POPIA Notice & PAIA Manual Summary

Draft — to be reviewed by a qualified legal practitioner before publication.

Version 1.0 · Effective 25 September 2026

This notice supplements our Privacy Policy for people in South Africa. It gives the information required by section 18 of the Protection of Personal Information Act 4 of 2013 (POPIA) and summarises the manual described in section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA).

SiteMinutes is operated by Water en Skaafsels, a business registered and domiciled in Namibia, and stores its data in the European Union. Namibian law is our home law. POPIA applies to us to the extent that we process personal information of South African data subjects in circumstances covered by section 3 of POPIA — in particular as the operator for our South African customers, who are responsible parties under POPIA for the content they put into SiteMinutes, and as a foreign responsible party for the account and billing information of South African users. PAIA applies to the extent that its provisions extend to us. We follow POPIA's conditions for lawful processing for all personal information of South African data subjects, and we publish this notice so that our South African customers and their people have the information they need. It does not mean that we are established in South Africa.

1. Contact details and Information Officer

2. Our two roles under POPIA

• Responsible party for account, billing, support and website information (we decide why and how it is processed).
• Operator (section 1 of POPIA) for the content our customers put into SiteMinutes: projects, recordings, transcripts, minutes, attendance lists, plans and documents. The customer is the responsible party. We process that content only with the customer's knowledge and authorisation (section 20), keep it confidential, and apply the security measures required by section 19, under our Data Processing Addendum (the written contract required by section 21).

3. Categories of data subjects and their personal information

SiteMinutes is not designed to process special personal information (for example health, religious beliefs or criminal behaviour) or the personal information of children. Such information may, however, be spoken in a meeting. Customers should avoid recording it unless they have a lawful basis under sections 27 or 35 of POPIA.

4. Purposes of processing

• Providing the Service: recording, transcription, drafting and editing minutes, syncing and storing project records.
• Opening and managing accounts, workspaces, seats and invitations.
• Billing, collecting payments and keeping accounting and tax records.
• Support, the help assistant, and communication about the Service.
• Security, abuse prevention, error fixing and cost control.
• Complying with the law and protecting our rights.

The lawful grounds (section 11) are: performance of a contract with the data subject or our customer, compliance with an obligation imposed by law, and our legitimate interests or those of our customer. Where the customer relies on the consent of meeting participants, the customer must obtain it.

5. Recipients

Our operators (sub-processors) are listed in the Privacy Policy: Supabase (database, sign-in and storage, Frankfurt, Germany), Vercel (web hosting, Frankfurt and worldwide edge), OpenAI (speech-to-text, United States), Anthropic (AI drafting and help, United States), PayGate / DPO Group (card payments, South Africa) and Apple (app distribution). We may also disclose information to professional advisers, regulators or courts when the law requires it.

6. Cross-border transfers (section 72)

Personal information is transferred outside South Africa to the European Union (our database and storage) and to the United States (AI transcription and drafting). We transfer it only because:

• each recipient is bound by a written agreement (including Standard Contractual Clauses where applicable) that provides an adequate level of protection substantially similar to the conditions for lawful processing in POPIA, and that restricts onward transfers (section 72(1)(a)); and
• the transfer is necessary to perform the contract between us and our customer, and between the customer and its users (section 72(1)(b) and (c)).

The AI providers receive only what is needed for the task, do not use it to train their models under their business terms, and keep it only for short periods (see the AI & Recording Policy).

7. Security safeguards (section 19)

Encryption in transit and at rest, row level security that separates every company's data in the database, secrets in an encrypted vault, least-privilege access, audited administrative functions and daily backups. See the Security Overview.

8. Security compromises (section 22)

If we have reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, we will notify the affected customer (the responsible party) without undue delay so it can notify the Information Regulator and data subjects. Where we are the responsible party, we will notify the Information Regulator and the affected data subjects ourselves, as soon as reasonably possible.

9. Your rights

As a data subject you have the right to:

• be told that personal information about you is being collected (section 18) and whether it has been accessed by an unauthorised person (section 22);
• ask whether we hold personal information about you and request a record or description of it (section 23);
• ask for it to be corrected, destroyed or deleted (section 24);
• object to its processing on reasonable grounds (section 11(3)), and to direct marketing (sections 11(3)(b) and 69);
• not be subject to a decision based solely on automated processing (section 71); and
• complain to the Information Regulator and institute civil proceedings (section 99).

Making a request. E-mail help@siteminutes.com. You may use the Information Regulator's forms (POPIA Form 1 for objections, Form 2 for correction or deletion), but a clear e-mail is enough. We will confirm your identity and answer within 30 days. If the request concerns a customer's meeting content, we will pass it on to that customer and help it answer.

10. PAIA manual summary (section 51)

Records we hold.

Records available without a request. Everything published at /legal.

Records kept in terms of legislation. Mainly Namibian law: the Companies Act 28 of 2004 or the Close Corporations Act 26 of 1988 (depending on the entity), the Income Tax Act 24 of 1981, the Value-Added Tax Act 10 of 2000 and the Electronic Transactions Act 4 of 2019. For South African customers and data subjects, also the Electronic Communications and Transactions Act 25 of 2002, the Consumer Protection Act 68 of 2008, POPIA and PAIA, to the extent they apply.

Requesting access. Use PAIA Form 2 (Request for Access to Record), available on the Information Regulator's website, and send it to the Information Officer above. A request fee and access fees may apply as prescribed in the PAIA regulations; we will tell you before any fee is payable. We answer within 30 days (extendable by up to 30 days as PAIA allows). A request may be refused on the grounds in Chapter 4 of Part 3 of PAIA (for example to protect a third party's personal or commercial information).

PAIA Guide. The Information Regulator publishes a guide on how to use PAIA, in all official languages, at inforegulator.org.za.

11. Information Regulator

12. Updates

We review this notice at least once a year and whenever our processing changes. The current version is always at siteminutes.com/legal/popia-notice.