How Mongwalo handles personal information
Effective date: to be set at go-live. This notice explains what personal information Mongwalo collects, why it is collected, where it is kept and what your rights are under South Africa's Protection of Personal Information Act (POPIA).
Who is responsible for your information
Mongwalo, operated by Clekzo Studio, Johannesburg, South Africa, is the responsible party for personal information processed on this platform. Questions, requests and complaints about personal information can be sent to [email protected].
What we collect
- Account information: the name, email address and password of account holders. Passwords are stored in hashed form, never as plain text.
- Signer information: the name, email address and signature of each person invited to sign a document. Signers do not need an account.
- Documents: the files uploaded for signing and the sealed, completed versions.
- Audit trail: a record of signing events, including who was invited, who viewed, who signed, timestamps and technical identifiers logged with those events.
- Correspondence: emails you send to us, for example support or pricing enquiries.
Why we collect it
- To run the signing process: sending invitations, collecting signatures and delivering sealed copies to every party.
- To maintain the audit trail that makes a signed document verifiable.
- To operate accounts, provide support and respond to enquiries.
- To meet legal obligations that apply to electronic signatures and records.
Mongwalo does not sell personal information and does not use it for advertising.
Where your information is kept
Documents are stored in Cloudflare R2 object storage. Platform data, including accounts and audit trails, lives in a Postgres database on Mongwalo's own server, hosted in a European data centre. Signing invitations and notifications are delivered by Resend. All traffic to and from the platform is encrypted over HTTPS.
This means personal information is processed on servers outside South Africa, including in the European Union. POPIA's rules on transfers of personal information outside the Republic (section 72) apply to those transfers.
How long we keep it
Signed documents and their audit trails are legal records. They are kept for as long as the associated account is active, or for as long as the law requires. Other personal information is kept only as long as it is needed for the purposes above. You can ask us to delete personal information we have no legal duty to keep.
Your rights under POPIA
- You may ask what personal information we hold about you and request a copy.
- You may ask us to correct or delete personal information, subject to the retention rules above.
- You may object to processing of your personal information.
- You may lodge a complaint with the Information Regulator (South Africa) if you believe your personal information has been mishandled.
To exercise any of these rights, email [email protected].
The Information Regulator (South Africa) can be reached at JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001, by email at [email protected] (complaints) or [email protected] (general enquiries), or by phone on 010 023 5200.
Cookies
The signing platform uses session cookies that are necessary to keep you signed in. This website and the platform do not use advertising or tracking cookies.
Changes to this notice
If this notice changes, the updated version will be published on this page with a new effective date.