POPIA Notice & PAIA Manual

Version 1.3.1 — published 13 October 2026. It applies to new customers from 13 October 2026 and to existing customers from 12 November 2026. See What changed in 1.3 at the end.

This notice supplements our Privacy Policy for people in South Africa. It gives the information required by section 18 of the Protection of Personal Information Act 4 of 2013 (POPIA) and contains our manual under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA).

SiteMinutes is a trading name of Deidre and Co (Pty) Ltd, a private company registered and domiciled in South Africa. POPIA applies to all our processing of personal information: we are the responsible party for account, billing, support and website information, and the operator for the content our customers put into SiteMinutes. We store our data in the European Union (see section 6). As a private body, we publish our PAIA manual in section 10.

1. Contact details and Information Officer

2. Our two roles under POPIA

• Responsible party for account, billing, support and website information (we decide why and how it is processed).
• Operator (section 1 of POPIA) for the content our customers put into SiteMinutes: projects, recordings, transcripts, minutes, attendance lists, plans and documents. The customer is the responsible party. We process that content only with the customer's knowledge and authorisation (section 20), keep it confidential, and apply the security measures required by section 19, under our Data Processing Addendum (the written contract required by section 21).

3. Categories of data subjects and their personal information

Call audio. On a Mac, the optional Call audio switch records the microphone together with all sound the Mac plays, including the other people in a Teams, Zoom or Google Meet call. SiteMinutes records on the Mac and does not join the call, so those people get no recording notice from the call app. The customer must tell everyone at the start that the meeting is being recorded, and must not record where consent is refused or where the law of any participant's location requires consent that has not been given.

Calendar access. With the user's permission, the apps read the device's calendars to list invites from 3 days ago to 2 weeks ahead, on the device only. Only the invite the user chooses is copied into the meeting (date and time, venue or meeting-link type, attendee names and e-mail addresses); other calendar events never leave the device. Invitees are collected indirectly, so the customer (the responsible party) is responsible for informing them under section 18, as with any contact it adds.

SiteMinutes is not designed to process special personal information (for example health, religious beliefs or criminal behaviour) or the personal information of children. Such information may, however, be spoken in a meeting. Customers should avoid recording it unless they have a lawful basis under sections 27 or 35 of POPIA.

4. Purposes of processing

• Providing the Service: recording, transcription, drafting and editing minutes, syncing and storing project records.
• Opening and managing accounts, workspaces, seats and invitations.
• Billing, collecting payments and keeping accounting and tax records.
• Support, the help assistant, and communication about the Service.
• Service e-mails (sign-in links, invitations, receipts, plan and trial reminders, security and legal notices), which are always sent; and product-update e-mails ("What's new") to customers only, each with an unsubscribe link and one-click unsubscribe. Our e-mails contain no tracking pixels or rewritten links.
• Copying the details of a calendar invite the user chooses into a meeting.
• Security, abuse prevention, error fixing and cost control.
• Complying with the law and protecting our rights.

The lawful grounds (section 11) are: performance of a contract with the data subject or our customer (section 11(1)(b)), compliance with an obligation imposed by law (section 11(1)(c)), and our legitimate interests or those of our customer (section 11(1)(f)). Where the customer relies on the consent of meeting participants (section 11(1)(a)), the customer must obtain it. The Privacy Policy sets out the ground for each purpose.

Direct marketing (section 69). We send direct marketing by e-mail only with the data subject's consent or, under section 69(3), to our own customers about SiteMinutes itself, with a free way to opt out in every message. Product-update e-mails ("What's new") go to customers only and have an unsubscribe link and one-click unsubscribe. We send no other direct marketing and never sell personal information.

Retention (section 14). We keep personal information only as long as we need it for these purposes or as the law requires (for example, billing records for 7 years). The periods are in the Data Retention & Deletion Policy.

Cookies. The website and web app use only the cookies and browser storage needed to sign in, remember display preferences and show an estimated price; see the Cookie Policy.

5. Recipients

Our operators (sub-processors) are listed in the Privacy Policy: Supabase (database, sign-in and storage, Frankfurt, Germany), Vercel (web hosting, Frankfurt and worldwide edge), OpenAI (speech-to-text, United States), Anthropic (AI drafting and help, United States), Paystack (card payments, South Africa; part of the Stripe group), Resend (e-mail delivery from noreply@siteminutes.com; a United States company sending from its EU region in Ireland), Microsoft (Microsoft 365, which hosts our support mailbox help@siteminutes.com) and Apple (app distribution). If we publish an Android app on Google Play, Google will distribute it under its own terms and we will add it to this list. We may also disclose information to professional advisers, regulators or courts when the law requires it.

6. Cross-border transfers (section 72)

Personal information is transferred outside South Africa to the European Union (our database and storage), to the United States (AI transcription and drafting), and to our e-mail providers Resend (a United States company that sends our e-mails from its EU region in Ireland) and Microsoft 365 (our support mailbox). For the e-mail providers we rely on the safeguards in the provider's data processing terms, such as standard contractual clauses. We transfer it only because:

• each recipient is bound by a written agreement (including Standard Contractual Clauses where applicable) that provides an adequate level of protection substantially similar to the conditions for lawful processing in POPIA, and that restricts onward transfers (section 72(1)(a)); and
• the transfer is necessary to perform the contract between us and our customer, and between the customer and its users (section 72(1)(b) and (c)).

The AI providers receive only what is needed for the task, do not use it to train their models under their business terms, and keep it only for short periods (see the AI & Recording Policy).

7. Security safeguards (section 19)

Encryption in transit and at rest, row level security that separates every company's data in the database, secrets in an encrypted vault, least-privilege access, audited administrative functions and daily backups. See the Security Overview.

8. Security compromises (section 22)

If we have reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, we will notify the affected customer (the responsible party) without undue delay so it can notify the Information Regulator and data subjects. Where we are the responsible party, we will notify the Information Regulator and the affected data subjects ourselves, as soon as reasonably possible.

9. Your rights

As a data subject you have the right to:

• be told that personal information about you is being collected (section 18) and whether it has been accessed by an unauthorised person (section 22);
• ask whether we hold personal information about you and request a record or description of it (section 23);
• ask for it to be corrected, destroyed or deleted (section 24);
• object to its processing on reasonable grounds (section 11(3)), and to direct marketing (sections 11(3)(b) and 69) — every product-update e-mail has an unsubscribe link and one-click unsubscribe (service e-mails needed to run your account are still sent);
• not be subject to a decision based solely on automated processing (section 71); and
• complain to the Information Regulator and institute civil proceedings (section 99).

Making a request. E-mail help@siteminutes.com. You may use the Information Regulator's forms (POPIA Form 1 for objections, Form 2 for correction or deletion), but a clear e-mail is enough. We will confirm your identity and answer within 30 days. If the request concerns a customer's meeting content, we will pass it on to that customer and help it answer.

10. PAIA manual (section 51)

This is the manual of Deidre and Co (Pty) Ltd, trading as SiteMinutes, as a private body under section 51 of PAIA.

10.1 Contact details

10.2 Guide on how to use PAIA

The Information Regulator has published the guide described in section 10 of PAIA, in all official languages. It is available at inforegulator.org.za, and we will send you a copy on request.

10.3 Records we hold

10.4 Records available without a request

Everything published at siteminutes.com/legal.

10.5 Records kept in terms of legislation

The Companies Act 71 of 2008, the Income Tax Act 58 of 1962, the Tax Administration Act 28 of 2011, the Electronic Communications and Transactions Act 25 of 2002, the Consumer Protection Act 68 of 2008, POPIA and PAIA, to the extent they apply.

10.6 Processing of personal information

The purposes of processing are in section 4, the categories of data subjects and of their personal information in section 3, the recipients in section 5, planned cross-border transfers in section 6, and our security measures in section 7.

10.7 How to request access

Use PAIA Form 2 (Request for Access to Record), available on the Information Regulator's website, and e-mail it to the Information Officer at help@siteminutes.com. Give enough detail to identify the record, the form of access you want and, if you act for someone else, your authority. A request fee and access fees may apply as prescribed in the PAIA regulations; we will tell you before any fee is payable. We answer within 30 days (extendable by up to 30 days as PAIA allows). A request may be refused on the grounds in Chapter 4 of Part 3 of PAIA (for example to protect a third party's personal or commercial information). If you are not satisfied with our answer, you may complain to the Information Regulator (section 11) or apply to court.

10.8 Availability of this manual

This manual is published at siteminutes.com/legal/popia-notice and is available free of charge on request from help@siteminutes.com and at our registered office.

11. Information Regulator

12. Updates

We review this notice at least once a year and whenever our processing changes. The current version is always at siteminutes.com/legal/popia-notice.

What changed in 1.3

1.3.1 (13 October 2026, the same day): the Information Officer is Deidré de Waal, director of Deidre and Co (Pty) Ltd; section 10 is now our full PAIA manual; the lawful ground (section 11), direct marketing (section 69), retention and cookies are spelled out; the Information Regulator's complaints page is added.

Version 1.3 replaces version 1.2. It applies to new customers from 13 October 2026 and to existing customers from 12 November 2026. In short:

• New operator. SiteMinutes is now a trading name of Deidre and Co (Pty) Ltd (registration number 2023/811635/07), a private company registered in South Africa, with its registered office at Regus Century City, The Colosseum, Foyer 3, 1st Floor, Century Way, Century City, Cape Town 7441, South Africa. Under section 20 of the Terms (Assignment), Deidre and Co (Pty) Ltd takes over every existing customer agreement from 13 October 2026 and honours it in full: your plan, prices, paid periods, data and settings stay as they are.
• South African law. The Terms are governed by South African law, and our POPIA Notice is now that of a South African responsible party. The consumer rights you have under the law of the country where you live are not affected.
• Rand only, through Paystack. All prices are charged in South African rand (ZAR). Card payments will be processed by Paystack (Paystack South Africa (Pty) Ltd, a Stripe company), our new payment provider. Until card payment through Paystack opens, you can pay by EFT on invoice through a support ticket.
• Version 1.2 dates stay. The changes announced in version 1.2 (sub-processors Resend and Microsoft 365, Mac Call audio, calendar invites, once-off payments with reminders, product-update e-mails) take effect on 30 October 2026, as announced.

If you are an existing customer and do not agree to version 1.3, you may cancel before 12 November 2026 and receive a pro-rata refund of any prepaid, unused period (Terms, section 18). Under the Data Processing Addendum you may object to Paystack as a new sub-processor before that date by writing to help@siteminutes.com.