POPIA Information Notice

Issued in terms of the Protection of Personal Information Act 4 of 2013 (POPIA) — June 2026

1. Responsible Party

Name: LedgerFlow AI (Pty) Ltd
Country of Registration: Republic of South Africa
Contact: Via our Contact page or LinkedIn

2. Information Officer

LedgerFlow has appointed an Information Officer as required by POPIA. Queries and requests related to personal information processing may be directed to us via our Contact page. We will acknowledge receipt within 5 business days and respond substantively within 30 days as required by POPIA.

3. Personal Information We Collect

LedgerFlow collects the following categories of personal information in connection with our website and platform services:

• Identity information: Name, surname, job title
• Contact information: Email address, company name
• Technical information: IP address, browser type, session identifiers
• Communication records: Emails and messages exchanged with us
• Usage data: Platform feature usage, navigation patterns in the trial environment

LedgerFlow does not process special personal information (as defined in Section 26 of POPIA) in connection with its website or demonstration services.

4. Purpose of Collection

Personal information is collected and processed for the following specific, explicitly defined, and lawful purposes:

• Providing access to and managing the LedgerFlow trial environment
• Responding to product enquiries and scheduling demonstrations
• Sending product-related communications (with your consent or under legitimate interest)
• Improving the platform and user experience
• Complying with applicable legal obligations
• Protecting against fraud and ensuring platform security

5. Lawful Grounds for Processing

Processing is conducted on the following grounds as contemplated in Section 11 of POPIA:

• Consent (s11(1)(a)): Where you have specifically consented, for example to receive product communications
• Contractual necessity (s11(1)(b)): Where processing is necessary to provide the Services you have requested
• Legitimate interest (s11(1)(f)): For platform improvement and relevant business communications, balanced against your rights
• Legal obligation (s11(1)(c)): Where required by applicable law

6. Recipients of Personal Information

Personal information may be shared with the following categories of recipients:

• Service providers assisting with website hosting, email delivery, and scheduling (e.g. Calendly), under written data processing agreements
• Professional advisors (legal, auditing) under confidentiality obligations
• Regulatory and law enforcement authorities where required by law

LedgerFlow does not sell, rent, or trade personal information to third parties for commercial purposes.

7. Cross-Border Transfers

Where personal information is transferred to a third country (outside South Africa), LedgerFlow ensures that the recipient country or organisation provides an adequate level of protection as contemplated in Section 72 of POPIA, or that appropriate contractual safeguards are in place.

8. Retention of Personal Information

Personal information is retained only for as long as necessary for the purposes for which it was collected, or as required by law:

• Trial account data: deleted within 90 days of account closure
• Communication records: retained for 3 years for legal compliance
• Financial/billing records: retained for the period required by South African tax and company law

After the retention period expires, personal information is securely deleted or anonymised.

9. Your Rights as a Data Subject

In terms of POPIA, you have the following rights:

• Right to access (s23): To request confirmation whether we hold your personal information and to obtain a copy
• Right to correction (s24): To request correction of inaccurate, irrelevant, excessive, or outdated information
• Right to deletion: To request deletion of personal information we are no longer entitled to retain
• Right to object (s11(3)): To object to the processing of your personal information on grounds relating to your particular situation
• Right to withdraw consent: To withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing
• Right to complain: To lodge a complaint with the Information Regulator of South Africa

10. How to Exercise Your Rights

To exercise any of the above rights, please submit a written request via our Contact page. We may require you to verify your identity before processing the request. We will respond within 30 days as required by POPIA.

11. Information Regulator Contact Details

You have the right to lodge a complaint with the Information Regulator of South Africa if you believe your rights under POPIA have been infringed:

Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Website: www.justice.gov.za/inforeg

12. Platform-Level POPIA Features

For organisations deploying LedgerFlow as their own Responsible Party, the platform includes built-in POPIA-supporting capabilities:

• Hash-verified document storage for KYC records
• 5-state KYC lifecycle with reviewer identity audit trail
• Automated document expiry tracking and renewal prompts
• Trigger-based audit log capturing all data changes with actor identity
• Role-based access control limiting data access to authorised personnel only
• Immutable audit trail for subject access request compliance
• Encryption at rest and in transit (configurable per deployment)

13. Updates to This Notice

LedgerFlow may update this POPIA Information Notice from time to time to reflect changes in our processing activities or applicable law. Material changes will be communicated to registered users. The current version is always available at this URL.