Search legal guides

Search MJ Kotze Inc legal guides and articles

Data Protection

Privacy Policy

Last Updated: 18 July 2026

1. Introduction

MJ Kotze Incorporated ("MJ Kotze Inc", "we", "us", "our") is a law firm registered with the Legal Practice Council (Firm No. 17444) and directed by Martin Kotze, an admitted attorney, conveyancer and notary public of the High Court of South Africa. We are committed to protecting your personal information and processing it lawfully, fairly and transparently.

This Privacy Policy explains how we collect, use, store, share and protect personal information in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA") and the regulations made under it. It serves as the notification to data subjects contemplated in section 18 of POPIA. It covers our website at mjkinc.co.za (the "Website"), including its interactive tools, the AI website assistant, and the client and agent portals, as well as personal information we process when you enquire about or make use of our professional services.

2. Information We Collect

We collect only the personal information necessary for the purposes described in this Policy. Depending on how you interact with us, the categories of information we collect include:

  • Enquiries and contact requests: your name, email address, telephone number and the content of your message when you contact us through the Website, by email, by telephone or by WhatsApp.
  • AI website assistant conversations: the messages you type into the assistant, together with a pseudonymous visitor token, your IP address, browser information and referral source. If you ask to be contacted, we also collect the name and contact details you provide at that step. See section 4 for full details.
  • Consultation bookings and payments: your name, email address, telephone number, appointment details and payment confirmation when you book and pay for a consultation or other service. Card and payment details are collected and processed directly by our payment service providers; we do not store your card number.
  • Template and guide downloads: your name and email address when you request one of our downloadable templates or guides.
  • Client engagement information: where you engage the firm, the identification and verification information we are required to collect under the Financial Intelligence Centre Act 38 of 2001 ("FICA"), together with the information needed to conduct your matter, invoice for our services and administer trust monies.
  • Portal accounts: login credentials and account activity where you are given access to a client or agent portal in connection with an engagement.
  • Website usage information: pages viewed, time on page, scroll depth, referral source, approximate location (country), IP address, browser and device information, collected through our own first-party analytics as described in section 3.

We do not intentionally collect special personal information (as defined in section 26 of POPIA, including information concerning health, race, religion, political views or criminal record) through the public areas of this Website, and we ask that you do not submit such information through the contact forms or the AI assistant. Where special personal information is necessary for the conduct of a legal matter, it is processed under the authorisations in section 27 of POPIA, including processing necessary for the establishment, exercise or defence of a right or obligation in law.

3. Cookies and Website Analytics

The Website uses two kinds of cookies:

  • Strictly necessary cookies: session and security cookies (such as the session and cross-site request forgery tokens) that are required for the operation of the Website and its secure areas. These are deleted when your session ends.
  • A first-party analytics cookie: we set a single, first-party visitor identifier cookie (named mjk_vid) that persists for up to 400 days. It contains a random token only — no name, email address or other directly identifying information.

We use the analytics cookie to operate our own, self-hosted website measurement. It records the public pages you visit, how you arrived (referral source and campaign parameters), how long you engage with a page, scroll depth, your IP address, browser information and approximate location (country). We use this information to understand how the Website is used, to measure which content is useful, and to improve our services. Where you go on to identify yourself to us — for example by requesting contact or booking a consultation — we may connect your prior visits to your enquiry so that we can understand how you found us and serve you better.

This processing is performed on the basis of our legitimate interests under section 11(1)(f) of POPIA. It is used for measurement and service improvement only: we do not use analytics data for behavioural advertising or retargeting, we do not use third-party advertising or tracking cookies, and we do not sell or share analytics data with advertising networks. Raw analytics events are deleted after 180 days; only aggregated statistics are retained thereafter. Authenticated areas of the platform, including the client and agent portals, are not tracked. You may object to this processing at any time on the grounds set out in section 11(3) of POPIA by contacting our Information Officer (section 13), and most browsers also allow you to block or delete cookies.

4. AI Website Assistant

The Website offers an optional AI assistant that shares information from our website and points you to the right page or person. Using it is voluntary — the whole Website, and all of our contact channels, work without it. When you use the assistant, we process the messages you type in order to:

  • understand your question and direct you to the relevant page on our website;
  • connect you with a member of our team if you ask us to; and
  • keep a short-term record of the conversation for quality purposes and to follow up if you requested contact.

The assistant is powered by a third-party AI provider, Anthropic, PBC, located in the United States, and the messages you send are processed by that provider outside South Africa under contractual safeguards as described in section 9. The assistant does not give legal advice, and no attorney–client relationship is created by using it. Please do not enter confidential, sensitive or identifying details about a legal matter into the assistant. Your name and contact details are collected only if you choose to request contact from our team.

Chat conversations are retained for 90 days and then deleted. A record of your consent to use the assistant is retained for 5 years. You may request the deletion of a conversation at any time using the control in the chat interface or by contacting our Information Officer.

5. Purpose of Processing

We process personal information for the following purposes:

  • To respond to enquiries submitted through the Website, by email, by telephone or by WhatsApp.
  • To conclude engagements, conduct legal matters, and communicate with clients and other parties in connection with professional services.
  • To administer bookings, invoicing, payments and trust accounting.
  • To provide access to the client and agent portals.
  • To deliver templates, guides and other resources you request, and — with your consent — to send you related legal updates.
  • To measure and improve the content, functionality and security of the Website.
  • To comply with our professional and legal obligations, including under FICA and the rules of the Legal Practice Council.

We will not process your personal information for any purpose incompatible with those stated above without a lawful basis for doing so.

6. Legal Basis for Processing

We process personal information on the following lawful grounds under section 11 of POPIA:

  • Consent (section 11(1)(a)): where you have consented — for example, to use the AI assistant or to receive marketing communications.
  • Performance of a contract (section 11(1)(b)): where processing is necessary to carry out an engagement or other agreement with you, or to take steps at your request before concluding one — for example, administering a booking you have made.
  • Legal obligation (section 11(1)(c)): where processing is required to comply with applicable law or the professional rules binding on attorneys in South Africa, including FICA client identification and record-keeping.
  • Legitimate interest (section 11(1)(f)): where processing is necessary to pursue our legitimate interests — for example, responding to professional enquiries, first-party website measurement, and securing the Website — provided those interests are not overridden by your right to privacy.

7. Direct Marketing

We send electronic marketing — such as legal updates and information about our services — only in accordance with section 69 of POPIA: to prospective clients, only with your prior consent; and to existing clients, only in respect of similar services and with the opportunity to opt out, which existed when we collected your details and is repeated in every message we send. Every marketing email contains a one-click unsubscribe link, and we maintain suppression records to ensure an opt-out is honoured permanently. We do not send marketing by WhatsApp without your explicit consent. Requesting a template or guide, or making an enquiry, does not by itself subscribe you to marketing.

8. Information Sharing

We do not sell, rent or trade your personal information. We share personal information only:

  • Where required by law, court order or professional obligation — for example, reporting obligations under FICA, the rules of the Legal Practice Council, or the requirements of our auditors.
  • Where necessary for the conduct of your matter — for example, with counsel, correspondent attorneys, the Deeds Office, CIPC, SARS or a counterparty's attorneys, on your instructions or as the matter requires.
  • With service providers ("operators" under POPIA) who process personal information on our behalf and on our instructions, subject to written agreements and confidentiality obligations. These include providers of: cloud hosting and file storage; email delivery; the AI assistant (Anthropic, PBC); scheduling; electronic signatures; payment processing; accounting software; and real-time messaging infrastructure.

9. Transfers Outside South Africa

Some of our service providers store or process personal information outside South Africa — including cloud hosting and storage, email delivery, scheduling, electronic signature and accounting providers, and the AI provider that powers the website assistant (located in the United States). We transfer personal information outside South Africa only as permitted by section 72 of POPIA: to recipients bound by contractual terms that provide an adequate level of protection substantially similar to POPIA (section 72(1)(a)), where the transfer is necessary for the performance of a contract with you or steps taken at your request (section 72(1)(c)), or with your consent (section 72(1)(b)) — as is obtained for the AI assistant.

10. Data Retention

We retain personal information only for as long as necessary for the purposes for which it was collected, or as required by law:

  • Contact enquiries that do not lead to an engagement: 12 months from submission, after which they are securely deleted.
  • AI assistant conversations: 90 days. Consent records: 5 years.
  • Raw website analytics events: 180 days; only aggregated statistics are kept thereafter.
  • Client matter records: in accordance with our obligations under FICA (at least 5 years from termination of the business relationship), the rules of the Legal Practice Council, and the applicable prescription periods under South African law.

You may request the deletion of your personal information at any time, subject to our legal and professional obligations to retain certain records.

11. Your Rights Under POPIA

As a data subject under POPIA, you have the following rights:

  • Right of access (section 23): you may request confirmation of whether we hold personal information about you and, if so, a description of that information. Formal requests for access to records are handled under the Promotion of Access to Information Act 2 of 2000 ("PAIA") through our Information Officer, as set out in our PAIA Manual.
  • Right to correction and deletion (section 24): you may request that we correct or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained.
  • Right to object (section 11(3)): you may object at any time, on reasonable grounds relating to your particular situation, to processing based on our legitimate interests — including the website analytics described in section 3 — unless legislation requires the processing.
  • Right to opt out of direct marketing (section 69): you may withdraw consent to, or opt out of, electronic marketing at any time using the unsubscribe link in any message or by contacting us.
  • Right to lodge a complaint: if you believe we have processed your personal information unlawfully, you may lodge a complaint with the Information Regulator.

To exercise any of these rights, please contact our Information Officer using the details in section 13. We will respond within a reasonable time and in accordance with POPIA. Note that information protected by legal professional privilege, or processed for the establishment, exercise or defence of a right or obligation in law, may be subject to limitations on access and deletion.

12. Information Regulator Contact Details

If you are not satisfied with how we have handled your personal information or responded to your complaint, you may contact the Information Regulator of South Africa:

13. Information Officer and Privacy Enquiries

For privacy enquiries, to exercise your rights under POPIA, to object to processing, or to submit a request under PAIA, please contact:

We will acknowledge receipt of your request within a reasonable period and endeavour to resolve it promptly.

14. Security

We implement reasonable technical and organisational measures, as required by section 19 of POPIA, to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access — including encrypted connections, access controls, malware scanning of uploaded files, and audit logging. These measures are reviewed and updated periodically to address evolving threats. In the event of a security compromise affecting your personal information, we will notify you and the Information Regulator as required by section 22 of POPIA.

While we take appropriate precautions, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

15. Children

The Website is not directed at children, and we do not knowingly collect personal information from children through it without the consent of a competent person as required by section 35 of POPIA. If you believe a child has provided us with personal information, please contact our Information Officer so that we can delete it.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will update the "Last Updated" date at the top of this page. We encourage you to review this page periodically.