applicable Cookie Notice. Technologies used may include Google Analytics 4, Google Tag Manager, Google Ads conversion tracking and remarketing, Meta advertising technologies, YouTube, AdStories, call-tracking services and embedded WhatsApp functionality.

13.4 Browser or device settings may also allow you to restrict cookies, although blocking necessary cookies may affect certain website functions.

14. Direct marketing

14.1 Responding to a legal enquiry or sending communications necessary for an existing matter is not treated as consent to receive unrelated marketing.

14.2 We send unsolicited electronic direct marketing only where permitted by section 69 of POPIA, including where valid consent has been obtained or where the limited existing-customer requirements apply.

14.3 Where we request optional marketing consent on a website form, it will be presented separately from the acknowledgement required to submit an enquiry, will not be pre-selected and will describe the type of communication concerned.

15. Your rights

Subject to POPIA, PAIA and other applicable law, you may:

• ask whether we hold personal information about you and request access to it;
• request correction or deletion of inaccurate, irrelevant, excessive, out-of-date, incomplete, misleading or unlawfully obtained information;
• request destruction or deletion of a record that we are no longer authorised to retain;
• object, on reasonable grounds, to processing based on particular lawful grounds;
• withdraw consent where processing is based on consent, without affecting processing that was lawful before withdrawal;
• object to or opt out of direct marketing; and
• lodge a complaint with the Information Regulator.

Some rights may be limited by legal professional privilege, duties owed to another person, legal or professional retention obligations, pending or anticipated proceedings, or another lawful ground. We may require reasonable proof of identity before acting on a request.

Requests may be sent to the Information Officer using the contact details in section 2. Prescribed POPIA and PAIA forms are available from the Information Regulator at https://inforegulator.org.za.

16. Complaints

We encourage you to contact our Information Officer first so that we can attempt to resolve a privacy concern. You also have the right to lodge a complaint with the Information Regulator (South Africa):

• Website: https://inforegulator.org.za
• Complaints: complaints.IR@inforegulator.org.za
• General enquiries: enquiries@inforegulator.org.za
• Telephone: +27 10 023 5200

17. Changes to this Policy

We may update this Policy to reflect changes in law, our services, technology or processing practices. The current version will be published on our websites. Where a change materially affects the way we process personal information, we will take appropriate steps to bring it to the attention of affected persons.

18. Version information