Vatongi

Privacy Policy

Last updated: 4 July 2026

Vatongi ("Vatongi", "we", "us") provides practice-management software for South African legal practices. We take the protection of personal information seriously and process it in accordance with the Protection of Personal Information Act, 4 of 2013 ("POPIA") and other applicable law.

This policy explains what personal information we collect through the Vatongi application and website, why we collect it, how we protect it, and the rights of data subjects.

1. Who we are (Responsible Party)

The responsible party for personal information processed to operate the Vatongi service is:

  • Vatongi [TO REVIEW: full registered company name]
  • Registration number: [TO REVIEW: company registration number]
  • Registered address: [TO REVIEW: physical address]
  • Information Officer: [TO REVIEW: name of Information Officer]
  • Contact: support@vatongi.com [TO REVIEW: confirm privacy contact email]

Where a law firm uses Vatongi to manage its clients and matters, that firm is the responsible party for its clients' personal information, and Vatongi acts as an operator under section 20 and 21 of POPIA, processing such information only on the firm's instructions and under conditions of confidentiality and security.

2. Personal information we collect

Information provided by the law firm and its users

  • Account details of firm staff: name, email address, telephone number, role.
  • Client and matter records captured by the firm: names, identity numbers, contact details, addresses, FICA verification documents and status, matter details, billing and trust-accounting records, documents and correspondence.
  • Special personal information may be contained in matter records where the firm captures it (for example in medical-malpractice or personal-injury matters). Such information is processed solely on behalf and on instruction of the firm.

Information collected automatically

  • Login and session records, IP addresses, and security logs.
  • Technical usage data required to operate, secure, and support the service.

3. Purposes of processing

  • Providing, operating, securing, and supporting the Vatongi service.
  • Authenticating users and enforcing access controls and audit trails.
  • Billing and account administration for the firm's subscription.
  • Compliance with legal obligations, including the Financial Intelligence Centre Act, 38 of 2001 ("FICA") record-keeping performed by firms in the application, and the Legal Practice Act, 28 of 2014 requirements supported by the trust-accounting features.
  • Communicating service notices and responding to support requests.

We do not sell personal information, and we do not use firm or client data for advertising.

4. Legal basis

Processing is performed on one or more of the following bases:

  • Performance of the contract with the subscribing firm;
  • Compliance with a legal obligation;
  • The legitimate interests of the firm, its clients, or Vatongi (for example securing the service), balanced against the rights of data subjects; and
  • Consent, where specifically requested.

5. Operators and sharing

We use a small number of service providers (operators) to run the service, under written obligations of confidentiality and security, including:

  • Cloud hosting and content delivery providers [TO REVIEW: list current providers, e.g. Vercel Inc. (application hosting) and the server hosting provider for the backend and database].

We disclose personal information only: to these operators; where a firm instructs or authorises it; where required by law or a court order; or to protect the rights, safety, and security of Vatongi, our customers, or others.

6. Cross-border transfers

Some operators may store or process information outside South Africa. Where that occurs, we ensure the recipient is subject to a law, binding corporate rules, or a binding agreement providing an adequate level of protection substantially similar to POPIA, as required by section 72 of POPIA. [TO REVIEW: confirm hosting regions for the application and backups.]

7. Security

We implement reasonable, appropriate technical and organisational measures to secure personal information, including encryption in transit (TLS), tenant isolation, role-based access control, audit logging, and regular backups. Should a security compromise occur, we will notify the Information Regulator and affected responsible parties as required by section 22 of POPIA.

8. Retention

We retain personal information for as long as the firm's subscription is active and thereafter only as long as required for lawful purposes. Firms remain responsible for their own statutory retention obligations (for example FICA records must generally be kept for at least five years). On termination of a subscription, firm data is returned or deleted in accordance with the service agreement. [TO REVIEW: confirm post-termination retention window.]

9. Your rights

Data subjects have the right, subject to POPIA, to:

  • be notified that personal information about them is being collected;
  • request access to the personal information we hold;
  • request correction or deletion of inaccurate or unlawfully obtained information;
  • object to processing in certain circumstances;
  • complain to the Information Regulator (South Africa) — enquiries@inforegulator.org.za / complaints.IR@inforegulator.org.za; and
  • institute civil proceedings regarding alleged interference with their information.

Where Vatongi processes information as an operator for a law firm, access and correction requests regarding the firm's client records should be directed to that firm; we will assist the firm in responding.

10. PAIA

Requests for access to records held by Vatongi may also be made under the Promotion of Access to Information Act, 2 of 2000 ("PAIA"). Our PAIA manual is available on request. [TO REVIEW: prepare and publish PAIA manual.]

11. Cookies

The application uses strictly necessary cookies only: a session cookie to keep you signed in and a tenant cookie to route you to your firm's environment. We do not use advertising or third-party tracking cookies.

12. Changes and contact

We may update this policy from time to time; material changes will be notified in the application. Questions and requests may be sent to support@vatongi.com [TO REVIEW: confirm privacy contact email].