Privacy
Privacy Notice & POPIA Section 72 Cross-Border Data Transfer Policy
Last updated: 12 October 2026
1. Responsible party
WillsDatabase (Pty) Ltd ("WillsDatabase", "we") is the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA) and decides why and how your personal information is processed. Contact our Information Officer at privacy@willsdatabase.com.
2. What we process and why
Identity and contact details, Will and Living Will content, estate and asset information, trusted-contact and executor details, and documents you upload to the Vault. We process this to prepare and register your Will, keep your estate records, notify trusted contacts and executors, and comply with legal obligations (POPIA s11).
3. Operators (service providers)
We use operators who process information only on our instructions under written agreements (POPIA ss20–21):
| Operator | Location | Safeguard |
|---|---|---|
| Lovable (application hosting) | Global edge network incl. South Africa; EU/US | Data Processing Agreement; Standard Contractual Clauses |
| Lovable Cloud database & file storage | European Union (Frankfurt, Germany) | Data Processing Agreement; GDPR-equivalent protection (s72(1)(a)) |
| AI assistance services | EU / United States | Operator agreement; personal identifiers masked before processing |
| Email delivery provider | EU / United States | Data Processing Agreement; Standard Contractual Clauses |
| Payment provider | South Africa or as disclosed at checkout | Provider terms; PCI-DSS |
4. Cross-border transfers (Section 72)
Your information may be stored or processed outside South Africa, mainly in the European Union. We transfer it only where at least one Section 72 condition applies:
- the recipient is subject to law, binding corporate rules or a binding agreement giving protection substantially similar to POPIA, including the EU GDPR and Standard Contractual Clauses (s72(1)(a));
- you consent to the transfer (s72(1)(b)), which you give when creating your account;
- the transfer is necessary to perform our contract with you (s72(1)(c)).
5. Security safeguards
Vault documents are encrypted in your browser with AES-256-GCM before upload, so storage providers never receive readable documents. Data is encrypted in transit (TLS) and at rest, access is role-restricted, identifiers are masked in AI processing, and staff access to client records is logged in an immutable audit trail.
6. Retention
Will custody records are kept for as long as legally required. When you close an account holding a Will or Vault documents, the records are restricted (POPIA s14(6)) rather than destroyed.
7. Your rights
You may request access to, correction of, or deletion of your information, object to processing, or withdraw consent from your Privacy settings or by emailing our Information Officer. You may complain to the Information Regulator: inforegulator.org.za.