Privacy notice

1. Responsible party and role allocation

The proposed responsible party is Chainclose (Pty) Ltd, using the reserved name pending incorporation and issuance of its registration number. Its proposed registered and physical address is 20 Mirage Drive, Helderkruin, Johannesburg, 1724, South Africa. Therry Martins is the proposed head of the private body and Information Officer, subject to incorporation, formal appointment where required and Information Regulator registration.

The designated privacy and PAIA route is privacy@chainclose.co.za and the contact telephone is +27 78 716 0366. The mailbox must pass monitored inbound-delivery qualification before this notice becomes operative. No Deputy Information Officer is designated in this draft.

For account, billing, security and service administration the operator may act as responsible party. For customer-controlled finance records it may act as an operator on documented instructions. The data-processing agreement allocates those roles and separately identifies any authorised CASP or specialist provider acting as an independent or joint responsible party.

2. Information processed

• Identity, business contact, organisation, membership, role and assurance information.
• Legal-entity, accountant/practice delegation and client-work information.
• Exchange/wallet/source identifiers, transaction evidence and financial records.
• Tax identifiers and CARF due-diligence fields only where the enabled service requires them.
• Authentication, device, request, security, audit and support records.
• Billing, plan, usage and contractual records.
• Credential references and protected secrets; never private wallet keys.

3. Sources and purposes

Information may come from the customer, authorised users, connected providers, public blockchain addresses, accountants, authorised CASPs and service/security systems. Processing purposes include providing and securing the service, preserving evidence, customer instructions, reconciliation, reporting preparation, billing, support, fraud/abuse prevention and legal compliance.

Each purpose must have a lawful justification permitted by POPIA, be compatible with the collection context and be limited to adequate, relevant and non-excessive information.

4. Recipients and operators

Access is limited to authorised customer/practice members and least-privilege personnel. The published subprocessor register identifies the approved architecture candidates, data categories and regions. A candidate becomes an appointed production subprocessor only after contract, DPA, security and deployment read-back; specialist CASP, KYT, Travel Rule and pricing providers remain unappointed until named there or in the applicable order.

5. Cross-border processing

Primary application, financial-record, immutable-evidence, email and backup processing is designed for the Google Johannesburg and AWS Cape Town regions. Customer identity and privacy-minimised workflow metadata are proposed for Frankfurt because the selected providers have no South African region. Paging may route minimal incident metadata through a global service. No raw finance evidence, credentials or locked accounting/tax numbers may enter workflow or paging payloads.

Each foreign-country flow requires a recorded POPIA section 72 assessment and a binding provider agreement that upholds substantially similar processing principles, controls onward transfer, confidentiality, security, incidents, assistance, return/deletion and audit evidence. Consent is not used as a blanket substitute for an adequate contract. Prior-authorisation triggers, including special information or unique-identifier linking into a country without adequate protection, must be assessed before activation.

6. Retention and deletion

7. Security and compromises

ChainClose uses technical and organisational measures designed around tenant isolation, access control, encryption, read-only source permissions, immutable evidence and monitored privileged actions. If a security compromise affects personal information, the responsible party will follow POPIA and current Information Regulator notification requirements; an operator will notify its responsible party without delay under the final agreement.

8. Rights and requests

• Ask whether personal information is held and request access.
• Request correction or deletion where the statutory conditions apply.
• Object to processing or direct marketing where applicable.
• Withdraw consent where consent is the applicable justification, without invalidating earlier lawful processing.
• Complain to the Information Regulator or seek other lawful relief.

9. Automated decisions and ML

ChainClose may use deterministic rules and assisted suggestions. It does not permit a model to silently make final identity, accounting, tax, filing or regulated-action decisions. Material outcomes require the configured human review and evidence path.

10. Children, direct marketing and cookies

The business service is not directed to children. The public site currently requires no advertising tracker; necessary authentication/security storage will be described before production. Direct marketing will use the required consent/opt-out controls and suppression records.

11. Contact and complaints

Privacy and PAIA requests are designated for Therry Martins, proposed Information Officer, at privacy@chainclose.co.za or 20 Mirage Drive, Helderkruin, Johannesburg, 1724, South Africa, telephone +27 78 716 0366. Until the mailbox is qualified, this remains a draft contact and no production processing or public signup may rely on it. Data subjects may also use the Information Regulator's complaint channels after following applicable internal routes.