Data Protection (POPIA)

Mammrlla is committed to protecting personal information in line with South Africa's Protection of Personal Information Act, 2013 (POPIA). This page explains how we apply POPIA's principles across our business and the systems we build for clients. It complements our Privacy Policy.

Our role

Depending on the engagement, we may act as a responsible party (deciding why and how information is processed, for example, our own marketing) or as an operator (processing personal information on behalf of a client who is the responsible party). Where we act as an operator, processing is governed by a written agreement.

The conditions we uphold

• Accountability, we take responsibility for lawful processing across our systems.
• Processing limitation, we process information lawfully, with consent or another valid basis, and only what is necessary.
• Purpose specification, we collect information for clear, defined purposes.
• Further processing limitation, we don't use information for incompatible new purposes.
• Information quality, we take reasonable steps to keep information accurate and current.
• Openness, we are transparent about what we collect and why.
• Security safeguards, we apply appropriate technical and organisational measures to protect information.
• Data subject participation, we honour your rights to access and correct your information.

Client accounts and billing pages

Where we give a client a live billing page on this site, that account keeps a record of which items are opened on it: which tab was opened, which line was expanded to read the reason behind it, which document or delivery was opened or downloaded, which supporting evidence was followed, and which queries were raised or marked settled. Each sitting is grouped together and kept with the account, and we are notified once at the end of it.

We keep this for one purpose: so that when a client asks us about a line, we can answer it against what was actually opened rather than from memory. It is part of the billing record and it is not used for advertising, profiling or scoring, and it is not shared with anyone outside Mammrlla.

We do not record how a person browses. There is no tracking of mouse movement, scroll position, keystrokes, or how long a cursor rests anywhere, and no third-party analytics or advertising tool is loaded on a client billing page. The record is of the work, not of the person. The billing page itself says so, in plain words, on the page.

Operator commitments

When we process personal information for a client, we do so only on documented instructions, maintain confidentiality, apply appropriate security, assist with data-subject requests, and securely delete or return information at the end of the engagement.

Security breaches

Where a security compromise affecting personal information occurs, we will act promptly to contain it and will notify the relevant responsible party and, where required, the Information Regulator and affected data subjects, in line with POPIA.

Your rights and the Regulator

You may request access to, or correction of, your personal information, and object to certain processing. You also have the right to complain to the Information Regulator of South Africa. To make a request, contact our information officer at obakengm@mammrlla.com.