Privacy Policy (POPIA)

1. Who is responsible

LekkerContracts is the responsible party for the personal information described here. Our Information Officer can be reached at privacy@lekkercontracts.co.za.

Where you generate a contract containing another person's information — an employee, a tenant, a contractor — you are the responsible party for that information, and we act as your operator under section 21 of POPIA.

2. What we collect

We collect only what we need to generate, deliver and re-issue your document.

• Account information: your name, email address and password hash (we never see your password).
• Document information: every answer you type into a generator, including the names, ID numbers, addresses, salaries and property details of the parties to your agreement.
• Payment information: the amount, currency, gateway reference and status. Card details are handled by the payment gateway and never reach our servers.
• Signature evidence: for each electronic signature, the signer's name, email address, timestamp, IP address and browser user agent.
• Technical information: basic server logs and error reports used to keep the service working.

3. Why we process it, and on what basis

We process your information to perform our contract with you: to generate your document, take payment, store it for re-download, and run the signing flow. That is the section 11(1)(b) basis.

We process signature evidence to give the signed document legal weight under the Electronic Communications and Transactions Act, and to comply with our own record-keeping obligations. That is the section 11(1)(c) and 11(1)(f) basis.

We do not use your document contents for advertising, we do not sell personal information, and we do not use your contract data to train machine-learning models.

4. Who we share it with

We share personal information only with the operators we need to run the service:

• Our hosting and database provider, which stores your account and documents on encrypted infrastructure.
• Our payment gateway, which processes your card payment and returns a reference to us.
• Our email provider, which delivers signing links, receipts and copies of your documents.
• A regulator, court or law enforcement agency where we are legally compelled to disclose.

5. Cross-border transfers

Some of our infrastructure providers host data outside South Africa. Where that is the case, the recipient is subject to a law or binding agreement providing an adequate level of protection substantially similar to POPIA, as required by section 72.

6. Security

We apply appropriate, reasonable technical and organisational measures as required by section 19 of POPIA: encryption in transit and at rest, row-level access controls so that you can only ever read your own records, private storage for signed PDFs accessible only through short-lived signed links, and least-privilege access for our own staff.

If we become aware that your personal information has been accessed by an unauthorised person, we will notify you and the Information Regulator as soon as reasonably possible, as required by section 22.

7. How long we keep it

We keep your account and generated documents for as long as your account is open, and for 5 years after your last purchase so that we can meet our tax and record-keeping obligations and so that you can re-download a document you paid for.

Signature evidence records are kept for the life of the signed document, because they are what makes the signature provable.

You may ask us to delete your account and documents at any time. We will do so within 30 days, except for records we are required by law to retain.

8. Your rights

Under POPIA you have the right to:

• Ask what personal information we hold about you and request a copy (section 23 and PAIA).
• Ask us to correct or delete information that is inaccurate, irrelevant, excessive or out of date (section 24).
• Object to processing based on legitimate interest (section 11(3)).
• Withdraw consent you have given, without affecting processing before withdrawal.
• Complain to the Information Regulator, and to claim damages under section 99.

9. Cookies

We use only the cookies and local storage needed to keep you signed in and to remember the draft you are working on. We do not run advertising or cross-site tracking cookies.

10. Contacting the Regulator

The Information Regulator of South Africa can be reached at JD House, 27 Stiemens Street, Braamfontein, Johannesburg, or at complaints.IR@inforegulator.org.za. We would appreciate the chance to resolve your concern first.