Privacy Policy and PAIA Manual

MV Inc. (Malan Vermeulen Incorporated) · Version 2 · Effective 25 September 2026

Part A — Privacy Policy

MV Inc. respects the privacy of everyone who contacts us, and the confidence placed in us by the parties to every mediation. This policy explains what personal information we process, why, and your rights under the Protection of Personal Information Act 4 of 2013 (POPIA).

1. Who we are

Malan Vermeulen Incorporated (MV Inc.) is a South African law firm practising exclusively in alternative dispute resolution, and is the responsible party for the personal information described here.

• Registration number: 2025/574036/21
• Address: Ground Floor, Quadrum 3, Quadrum Office Park, 50 Constantia Boulevard, Floracliffe, Johannesburg, 1709
• Telephone: 010 980 5160 · WhatsApp: 069 045 9490
• Email: [email protected]
• Website: www.adrlaw.co.za · Contact page · The Firm

Information Officer: Karen Malan, [email protected], 010 980 5160. The Information Officer is registered with the Information Regulator. MV Inc. has not appointed a Deputy Information Officer. Questions, requests and complaints about personal information go to the Information Officer.

2. Scope

This policy applies to personal information we process when you:

• visit www.adrlaw.co.za or send us an enquiry, referral or newsletter sign-up through it;
• contact us by telephone, email or WhatsApp;
• use one of our six areas of practice: Family Mediation, Civil and Commercial Mediation, Parenting Coordination, Rule 41A Mediation, Workplace Mediation and Conflict Coaching, or Mediation Preparation Consultation and Coaching;
• attend our Mediation for the Modern Attorney webinars or in-house training; or
• are a legal representative, advisor, expert or supplier connected with a matter we handle.

It does not cover third-party websites we link to, which have their own policies.

3. What we collect

4. How we collect it

• Directly from you, through our website forms, by telephone, email, WhatsApp, in person, or on Microsoft Teams.
• From your legal representative or advisor, when they refer a matter or act for you in it.
• From the other parties to a mediation and their representatives, and from court records in court-annexed matters.
• Automatically, through cookies and similar technologies when you use our website (see section 10).

5. Why we use it, and on what grounds

We process personal information only for a defined purpose and on a ground POPIA recognises (section 11).

We do not sell personal information, and we do not use it for purposes unrelated to the reason it was given to us.

6. Special personal information and children

Family and parenting matters often involve health, religious, family and children’s information. We process it only where it is necessary for the mediation or parenting coordination, with the consent of the persons concerned or a competent person for a child, or where it is necessary to establish, exercise or defend a right or obligation in law (section 27(1)(d)), or where POPIA or another law otherwise authorises it (sections 26 to 35). Access is limited to the mediator and staff working on the matter.

7. Confidentiality of mediation

Mediation is a confidential, without-prejudice process. What is said and disclosed in a mediation is used only for that mediation and is not disclosed outside it, except:

• as the parties agree in writing;
• to the extent a settlement agreement is made an order of court or must be enforced;
• where Rule 41A of the Uniform Rules of Court, a court practice directive or a court order requires a report on the process, which never includes what was said in it; or
• where the law compels disclosure, for example to protect a child or another person from serious harm.

8. Who we share it with

We do not share personal information with third parties. Information in a matter is shared only:

• among the parties to that specific mediation, by agreement;
• in parenting coordination matters, with the court and the parties’ acknowledged legal teams, as the Parenting Coordination Appointment provides; and
• with any other person agreed to in writing in the Agreement to Mediate, the Fee Agreement, the Parenting Coordination Appointment or the Client Mandate, such as an expert engaged for the matter, who is then bound by the same confidentiality.

The only other disclosures are those the law compels, for example FICA reporting, a subpoena or a court order.

The service providers below are not third parties in this sense. They are “operators” under POPIA: they process information only on our instructions, under written terms that require confidentiality and appropriate security (sections 20 and 21), and may not use it for their own purposes.

9. Information sent outside South Africa

Matter records are held in Lawbox and on the firm’s Microsoft 365 drive, which is hosted in Microsoft’s Johannesburg data centre. SiteGround, Google, SMTP2GO and Meta (WhatsApp) process information outside South Africa, including in the European Union and the United States. We use only providers bound by data-protection laws or contractual terms giving protection substantially similar to POPIA, as section 72 requires.

10. Cookies, analytics and advertising

Our website uses cookies (small files stored in your browser) and a few outside services. This section explains each one.

Your choice. When you first visit, a banner asks whether you accept analytics and advertising cookies. Essential cookies are always on. Google Analytics and Google Ads load only if you accept them, and you can change your choice at any time through the “Cookie settings” link at the foot of every page.

Google Analytics. With your consent, Google Analytics (provided by Google) records how the site is used: the pages you view, how you arrived, your device and browser type, and your approximate location. It uses a random identifier, not your name, and Google Analytics does not store your IP address. When you send an enquiry or referral form, Analytics records that a form was sent, but not what you wrote in it. Our property keeps event-level data for 2 months and user-level data for 14 months; summary reports are kept longer but identify no one.

Google Ads. We advertise our services on Google. With your consent, Google Ads measures whether someone who clicked one of our advertisements later called us or sent an enquiry, so that we can judge whether the advertising works. We do not give Google your name, email address or the contents of your enquiry.

Website forms and SMTP2GO. When you send an enquiry, referral or newsletter sign-up, the details you enter are stored securely on our website and emailed to [email protected] through SMTP2GO, an email delivery service. SMTP2GO carries the message on our instructions and keeps delivery records for a limited period under its own terms.

WhatsApp. The WhatsApp links on our site open WhatsApp, a service of Meta, on your own device. The site sets no WhatsApp cookies. If you message us, we receive your name, number and message on the firm’s WhatsApp number. WhatsApp encrypts messages end to end, but Meta processes some information about the use of its service under its own privacy policy. Please do not send confidential documents by WhatsApp; we will give you a secure alternative.

Microsoft Teams. Virtual mediations and consultations take place on Microsoft Teams, within the firm’s Microsoft 365 environment hosted in Johannesburg. You join through a link we send you; a Microsoft account is not required. Sessions are not recorded unless all parties agree in writing.

You can also block or delete cookies in your browser settings, and opt out of Google Analytics with Google’s browser add-on.

11. How long we keep it

At the end of the period we destroy, delete or de-identify the information securely (section 14).

12. How we protect it

We take appropriate technical and organisational measures to protect personal information against loss, damage and unauthorised access (section 19). They include encrypted website connections, access limited to the people working on a matter, password and multi-factor protection on firm systems, confidentiality undertakings from staff and experts, and secure disposal. If we believe personal information has been accessed without authority, we will notify the Information Regulator and the persons affected as section 22 requires.

13. Your rights

Under POPIA you may:

• be told when personal information about you is collected, and if it has been accessed or acquired by an unauthorised person;
• ask whether we hold personal information about you, and for a copy of it (section 23);
• ask us to correct, update or delete information that is inaccurate, irrelevant, excessive, out of date or unlawfully obtained (section 24);
• object to processing based on our legitimate interests, and to direct marketing at any time (section 11(3));
• withdraw consent you have given, without affecting processing before the withdrawal;
• not be subject to a decision based solely on automated processing that significantly affects you. We make no such decisions;
• complain to the Information Regulator; and
• institute civil proceedings about an alleged interference with the protection of your personal information.

Send requests to the Information Officer. We may need to verify your identity first. Some information cannot be released or deleted, for example where it belongs to another party to a mediation, is privileged, or must be kept by law. Access requests are also governed by our PAIA manual.

14. Newsletters and direct marketing

We send The MV Ink newsletter and invitations to our Mediation for the Modern Attorney webinars only to people who have signed up, or to existing contacts about similar services, as section 69 allows. Every message has an unsubscribe link, and you can also ask the Information Officer to remove you.

15. PAIA manual

Our manual under the Promotion of Access to Information Act 2 of 2000 explains how to request records we hold. It is published in full as Part B below, and is also available for inspection at our offices and on request from the Information Officer.

16. Complaints, changes and contact

If you are unhappy with how we have handled your personal information, please contact our Information Officer first. You may also complain to the Information Regulator:

• Physical address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• Postal address: P.O. Box 31533, Braamfontein, Johannesburg, 2017
• Telephone: 010 023 5200 · toll-free 0800 017 160
• Email: [email protected]
• Website: inforegulator.org.za, where complaint forms are available

We may update this policy from time to time. The version and effective date at the top show when it last changed.

This policy is governed by the laws of the Republic of South Africa, including POPIA and PAIA.

Contact: Karen Malan, Information Officer, MV Inc., Ground Floor, Quadrum 3, Quadrum Office Park, 50 Constantia Boulevard, Floracliffe, Johannesburg, 1709 · 010 980 5160 · [email protected]

Part B — PAIA and POPIA Manual

Prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA) and in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA). This manual applies to Malan Vermeulen Incorporated (trading as MV Inc.), registration number 2025/574036/21.

1. Definitions

Unless the context indicates otherwise:

• “PAIA” means the Promotion of Access to Information Act 2 of 2000, as amended.
• “POPIA” means the Protection of Personal Information Act 4 of 2013.
• “Conditions for Lawful Processing” means the conditions in Chapter 3 of POPIA.
• “Data Subject”, “Personal Information” and “Processing” have the meanings given in section 1 of POPIA.
• “Information Officer” means the head of MV Inc., designated in terms of section 56 of POPIA and responsible for compliance with POPIA and PAIA.
• “Information Regulator” means the Regulator established by section 39 of POPIA.
• “Manual” means this PAIA and POPIA Manual.
• “Private Body” means MV Inc. as defined in PAIA.
• “Record” means any recorded information, in any form or medium, in the possession or under the control of MV Inc.
• “Requester” means any person requesting access to a record of MV Inc. in terms of PAIA.

2. Purpose of this Manual

This Manual:

• describes the structure and functions of MV Inc. and the categories of records it holds;
• explains how members of the public may request access to those records in terms of PAIA;
• describes how MV Inc. processes personal information in accordance with POPIA, and the rights of data subjects; and
• promotes transparency and accountability in the processing of information.

3. Details of MV Inc.

4. Information Officer

In terms of section 56 of POPIA, the head of a private body is its Information Officer. MV Inc.’s Information Officer is Karen Malan, Managing Director, who may be contacted at [email protected], 010 980 5160, or the address above. No Deputy Information Officer has been appointed; one may be appointed if needed.

The Information Officer:

• encourages compliance with PAIA and POPIA within the firm;
• deals with requests for access to records;
• ensures personal information is processed in accordance with POPIA;
• works with the Information Regulator on investigations and complaints;
• ensures appropriate policies and procedures protect personal information; and
• assists data subjects who wish to exercise their rights under POPIA.

5. The Information Regulator’s Guide to PAIA

In terms of section 10 of PAIA, the Information Regulator has compiled a Guide on how to use PAIA and obtain access to records. It covers the objects of PAIA, how to make a request, the assistance available from Information Officers and the Regulator, legal remedies, voluntary disclosure, fees, and the PAIA regulations. The Guide is available in each official language and in braille, from the Regulator’s offices during working hours or its website.

6. Records available without a formal request

The records below are available on our website or on informal request to the Information Officer, subject to a reasonable reproduction fee for copies.

This does not oblige MV Inc. to release any record containing confidential, personal or legally protected information.

7. Records kept in terms of other legislation

The records below are kept under the legislation listed, and may be accessed by persons entitled to them under that legislation.

8. Subjects on which records are held

Access to these records may be limited by confidentiality, legal professional privilege, the protection of personal information, contractual restrictions or other legislation.

9. How to request access to a record

1. Use the prescribed form. Complete PAIA Form 2 (Request for Access to Record, Regulation 7) and send it to the Information Officer by email or by delivery to our offices.
2. Give enough detail to identify the record, your identity, the form of access you want, and a postal or email address in South Africa. Explain which right you want to exercise or protect, and why the record is needed for it.
3. Acting for someone else? Provide proof of the capacity in which you make the request.
4. Need help? If you cannot complete the form because of illiteracy, disability or another reason, the Information Officer will help you.

The Information Officer will acknowledge the request and advise of any request fee. MV Inc. will decide within 30 days, and may extend this once by up to 30 days where the request covers many records, needs a search through a large volume of records, requires consultation with third parties, or the records cannot reasonably be obtained in time. You will be told in writing of any extension.

You will be told in writing whether the request is granted, partly granted or refused. If granted, the notice sets out any access fee, the form of access and how to obtain the record. If refused, it gives the reasons and the remedies available.

• Severability: where part of a record is protected, the rest will be released where reasonably possible.
• Records not found: if a record cannot be found after a reasonable search, or does not exist, you will be told by affidavit or affirmation. If it is found later, access will be given unless it may lawfully be refused.
• Identifying records: requests must describe records with reasonable particularity. MV Inc. is not obliged to conduct open-ended searches of email archives, backups or document stores for broadly framed requests, and may ask for more detail.
• Legal proceedings: PAIA may not be used to circumvent discovery, subpoena or other procedures for obtaining documents in legal proceedings. Where a request relates to pending or contemplated proceedings, MV Inc. may require it to be pursued under the rules of those proceedings.

10. Grounds for refusing access

Each request is considered on its merits under Chapter 4 of PAIA. The main grounds on which access may be refused are:

• Personal information of a third party, where disclosure would be unreasonable, unless the third party consents or the law permits it.
• Commercial information of a third party, including trade secrets and information supplied in confidence whose disclosure could cause harm.
• Confidential information supplied in confidence, where disclosure would breach a duty of confidence.
• Safety of individuals and property, where disclosure could endanger life or safety or prejudice the security of property.
• Legally privileged records, which must be refused unless the privilege is waived. This includes legal advice, privileged correspondence and information a client gives an attorney to obtain advice or assistance.
• Mediation and matter files, which contain information of several parties, including privileged, confidential and without-prejudice communications, and personal or commercial information of third parties.
• Commercial information of MV Inc., including trade secrets, information that could harm its interests or negotiating position, and information that could compromise the security of its systems, premises or people.
• Research information of MV Inc. or a third party, where disclosure would seriously disadvantage the research or researcher.
• Frivolous or vexatious requests, or requests that would unreasonably divert the firm’s resources.

Despite these grounds, access must be given where disclosure would reveal a substantial contravention of the law or an imminent and serious public safety or environmental risk, and the public interest in disclosure clearly outweighs the harm.

11. Remedies

• Internal appeal: MV Inc. has no internal appeal procedure, so the Information Officer’s decision is final within the firm.
• Complaint to the Information Regulator: a requester may complain, in the prescribed form, about a refusal, a failure to respond in time, unreasonable fees, or any other alleged infringement of PAIA or POPIA.
• Court application: a requester or third party may apply to a court with jurisdiction for relief.

12. Processing of personal information

MV Inc. processes personal information lawfully, fairly and transparently, in accordance with the Conditions for Lawful Processing in Chapter 3 of POPIA. Part A of this page sets out in full the purposes, lawful grounds, operators, cross-border transfers, security safeguards, retention periods and data-subject rights. In summary:

MV Inc. does not share personal information with third parties. Information in a matter is shared only among the parties to that mediation by agreement, with the court and the parties’ acknowledged legal teams in parenting coordination matters, with any other person agreed to in writing in the Agreement to Mediate, Fee Agreement, Parenting Coordination Appointment or Client Mandate, or where the law compels disclosure. Operators that provide services to the firm process information only on its instructions (Part A, section 8).

13. Availability and updating of this Manual

This Manual is available on our website, for inspection at our offices during business hours, on request from the Information Officer, and to the Information Regulator on request. Copies may be subject to the reproduction fee prescribed in the PAIA Regulations. MV Inc. will review the Manual periodically and publish any amendments in the same way.

14. Request form

The prescribed forms are published by the Information Regulator and do not need to be uploaded to our site:

The Information Officer will also email any of these forms on request.

Issued by Karen Malan, Managing Director and Information Officer, MV Inc. · Version 2 · 25 September 2026