Protection of Personal Information Act 4 of 2013
Privacy notice
This website, Life's Next Chapter (lifefile.theahg.co.za), is operated by The Archive and Heritage Digital Commons Group (Pty) Ltd ("the AHG", "we", "us"). Life's Next Chapter is the client-facing name of a platform we build and operate called LifeFile.
Read section 2 before anything else. Who is responsible for your information depends on how you came to us, and the answer is not the same for a visitor to this website as it is for a client of a planning practice.
| Responsible party | The Archive and Heritage Digital Commons Group (Pty) Ltd |
|---|---|
| Address | 490 Barry Hertzog Street, Constantia Park, Pretoria, 0181, South Africa |
| Information Officer | Dr Johan Pieterse |
| info@theahg.co.za, marked for the attention of the Information Officer | |
| Website | theahg.co.za |
1. What this site currently collects
Life's Next Chapter is in development and there is no client sign-up on this website. At present the site is a set of static pages. It sets no cookies, runs no analytics, embeds nothing from third parties, and asks you for nothing.
Our web server keeps ordinary access logs, which include your IP address, the page requested, the time, and your browser type. They exist to keep the site running and secure, and they are deleted on a routine cycle.
If you contact us by email, we hold what you send us for as long as it takes to deal with your enquiry and to keep a record of it.
2. Who is responsible for your information
There are two different positions, and the distinction is a legal one rather than a formality.
Visitors to this website, and people who contact us
The AHG is the responsible party. We decide why and how your information is processed, and this notice governs it.
Clients of a planning practice using the platform
Where you are a client of a professional practice that uses LifeFile, that practice is the responsible party and the AHG is the operator. The practice decides why and how your information is processed; we hold and process it on their instruction under a written agreement required by section 21 of the Act.
That contract obliges us to process your information only on the practice's instruction, to keep it confidential, to maintain specified security measures, and to notify the practice immediately of any unauthorised access.
We may not use your planning information for our own purposes at all. Not for statistics, not for market research, not for benchmarking, not to build products, and not to train any artificial intelligence system, whether or not it has been de-identified. That is a term of the contract, not a policy we could quietly revise.
Your practice gives you its own privacy notice covering that information. If you want to know what is held about you as a client, ask your practice first. If they cannot help, contact us and we will point you to the right party.
3. What the platform holds about a client
Set out here for transparency, even though the practice is responsible for it. An estate and life plan requires more personal information than almost anything else a person completes: legal identity, family and relationships, assets and liabilities, policies and retirement benefits, dependants, guardianship, business interests, document locations, and the recovery routes for online accounts.
Two categories are treated as special personal information under section 26 of the Act and are held only with explicit consent: information concerning health, including treatment and care preferences, and information concerning religious or philosophical beliefs, where funeral and body wishes rest on them. Information about children is processed only as sections 34 and 35 permit.
4. What we never collect
We do not ask for and do not store passwords, passphrases, one time codes or private keys. The platform records how an account is recovered, never how it is opened. There is no column anywhere in it capable of holding a client credential.
If anyone contacts you claiming to be from Life's Next Chapter or the AHG and asks for a password, a one time code or your banking details, it is not us. Please tell us that it happened.
5. Our lawful basis
For this website and for enquiries, we rely on our legitimate interest in operating the site and in responding to you, and on your consent where you send us something voluntarily.
For client planning information, the practice determines the basis, which is ordinarily consent together with the performance of its engagement with you, and some of it is held because professional or legal obligations require it.
6. Who we share it with
We do not sell personal information, to anyone, ever.
We share it only with operators who help us run the service, under confidentiality obligations, and with authorities where the law requires it. Client planning information is shared only as the responsible practice instructs, and with the people a client has authorised.
7. Where it is stored
Personal information is stored and processed in the Republic of South Africa, on infrastructure under our control. It is not transferred outside the country, and section 72 of the Act therefore does not arise.
8. How it is protected
- Multi factor authentication is mandatory for every account with professional access and cannot be switched off.
- Information is encrypted in transit and at rest, with additional encryption over the most sensitive parts and key material held away from the database.
- Tenancies are isolated at the database layer, so a fault in the application cannot expose one practice's clients to another.
- Every access and every change is written to an audit trail that cannot be edited, and a client can see who has looked at their record and when.
- Backups are encrypted, held in more than one place, and restoring from them is tested on a schedule rather than assumed to work.
- The platform is independently security reviewed before it holds any client information, and at regular intervals afterwards.
No system is beyond risk, and anyone who tells you otherwise is selling something. Where information has been accessed by someone who should not have it, we notify the responsible party immediately, and the responsible party notifies you and the Information Regulator as section 22 requires.
9. How long we keep it
Website access logs are kept briefly and then deleted. Enquiry correspondence is kept for as long as it takes to deal with the matter and to keep a record.
Client planning information is kept for as long as the practice instructs, subject to the retention that professional and legal obligations impose, particularly on executed documents and the evidence of how they were signed. Where a deletion instruction conflicts with such an obligation, we say so plainly and identify the item rather than quietly retaining it.
10. Your rights
- to be told what personal information we hold about you and to receive a copy of it;
- to ask us to correct or delete information that is inaccurate, irrelevant, excessive, misleading or out of date;
- to receive your information in a form you can take elsewhere;
- to object, on reasonable grounds, to the processing of your information;
- to withdraw a consent we relied on, though we will explain the effect first; and
- to complain to the Information Regulator.
To exercise any of these, email info@theahg.co.za. A formal access request may be made under our PAIA Manual. Where you are a client of a practice, the request is made to that practice, and we assist them in answering it.
11. Complaints
Tell us first, at info@theahg.co.za, marked for the attention of the Information Officer. If you are not satisfied with how we deal with it, you may complain to the Information Regulator of South Africa.
12. Changes to this notice
If we change how we handle personal information we will publish an updated notice here and record the date. Where a change is significant and we rely on your consent, we will ask for it again rather than assume it.