Privacy Policy
Version 2026-11-15 · In force from 2026-11-15
This policy explains how Bamboo Media, trading as Bamboo Tech Law ("we", "us"), processes personal information. We follow the Protection of Personal Information Act 4 of 2013 ("POPIA").
1. Two different roles
We are the responsible party for information about the firms that use Bamboo Tech Law and their users (names, emails, billing, sign-in records), for visitors to our website, and for anyone who contacts us. This policy covers that information.
We are an operator for what firms store in the app about *their* clients, cases and other people ("Firm Data"). The law firm is the responsible party for Firm Data. It decides what is stored and why, and we process it only on the firm's instructions, under our Data Processing Agreement. If you are a client of a law firm that uses Bamboo Tech Law, contact that firm about your information. We will pass any request we receive on to the firm.
2. What we collect
| Who | What | Where it comes from |
|---|---|---|
| Firm owners and users | Name, email, role, firm name and details, password (stored only as a one-way hash), two-step sign-in settings | You, when you sign up or are invited |
| Sign-in records: date and time, device type, IP address | Automatically, for security | |
| Billing: plan, invoices, a card token, and the card's last four digits and expiry (we never see or store the full card number) | You, and Paystack | |
| Support messages and feedback | You | |
| Legal acceptances: which terms you accepted, when, and from what IP address | Automatically, when you accept | |
| Website visitors | No tracking cookies and no advertising trackers. Our host keeps standard server logs (IP address, pages, times) for security. To show prices in your currency, your browser asks a currency-rate service for today's rates. | Automatically |
| People who contact us | Name, email, phone, message | You |
We do not knowingly collect information about children for our own purposes. The service is for legal practitioners and their staff.
3. Why we process it (and on what lawful basis)
| Purpose | Lawful basis (POPIA section 11) |
|---|---|
| Creating and running accounts, and providing the service | Performing our contract with the firm |
| Billing, collecting fees, and keeping tax records | Contract, and legal obligation (Tax Administration Act, VAT Act) |
| Security: detecting misuse, keeping sign-in records, preventing fraud | Our legitimate interest, and the firm's, in a secure service |
| Support and service messages (renewals, failed payments, security alerts) | Contract |
| Product news and offers | Your consent, or (for existing customers) our legitimate interest, with an opt-out in every message (POPIA section 69) |
| Complying with the law, court orders and regulators | Legal obligation |
| Recording acceptance of our terms | Contract, and legitimate interest in proving what was agreed |
We do not sell personal information. We do not use automated decisions that have legal effects on you (POPIA section 71).
4. Who we share it with
We use these service providers (operators) to run Bamboo Tech Law. Each processes information only to provide its service to us, under contract terms that require confidentiality and security:
| Provider | What it does | Where the data is |
|---|---|---|
| Supabase | Database, sign-in, document storage | United Kingdom (London) |
| Hostinger | Hosting of the app and website, and sending our emails | Hostinger data centres (see Hostinger's location for our plan) |
| Paystack | Card payments and subscriptions | South Africa / Nigeria |
| Google, Microsoft | Sign-in, only if you choose it | Global |
| Apple, Google, Mozilla push services | Delivering phone notifications you turn on | Global |
We may also disclose information when the law requires it, to protect people from harm, or to our professional advisers (lawyers, auditors) under confidentiality. If our business is sold, information may pass to the buyer, who must protect it as this policy says.
5. Information sent outside South Africa
Some of our providers process information outside South Africa (see the table above). Under POPIA section 72, we transfer it only where the recipient is bound by a law, binding corporate rules or an agreement that gives substantially similar protection to POPIA (for example the UK's data protection law and our providers' data processing terms), or where another ground in section 72 applies.
6. How long we keep it
- Account information: while the account exists, and for up to 12 months after it closes so that we can deal with queries and disputes, unless you ask us to delete it sooner and we have no legal reason to keep it.
- Billing records: 5 years after the end of the tax year they relate to, as tax law requires.
- Security logs: up to 12 months.
- Firm Data: as the firm instructs. See our Terms (clause 11) and Data Processing Agreement.
- Marketing preferences: until you opt out, then a record that you opted out, so we don't contact you again.
7. How we protect it
Our main measures:
- all connections are encrypted (HTTPS);
- information is encrypted on our providers' disks;
- each firm's data is separated by database rules, tested automatically, so that nobody can see another firm's data;
- passwords are stored only as hashes;
- two-step sign-in is available, and required for roles that handle money;
- sign-in attempts are limited, and every sign-in is recorded;
- files are reached only through short-lived links;
- secret keys stay on the server;
- our staff have access only where their role needs it.
See our Security page for more. No system is completely secure. If a breach affects your information, we will tell you and the Information Regulator as POPIA section 22 requires.
8. Your rights
Under POPIA you may:
- ask whether we hold information about you, and for a copy (section 23);
- ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (section 24);
- object to processing based on legitimate interest, and to direct marketing at any time (section 11(3));
- withdraw consent where processing is based on consent;
- complain to the Information Regulator.
Email support@bambootechlaw.com. We will reply within 30 days and may need to confirm your identity first. Access requests may also be made under our PAIA manual.
Information Regulator (South Africa): see inforegulator.org.za for its current complaint forms and contact details.
9. Cookies
The app uses only essential cookies, to keep you signed in and to secure forms. It does not use advertising or analytics cookies. The website does not set tracking cookies. Your browser may store app data on your device (for example offline copies and settings). You can clear it in your browser settings.
10. Contact and Information Officer
Our Information Officer is the director responsible for privacy.
Email: support@bambootechlaw.com
Address: 131 Oxford Road, Rosebank, Johannesburg, 2196, South Africa
11. Changes
We will post any change here, with a new version date, and tell users in the app or by email if the change is material.