Privacy Policy

1. Responsible Party

The responsible party for the purposes of POPIA is:

2. Scope

This Privacy Policy applies to:

• Users of the SimplyWill™ website (www.simplywill.co.za)
• Law firms and legal professionals who subscribe to or pilot the SimplyWill™ software
• Individuals who contact us via email, WhatsApp, or the website contact form

This policy does not apply to end-client personal information processed by law firms using SimplyWill™ software. Law firms that use SimplyWill™ are themselves the responsible party for their clients' data under POPIA. See section 5 for detail.

3. Personal Information We Collect

We collect the following categories of personal information:

• Contact and firm details — name, firm name, email address, telephone number, collected when you submit a pilot request or contact form, or when you correspond with us directly.
• Licence and subscription information — firm name, billing contact, payment reference, and subscription details for active subscribers.
• Technical information — licence activation records, software version, and operating system type, collected automatically during licence activation and software updates.
• Website usage — standard server logs (IP address, browser type, pages visited, time of visit), collected automatically when you visit our website.

We do not knowingly collect personal information from individuals under the age of 18.

4. How We Use Information

We use the personal information we collect for the following purposes:

• To respond to pilot requests, support enquiries, and general correspondence
• To activate and manage SimplyWill™ software licences
• To deliver software updates and notify subscribers of new releases
• To process subscription payments and maintain billing records
• To comply with legal obligations, including POPIA and applicable tax laws
• To improve the SimplyWill™ website and software based on aggregate usage patterns

We do not use your personal information for automated decision-making or profiling. We do not sell, rent, or trade personal information to any third party for marketing purposes.

5. Client Data in SimplyWill™

SimplyWill™ is a local-first application. Each workstation holds a complete local database which is the working source of truth, and the software continues to operate with no internet connection.

So that a firm's own workstations stay current with one another, certain records — Will contents, dossier notes, the contact directory, firm settings, staff accounts, and files attached to a client's dossier — are synchronised in the background to a cloud database. Client content is encrypted on the workstation using a key belonging to the firm, before it leaves that machine. For an attached file this covers both the contents of the file and its filename. The synchronised copy is therefore not readable by us or by the hosting provider. Attached files larger than 20 MB are not synchronised and remain only on the workstation on which they were filed.

Operational telemetry. Separately from firm data, each installation reports to us when it starts and if it crashes: the firm's name, the software version, the operating system version, a one-way hash of the computer's name, and, for a crash, the opening portion of the technical error trace. This tells us which firms are running which version and what is failing. It carries no Will content, no directory entries and no client records. A crash trace is a technical message and may incidentally contain a file path, so we treat these reports as confidential. The reporting channel is insert-only: an installation cannot read back what it or any other installation has reported.

Cloud storage enforces row-level access control scoped to each firm, and every workstation is bound to its licensed firm. One firm's records are not accessible to another.

Cross-border transfer. The cloud database is hosted in the European Union. This constitutes a transborder flow of personal information under section 72 of POPIA. The transfer is made on the basis of section 72(1)(a): the hosting provider is bound by a written data-processing agreement requiring a level of protection substantially similar to that required by POPIA, and is further subject to the General Data Protection Regulation. No separate consent is sought from individual testators for the transfer itself, because the transfer does not rely on the consent ground. A written data-processing statement setting out what is stored, where it is held, and precisely what leaves the firm's premises is provided to each firm's Information Officer.

Law firms using SimplyWill™ are the responsible party for their clients' personal information under POPIA; GDK Software Developments (Pty) Ltd acts as an operator in respect of the synchronised data. It remains the firm's responsibility to ensure its use of SimplyWill™ complies with its own POPIA obligations, including obtaining appropriate consent from its clients.

To support data-subject requests, SimplyWill™ provides per-record view, edit, delete and export. A deletion performed in the software propagates to the cloud copy on the next synchronisation.

6. Data Storage & Security

Personal information we collect directly (contact details, licence records) is stored on secured servers located in South Africa. Client records synchronised from the SimplyWill™ application are held in the European Union and are encrypted before they leave the firm's workstation, as described in section 5. We implement reasonable technical and organisational measures to protect personal information against unauthorised access, loss, or disclosure, including:

• TLS encryption for data in transit (website, licence activation, synchronisation)
• Field-level AES-256 encryption of client content, applied on the firm's workstation under a per-firm key
• Row-level access control scoping each firm's records to that firm
• Access controls limiting personal data access to authorised personnel only
• Regular security reviews of our systems and processes

No method of electronic storage or transmission is 100% secure. We take reasonable steps to protect your information but cannot guarantee absolute security. In the event of a data breach that affects your personal information, we will notify you as required by POPIA.

7. Sharing of Information

We do not share your personal information with third parties except in the following circumstances:

• Service providers — we may share information with trusted service providers who assist us in operating our business (e.g. payment processing, hosting and cloud synchronisation), under contractual obligations to protect the information and not use it for other purposes. Our synchronisation provider stores client content only in the encrypted form described in section 5 and cannot read it.
• Legal requirements — we may disclose information where required by law, court order, or lawful government authority.
• Business transfer — in the event of a merger, acquisition, or sale of our business, personal information may be transferred as part of that transaction, with appropriate notice to affected parties.

We do not transfer personal information outside South Africa unless equivalent protection exists in the receiving country or the transfer is otherwise permitted under POPIA.

8. Your Rights Under POPIA

As a data subject under POPIA, you have the following rights in respect of your personal information held by us:

• Right of access — you may request details of the personal information we hold about you.
• Right to correction — you may request correction of inaccurate or incomplete personal information.
• Right to deletion — you may request deletion of your personal information, subject to our legal retention obligations.
• Right to object — you may object to the processing of your personal information in certain circumstances.
• Right to lodge a complaint — you may lodge a complaint with the Information Regulator of South Africa if you believe we have not complied with POPIA.

To exercise any of these rights, contact us at privacy@simplywill.co.za. We will respond within 30 days.

The Information Regulator can be contacted at: inforeg@justice.gov.za

9. Cookies & Website

Our website (www.simplywill.co.za) uses the following categories of cookies:

• Essential cookies — necessary for the website to function. These are always active and do not require consent.
• Advertising & analytics cookies (Meta Pixel) — used only if you choose to accept. When active, the Meta Pixel shares limited event data (page views, form submissions) with Meta Platforms Inc., which may process this data outside South Africa. You can withdraw consent at any time using the link below.

Standard server logs record IP addresses and page visits for security and diagnostic purposes. These logs are retained for 90 days and are not used for marketing or profiling.

Manage cookie preferences

10. Retention

We retain personal information only for as long as necessary for the purposes described in this policy, or as required by law:

• Pilot enquiries that do not convert — deleted after 12 months of inactivity
• Active subscriber records — retained for the duration of the subscription and 5 years thereafter for legal and tax compliance
• Licence activation records — retained for the duration of the licence and 3 years thereafter
• Website server logs — retained for 90 days

On expiry of the retention period, personal information is securely deleted or anonymised.

11. Contact

For any questions, requests, or complaints regarding this Privacy Policy or our handling of your personal information, please contact our Information Officer:

This Privacy Policy was last updated in July 2026. We reserve the right to update this policy from time to time. Material changes will be communicated to active subscribers by email. Continued use of SimplyWill™ after notification of changes constitutes acceptance of the updated policy.