POPIA & Data Processing Policy

1. Who we are

Moll Quibell & Associates Incorporated ("we", "us", "our") is the responsible party for the personal information you submit through this portal, as defined in the Protection of Personal Information Act, 4 of 2013 ("POPIA").

2. What information we collect

We collect the information and supporting FICA documentation required to prepare the suite of instruments requested by you or your organisation, including counter indemnities, deeds of suretyship, FICA forms and director or member resolutions. This may include identity documents, proof of address, company registration documents, financial statements, tax and VAT references, and the personal details of directors, members, trustees, shareholders and sureties.

3. How we use your information

Your information is used solely for its intended purpose, namely:

• Preparing the legal instruments you have instructed us to draft;
• Conducting the FICA due diligence required of us as an accountable institution;
• Submitting the relevant documentation to the relevant insurer or underwriter; and
• Providing the documentation to any representative of the Financial Intelligence Centre ("FIC"), the South African Revenue Service, or any other regulator lawfully entitled to request it.

We will not use your information for marketing, profiling or any other secondary purpose, and we will not sell or rent your information to any third party.

4. Who we share your information with

Your information is shared only with:

• The insurer or guarantor for whom the instruments are being prepared;
• The FIC, SARS or any other regulator lawfully entitled to receive it;
• Our secure cloud document storage (Microsoft SharePoint / OneDrive); and
• The platform and AI operators listed in section 5 below, strictly as our operators under POPIA.

5. Platform and AI operators

This portal is built and hosted on the Lovable platform, which in turn relies on sub-processors to provide hosting, database, authentication, email and AI document classification services. These operators process your information only on our instructions and only to the extent necessary to run the portal.

• Lovable (platform & hosting) — lovable.dev/privacy
• Supabase (database, authentication & file storage, branded as "Lovable Cloud") — supabase.com/privacy
• Cloudflare (edge hosting & network security) — cloudflare.com/privacypolicy
• Microsoft (SharePoint / OneDrive document storage) — privacy.microsoft.com/privacystatement
• Google (Gemini AI) — used to classify and extract fields from uploaded documents to assist our team — policies.google.com/privacy and Gemini API terms
• OpenAI — used, where applicable, for document understanding via the Lovable AI Gateway — openai.com/policies/privacy-policy
• Resend (transactional email delivery) — resend.com/legal/privacy-policy

Documents processed through the AI gateway are used only to classify the document type and extract the fields needed to populate your instruments. They are not used to train any third-party AI model.

6. How long we keep your information

We retain your information for as long as required by FICA, the Legal Practice Act and our professional record-keeping obligations (currently a minimum of five years from the conclusion of the matter), after which it is securely destroyed.

7. Security

Your information is transmitted over encrypted (TLS) connections, stored in access-controlled cloud storage, and accessible only to the attorneys and staff working on your matter.

8. Your rights

You have the right to access, correct or request deletion of your personal information, to object to processing, and to lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za.

9. Contact us

For any privacy queries or to exercise your rights, contact us at info@mqlaw.co.za or 010 446 5621.