Data Processing Addendum

For client personal information entered into ClientBrief, the brokerage is the POPIA responsible party and Kyvane (Pty) Ltd is its operator. Kyvane processes that information only on the brokerage’s documented instructions, including the service configuration, authorised user actions, and this addendum, unless South African law requires otherwise.

Kyvane limits access to authorised people who need it to provide or secure the service and requires them to keep personal information confidential. The current service safeguards include encryption in transit, hosting-provider encryption at rest, broker-level row security, private document storage, expiring signing links, and access controls for production systems. These controls are described in more detail in the Privacy Policy.

The approved sub-processors for this addendum are the providers listed below, for their stated purposes. Kyvane will give brokers notice of a material change and will maintain an appropriate written record of its vendor review before production launch.

• Supabase: Database, authentication and encrypted document storage (Ireland (European Union)).
• Resend: Transactional email delivery (client invitations, completion notices) (United States).
• Paddle: Payment processing and subscription billing. Paddle is the merchant of record and is a separate responsible party for your payment information. (United Kingdom).
• Vercel: Application hosting and content delivery (Global edge network).
• Google / Microsoft: Optional single sign-on, only if you choose to use it (United States).

Processing may occur outside South Africa where a listed provider operates there. Kyvane will assess the applicable POPIA section 72 transfer safeguards and provider terms as part of that vendor review; this page does not claim that separate vendor DPAs have already been signed.

Kyvane will provide reasonable assistance for data-subject access, correction, objection and deletion requests that the brokerage receives, and for the brokerage’s POPIA compliance enquiries that relate to ClientBrief processing. Kyvane will notify the affected brokerage without undue delay after confirming a security compromise involving that brokerage’s client personal information, so the brokerage can meet its own notification duties.

On a verified instruction from the brokerage at the end of services, Kyvane will make client records available for return or process a lawful deletion request. Deactivation alone is not a deletion instruction. Return or deletion remains subject to applicable legal, tax, FAIS, FICA, insurer, and other retention duties; Kyvane will not delete records where doing so would breach a duty that applies.

On reasonable written notice, Kyvane will provide information reasonably necessary to demonstrate compliance with this addendum and cooperate with a proportionate audit that does not compromise other brokerages’ information, service security, or confidentiality. The parties will agree the scope, timing and any reasonable cost before an on-site audit.

A South African lawyer experienced in POPIA and financial-services technology must approve this addendum’s final wording before production launch. For an instruction, question, or request under this addendum, contact hello@myclientbrief.com. This addendum should be read with the Terms of Service and Privacy Policy.