GovClerk Privacy Policy

1. Introduction

GovClerk (Pty) Ltd ("GovClerk", "we", "us", "our") is committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, store, and share your information when you use our services.

This policy applies to GovClerk Minutes:

• GovClerk Minutes at https://govclerkminutes.com — our AI-powered meeting minutes generation platform.

This website is referred to as "our Site" and the services provided through it as "our Services." GovClerk Portal, our separate public transparency product for government organizations, is covered by its own GovClerk Portal Privacy Policy.

By using our Services, you consent to the data practices described in this Privacy Policy. If you do not agree with any part of this policy, please discontinue use of our Services.

2. International Users

Depending on your location, one or more of the following frameworks apply to you:

• South Africa — the Protection of Personal Information Act (POPIA). See Section 3.
• United Kingdom and European Union — the UK GDPR and the EU General Data Protection Regulation (GDPR). See Section 4.
• California and other US states — the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA). See Section 5.
• Australia — the Privacy Act 1988 (Cth) and the Australian Privacy Principles. See Section 6.
• New Zealand — the Privacy Act 2020 and the Information Privacy Principles. See Section 7.

If you are located in a jurisdiction not listed above, we still apply the core privacy protections and data subject rights described throughout this policy as our baseline commitment to all users, regardless of where you are based.

Regardless of your location, GovClerk does not sell your personal information to third parties, for cash or any other valuable consideration. This is true across all regions we serve — see Section 10 for details on how we share information.

3. POPIA Compliance (South Africa)

GovClerk acts as a Responsible Party under POPIA. This means we determine the purpose of and means for processing your personal information and are accountable for ensuring that processing complies with the Act.

Information Officer

Our designated Information Officer, responsible for overseeing compliance with POPIA and handling data-related enquiries, is:

Cliff
Email: cliff@govclerkminutes.com

Your Rights Under POPIA

As a data subject under POPIA, you have the following rights:

• The right to access your personal information held by us.
• The right to request correction of inaccurate, irrelevant, excessive, out-of-date, incomplete, misleading, or unlawfully obtained personal information.
• The right to request deletion or destruction of your personal information.
• The right to object to the processing of your personal information.
• The right to lodge a complaint with the Information Regulator of South Africa.

See Section 13 for full details on how to exercise these rights.

4. GDPR Compliance (UK and EU)

For UK and EU users, GovClerk generally acts as the data controller for personal data collected directly through our Site (such as account and billing information), and as a data processor on behalf of our customers in respect of meeting recordings and related content they submit for processing.

Legal Basis for Processing

We rely on the following legal bases to process your personal data under the GDPR:

• Contract — processing necessary to provide our Services to you.
• Consent — for marketing communications and non-essential cookies, which you may withdraw at any time.
• Legitimate interests — for improving our Services, security, and fraud prevention, balanced against your rights and freedoms.
• Legal obligation — where processing is required to comply with law.

Your Rights Under GDPR

As a data subject under the GDPR, you have the following rights:

• Right of access — you may request a copy of the personal data we hold about you.
• Right to rectification — you may request that we correct inaccurate or incomplete personal data.
• Right to erasure ("right to be forgotten") — you may request that we delete your personal data, subject to certain legal exceptions.
• Right to restriction of processing — you may request that we limit how we use your personal data in certain circumstances.
• Right to data portability — you may request a copy of your personal data in a structured, commonly used, machine-readable format, and request that we transmit it to another controller where technically feasible.
• Right to object — you may object to processing based on legitimate interests, including profiling, and to processing for direct marketing purposes at any time.
• Right not to be subject to automated decision-making — including profiling that produces legal or similarly significant effects concerning you.
• Right to lodge a complaint — with your local supervisory authority (see below).

International Data Transfers

Where we transfer personal data of UK or EU individuals outside the UK or EEA (for example, to our cloud hosting provider), we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs) or the UK's International Data Transfer Addendum, to ensure your data continues to receive an adequate level of protection.

Supervisory Authority

If you are in the UK, you may lodge a complaint with the Information Commissioner's Office (ICO). If you are in the EU, you may lodge a complaint with the data protection authority in your member state.

How to Exercise Your Rights

To exercise any of the rights listed above, please contact our Information Officer at cliff@govclerkminutes.com. We will respond without undue delay and in any event within one month of receiving your request, as required by the GDPR.

5. CCPA Compliance (California/US)

The categories of personal information we collect are described in Section 8 (Information We Collect), and the purposes for which we use it are described in Section 9 (How We Use Your Information).

Your Rights Under CCPA

As a California consumer, you have the following rights:

• Right to know — you may request that we disclose the categories and specific pieces of personal information we have collected about you, the sources of that information, and the purposes for collecting it.
• Right to delete — you may request that we delete personal information we have collected from you, subject to certain legal exceptions.
• Right to opt-out of sale or sharing — you may direct us not to sell or share your personal information. As described below, GovClerk does not sell or share personal information, so there is nothing to opt out of today.
• Right to correct — you may request that we correct inaccurate personal information we maintain about you.
• Right to non-discrimination — we will not discriminate against you for exercising any of your CCPA rights.

Do Not Sell or Share My Personal Information

GovClerk does not sell or share personal information for cross-context behavioural advertising, and has not done so in the preceding 12 months. Because we do not sell or share personal information, we do not currently operate a "Do Not Sell or Share My Personal Information" link. If you would like to submit a request out of an abundance of caution, or have questions about our data practices, contact us using the details below and we will honour your request.

How to Exercise Your Rights

To submit a verifiable consumer request, please contact us at cliff@govclerkminutes.com or support@govclerkminutes.com. We may need to verify your identity before fulfilling your request. We will respond within the timeframes required by the CCPA.

6. Australian Privacy Act 1988

Your Rights Under the Australian Privacy Act

As an individual protected by the Australian Privacy Act, you have the right to:

• Access the personal information we hold about you.
• Request correction of personal information that is inaccurate or out of date.
• Deal with us anonymously or under a pseudonym where it is lawful and practicable to do so.
• Be notified of a data breach that is likely to result in serious harm, in accordance with the Notifiable Data Breaches scheme.
• Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) if you believe we have mishandled your personal information.

How to Exercise Your Rights

To exercise any of the rights listed above, please contact us at cliff@govclerkminutes.com.

Office of the Australian Information Commissioner (OAIC)

If you are not satisfied with our response, you may contact the OAIC: https://www.oaic.gov.au

7. New Zealand Privacy Act 2020

Your Rights Under the New Zealand Privacy Act

As an individual protected by the New Zealand Privacy Act, you have the right to:

• Access the personal information we hold about you.
• Request correction of personal information that is inaccurate or out of date.
• Be notified if a privacy breach has occurred that has caused, or is likely to cause, serious harm, in accordance with New Zealand's mandatory breach notification requirements.
• Complain to the Office of the Privacy Commissioner if you believe we have mishandled your personal information.

How to Exercise Your Rights

To exercise any of the rights listed above, please contact us at cliff@govclerkminutes.com.

Office of the Privacy Commissioner (New Zealand)

If you are not satisfied with our response, you may contact the Privacy Commissioner: https://www.privacy.org.nz

8. Information We Collect

Account and Contact Information

We collect your full name, email address, phone number, workplace or organization name, job title or role, and billing information (processed securely via PayStack or Paddle) when you register or use our Services. This is collected to create and administer your account, provide billing and subscription management, and communicate with you for support purposes.

Meeting Recordings, Transcripts, and Minutes (GovClerk Minutes)

When you use GovClerk Minutes, we collect meeting recordings (audio and/or video), transcripts generated from those recordings, meeting minutes and summaries, agendas and templates, and speaker labels and identification data. This is collected in order to provide the core transcription and minutes-generation service you have requested — it is the content our Services exist to process.

Technical Information

We automatically collect certain technical information when you visit our Site:

• IP address
• Browser type and version
• Device information
• Cookies and similar tracking technologies
• Usage data (pages visited, features used, time on site)
• Referring URLs

Analytics, Advertising, and CRM Data

We use a small number of specific third-party tools to understand how our Services are used, measure our marketing, and manage customer relationships. Each is listed here with what it collects and why:

• Usage analytics (PostHog) — we collect data about which features you use, pages you visit, and how you interact with our Services, in order to understand usage patterns and improve the product.
• Advertising and marketing measurement (Meta Pixel, Meta Conversions API, and Google Ads) — we collect data to measure and optimise the effectiveness of our marketing campaigns. This includes two distinct channels: the Meta Pixel, a browser cookie placed only with your consent, and the separate Meta Conversions API, a server-side channel that sends event data (including a cryptographically hashed version of contact details such as your email, phone number, and location) directly to Meta independently of the Pixel cookie. Google Ads similarly collects data to measure and optimise our advertising.
• CRM data (HubSpot) — we collect and store contact and communication data, including WhatsApp conversation records where applicable, in order to manage customer relationships and support communication with you.
• Site analytics (Vercel Analytics) — we collect basic, aggregate site performance and usage data (such as page load times and visit counts) to monitor the performance of our Site.

Communication Data

We collect information from communications you have with us, including:

• Support messages and tickets
• WhatsApp conversations (which may also be recorded in HubSpot, our CRM — see above)
• Email correspondence

9. How We Use Your Information

We use the information we collect for the following purposes:

• To provide and maintain GovClerk Minutes.
• To process your meetings: transcription, minutes generation, and speaker identification.
• To manage your account and subscriptions.
• To process payments securely via PayStack or Paddle.
• To communicate with you, including support responses, service updates, and marketing communications (with your consent).
• To improve our Services and develop new features based on usage patterns.
• To comply with our legal obligations under applicable law, including POPIA, GDPR, CCPA, the Australian Privacy Act, and the New Zealand Privacy Act.

10. How We Share Your Information

We do NOT sell your personal information to third parties for marketing or any other commercial purpose. This applies regardless of where you are located.

We may share your information in the following limited circumstances:

Service Providers

We work with trusted third-party service providers who assist us in operating our Services. These providers are contractually bound to process your data only in accordance with our instructions and applicable law:

• AI Transcription Services — for meeting transcription and minutes generation.
• Cloud Hosting (AWS) — for secure data storage and infrastructure.
• Email Delivery (Postmark) — for transactional and service-related emails.
• Payment Processing (PayStack and Paddle) — for subscription and billing management. The processor used for a given transaction is selected automatically based on your location.
• Analytics (PostHog) — for usage analytics to improve our Services.
• CRM (Brevo) — for customer relationship management.
• CRM (HubSpot) — for customer relationship management and support communication, including WhatsApp conversation records where applicable.
• Advertising (Meta Pixel and Meta Conversions API) — for measuring and optimising marketing campaign effectiveness. The Meta Conversions API is a separate, server-side channel from the Meta Pixel cookie: it sends hashed contact data directly to Meta independently of cookie consent.
• Advertising (Google Ads) — for measuring and optimising marketing campaign effectiveness.
• Site Analytics (Vercel Analytics) — for basic site performance and usage monitoring.

Legal Requirements

We may disclose your information if required to do so by law, regulation, or valid legal process (such as a court order or subpoena), or if we believe in good faith that such disclosure is necessary to protect the rights, property, or safety of GovClerk, our users, or the public.

Business Transfers

In the event of a merger, acquisition, or sale of all or a portion of our assets, your personal information may be transferred to the acquiring entity. We will notify you via email or a prominent notice on our Site prior to any such transfer.

With Your Consent

We may share your information for other purposes when you have explicitly authorized us to do so.

11. Data Storage and Security

We Do Not Store Your Payment Card or Banking Details

GovClerk does not store your payment card or banking details. All payment processing and storage of payment information is handled directly by our payment processors — PayStack and Paddle, selected automatically based on your location — not by GovClerk. We only receive and store transaction confirmations and references from these processors; we never receive or store your raw card or banking details.

We take the security of your personal information seriously and implement appropriate technical and organizational measures to protect it:

• Data is stored on secure cloud infrastructure provided by Amazon Web Services (AWS).
• Data is encrypted at rest and in transit using industry-standard encryption protocols.
• Access controls and user authentication are managed via Clerk.
• We conduct regular security assessments to identify and address vulnerabilities.
• Our data handling practices align with SOC 2 compliant standards.

Despite our best efforts, no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security. By using our Services, you acknowledge and accept this inherent risk.

12. Cookies and Tracking

We use cookies and similar tracking technologies to enhance your experience on our Site. Cookies are small text files stored on your device that help us recognise you and remember your preferences.

Essential Cookies

These cookies are necessary for authentication and session management. They cannot be disabled as they are required for our Services to function.

Analytics Cookies

We use PostHog to collect anonymised analytics data that helps us understand how users interact with our Site and improve our Services.

Marketing Cookies

We use Meta Pixel for advertising purposes to measure the effectiveness of our marketing campaigns. These cookies are only placed with your consent.

Managing Cookies

You can control and manage cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of our Services. For more information, refer to your browser's help documentation.

13. Your Rights Under POPIA

As a data subject, you have the following rights under POPIA and we are committed to facilitating the exercise of those rights:

• Right to be informed — You have the right to know what personal information we collect and how we use it (as set out in this policy).
• Right of access — You may request a copy of the personal information we hold about you.
• Right to correction — You may request that we correct any inaccurate or incomplete personal information.
• Right to deletion — You may request that we delete your personal information, subject to our legal obligations to retain certain data.
• Right to object — You may object to the processing of your personal information in certain circumstances.
• Right against automated decision-making — You have the right not to be subject to a decision based solely on automated processing that significantly affects you.
• Right to lodge a complaint — If you are unhappy with how we handle your personal information, you may lodge a complaint with the Information Regulator of South Africa (see Section 20).

How to Exercise Your Rights

To exercise any of the rights listed above, please contact our Information Officer at cliff@govclerkminutes.com or our support team at support@govclerkminutes.com. We will respond to your request within a reasonable time and in accordance with POPIA.

If you are located outside South Africa, see Section 2 (International Users) for the rights and contact details that apply under GDPR, CCPA, the Australian Privacy Act, or the New Zealand Privacy Act.

14. Data Retention

• We retain your personal information for as long as your account remains active.
• Meeting recordings and transcripts are retained for as long as you maintain your subscription.
• Following account deletion or subscription cancellation, your data will be purged within 30 days, subject to any legal obligations.
• Some information may be retained for a longer period if required by applicable law or regulation.

15. Children's Privacy

Our Services are not directed to anyone under the age of 18. We do not knowingly collect personal information from children under 18 years of age. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us immediately at cliff@govclerkminutes.com and we will take steps to remove such information from our systems.

16. International Data Transfers

Your personal information may be processed in countries outside South Africa, including the United States, where our cloud hosting provider (AWS) operates data centres. Where such cross-border transfers occur, we ensure that appropriate safeguards are in place as required by POPIA, including contractual protections to ensure your data receives an equivalent level of protection to that afforded within South Africa.

For UK and EU users, cross-border transfers are additionally safeguarded using mechanisms such as Standard Contractual Clauses, as described in Section 4 (GDPR Compliance).

17. Third-Party Links

Our Site may contain links to third-party websites or services. We are not responsible for the privacy practices or content of those sites. This Privacy Policy applies solely to information collected by GovClerk through our Site and Services. We encourage you to review the privacy policies of any third-party sites you visit.

18. Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time. Significant changes will be communicated to you via email to the address associated with your account, or by placing a prominent notice on our Site. Such changes will take effect 30 days after notification to allow you time to review the updated policy.

Non-material changes or clarifications will take effect immediately upon posting. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

19. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the way we handle your personal information, please contact us:

GovClerk (Pty) Ltd
Information Officer: Cliff
Email: cliff@govclerkminutes.com
Support: support@govclerkminutes.com
WhatsApp: +27 66 425 9236
Websites: https://govclerkminutes.com | https://govclerkpartners.org

20. Information Regulator of South Africa

If you are not satisfied with how we have handled your personal information or your complaint, you have the right to lodge a complaint with the Information Regulator of South Africa:

The Information Regulator (South Africa)
Email: complaints.IR@justice.gov.za
Website: https://inforegulator.org.za

If you are located outside South Africa, see Section 2 (International Users) for the supervisory authority relevant to your region.