Privacy Policy (POPIA) | YourLifeFile

Last updated: 7 October 2026 · Version 5 · YourLifeFile (Pty) Ltd

PRIVACY POLICY

YourLifeFile (Pty) Ltd | Registration Number: 2026/072254/07

Effective date: 27 July 2026

Privacy commitment: YourLifeFile does not sell your Personal Information and does not disclose it to unrelated third parties for their own direct-marketing purposes.

1. Introduction

1.1 YourLifeFile (Pty) Ltd (registration number 2026/072254/07) respects your privacy and is committed to protecting your Personal Information.

1.2 This Privacy Policy explains how we handle your Personal Information - including how we collect, store, use, share, protect and delete it - when you:

1.2.1 visit or use the YourLifeFile website or Platform;

1.2.2 register an Account;

1.2.3 create or maintain a Life File;

1.2.4 activate or purchase a Membership;

1.2.5 participate in the referral programme;

1.2.6 use the YourLifeFile Wallet;

1.2.7 nominate a Trusted Person;

1.2.8 submit or participate in an Access Request;

1.2.9 contact YourLifeFile for support;

1.2.10 receive communications from YourLifeFile; or

1.2.11 otherwise interact with YourLifeFile.

1.3 This Privacy Policy is intended to comply with the Protection of Personal Information Act 4 of 2013 (POPIA) and other applicable South African laws. Where and to the extent that the EU General Data Protection Regulation (Regulation (EU) 2016/679) (EU GDPR) or the United Kingdom General Data Protection Regulation (UK GDPR) applies to the processing of your Personal Information, this Privacy Policy is also intended to comply with those laws, as further explained in section 2A.

2. Who We Are

2.1 YourLifeFile is operated by:

Company: YourLifeFile (Pty) Ltd

Registration number: 2026/072254/07

Website: www.yourlifefile.co.za

Email: info@yourlifefile.co.za

Physical address: 10 Lantana Street, West Acres, Mbombela, Mpumalanga, South Africa, 1201

2.2 For purposes of POPIA, YourLifeFile is generally the Responsible Party in relation to Personal Information processed through the Platform. Where the GDPR or UK GDPR applies, YourLifeFile is generally the Controller of that Personal Information.

2.3 Service providers that process Personal Information on our behalf may act as Operators under POPIA and, where the GDPR or UK GDPR applies, as Processors.

2.4 Information Officer / privacy contact: Christo Odendaal (christo@yourlifefile.co.za). The Information Officer performs a role broadly equivalent to a data protection contact and, where a Data Protection Officer is required under the GDPR or UK GDPR, will fulfil or coordinate that function.

2.5 EU / UK Representative: Where YourLifeFile is required under Article 27 of the EU GDPR or the UK GDPR to designate a representative in the European Union or the United Kingdom, the current representative and its contact details will be published on the Platform. Until a representative is formally appointed, EU and UK Data Subjects may contact YourLifeFile directly using the contact details in section 47.

2A. Application of the GDPR and UK GDPR

2A.1 YourLifeFile is established and operated in South Africa and its services are primarily directed at South African users.

2A.2 The EU GDPR or UK GDPR may nevertheless apply to the processing of your Personal Information where:

2A.2.1 you are located in the European Economic Area (EEA) or the United Kingdom and YourLifeFile offers the Platform or Membership to you (irrespective of whether payment is required); or

2A.2.2 your behaviour is monitored as far as that behaviour takes place within the EEA or the United Kingdom.

2A.3 Where the GDPR or UK GDPR applies, the additional protections described in this Privacy Policy (including the lawful-basis framework in section 10, the data subject rights in section 36, the transfer safeguards in section 23 and the breach-notification standard in section 27) apply in addition to, and are to be read consistently with, the protections provided under POPIA.

2A.4 Where there is any genuine conflict between POPIA and the GDPR or UK GDPR in respect of a particular Data Subject, YourLifeFile will apply the standard that provides that Data Subject with the greater protection to the extent lawful and practicable.

3. Purpose of the Platform

3.1 YourLifeFile is a secure information organisation, document storage and reference platform that enables Members to organise important life information for use during life, incapacity and after death.

3.2 The Platform may allow a Member to:

3.2.1 record important personal, financial, insurance, medical and estate-related information;

3.2.2 upload supporting documents;

3.2.3 record the location of original documents;

3.2.4 nominate Trusted Persons;

3.2.5 manage Membership information;

3.2.6 participate in the referral programme;

3.2.7 manage Referral Rewards through a Wallet;

3.2.8 receive completion, update and renewal reminders;

3.2.9 support controlled Access Requests following death, illness or incapacity; and

3.2.10 support the administration of a deceased Member’s Wallet balance.

3.3 YourLifeFile does not provide financial, legal, medical, tax, fiduciary or estate-planning advice.

4. Important Definitions

4.1 In this Privacy Policy:

4.1.1 “Access Request” means a request for access to a Member’s Life File submitted through the Platform’s controlled verification process.

4.1.2 “Account” means the registered user account through which a Member accesses the Platform.

4.1.3 “Controller” means, under the GDPR or UK GDPR, the person that determines the purposes and means of processing Personal Information (broadly equivalent to a Responsible Party under POPIA).

4.1.4 “Data Subject” means the person to whom Personal Information relates.

4.1.5 “GDPR” means the EU General Data Protection Regulation (Regulation (EU) 2016/679) and, where the context requires, the UK GDPR as incorporated into the law of the United Kingdom.

4.1.6 “Life File” means the structured information, records, uploaded documents, contacts and other content entered or stored by a Member.

4.1.7 “Member” means a person who has registered an Account.

4.1.8 “Operator” means a person or organisation that processes Personal Information for YourLifeFile under a contract or mandate without coming under the direct authority of YourLifeFile.

4.1.9 “Personal Information” has the meaning given to it under POPIA and includes information relating to an identifiable living person and, where applicable, an identifiable existing juristic person. Where the GDPR or UK GDPR applies, it also includes “personal data” as defined in those laws.

4.1.10 “Platform” means the YourLifeFile website, application, systems, database, services and related functionality.

4.1.11 “Processor” means, under the GDPR or UK GDPR, a person that processes Personal Information on behalf of the Controller (broadly equivalent to an Operator under POPIA).

4.1.12 “Processing” includes collecting, receiving, recording, organising, storing, updating, retrieving, using, sharing, restricting, archiving, deleting or otherwise handling Personal Information.

4.1.13 “Responsible Party” means the person or organisation that determines why and how Personal Information is processed.

4.1.14 “Special Personal Information” includes categories of sensitive information protected under POPIA, including certain health, biometric, religious, philosophical, political, trade-union and criminal-behaviour information, and corresponds to “special categories of personal data” under Article 9 of the GDPR and data relating to criminal convictions and offences under Article 10 of the GDPR.

4.1.15 “Supervisory Authority” means a data protection authority competent under the GDPR or UK GDPR, and includes, in South Africa, the Information Regulator.

4.1.16 “Trusted Person” means a person nominated by a Member who may be eligible to submit an Access Request in circumstances permitted by the Platform.

4.1.17 “Wallet” means the internal Platform record reflecting Referral Rewards, credits, debits, renewals, withdrawals and related transactions.

4.1.18 “YourLifeFile”, “we”, “us” or “our” means YourLifeFile (Pty) Ltd.

4.1.19 “you” or “your” means a visitor, Member, Data Subject, requestor or other person interacting with the Platform.

5. Personal Information We Collect

What we collect depends on how you use YourLifeFile and which features you use.

Registration and identity information: your name;
an ID, passport or similar identifier (and date of birth where needed);
contact details and address;
and account records such as registration date, login and verification history, password resets, security checks, and your acceptance of our legal documents..

Membership information: your Membership type and status (Trial, Annual or Free Lifetime);
start, renewal, suspension, reactivation, cancellation, archival and deletion-review dates;
payments;
and related communications..

5.3 Life File information: whatever you choose to record, which may include details of your Will, estate and funeral wishes:

the professionals and contacts involved (such as your executor or attorney);
insurance, medical aid and healthcare information;
banking, investments, retirement funds, assets and liabilities;
digital and online accounts;
the location of original documents;
personal messages;
and any other information you voluntarily add..

5.4 Uploaded documents: the documents you upload and related details such as name, description, format, size, upload date, category, version history and security-scan results.

Trusted Person information: their name and contact details;
their relationship to you;
the access permissions and priority you set;
nomination and removal dates;
and any verification, communication and Access Request records..

5.6 Access Request information: the requestor’s identity, contact details and claimed authority or relationship:

the reason for the request and any declarations;
supporting evidence (such as a death certificate, medical evidence, Letters of Executorship, court orders or affidavits);
and our verification, review, decision, access and audit records..

Referral and Wallet information: your Referral Code and referral relationships;
reward calculations;
Wallet credits, debits, balances, renewals and withdrawals;
supporting documents for withdrawals (such as bank and identity verification);
and payment, approval and fraud-prevention records..

Deceased-estate Wallet information: the deceased Member’s Wallet details;
death verification;
executor or estate-representative details and proof of authority;
estate banking and payment instructions;
and related review, payment and audit records..

5.9 Payment information: the payer’s name; transaction references, dates, amounts and status; payment-provider references and authorisation results; and refund, reversal, dispute and related correspondence. We do not ordinarily receive or store full payment-card numbers, card security codes or online-banking credentials.

5.10 Communication and support information: your emails, support messages, tickets, complaints, queries and feedback:

your communication preferences;
and delivery, interaction and notice records..

Technical and security information: your IP address, device, browser and operating system;
session and login activity (including failed attempts);
security alerts and audit logs;
usage, error and performance data;
cookie and browser-storage data;
file-security results;
and information needed to investigate suspected fraud or unauthorised access..

6. Special Personal Information

6.1 Your Life File may contain Special Personal Information (special categories of personal data), particularly health-related or medical information.

6.2 Where only POPIA applies, we will process Special Personal Information only where: you have voluntarily provided it for the purposes of your Life File:

you have expressly consented where consent is required;
processing is necessary to establish, exercise or defend a right or obligation in law;
processing is necessary for an Access Request or incapacity-related process;
processing is authorised or required by applicable law;
or another lawful justification under POPIA applies..

6.3 Where the GDPR or UK GDPR applies, we will process special categories of personal data only where one of the conditions in Article 9(2) is met, in particular where: you have given explicit consent; processing is necessary for the establishment, exercise or defence of legal claims; processing is necessary to protect your vital interests or those of another person where you are physically or legally incapable of giving consent; or another Article 9(2) condition applies. Personal data relating to criminal matters will be processed only as permitted under Article 10.

6.4 You should only record Special Personal Information that is relevant and reasonably necessary for the purpose of your Life File.

7. Personal Information of Children

7.1 The Platform is not intended to allow a child to register independently as a Member.

7.2 A Member’s Life File may nevertheless contain limited Personal Information relating to a child, such as information about a child who is a beneficiary:

a dependant covered by a policy;
a dependant registered on a medical scheme;
a child named in a Will or estate arrangement;
education-related protection or funding arrangements;
or another legitimate family or estate arrangement..

7.3 Where you enter Personal Information relating to a child, you confirm that: you are legally authorised to provide the information:

the information is relevant and reasonably necessary;
you are the child’s competent person or otherwise have lawful authority;
and the information is not being provided for an unlawful or improper purpose..

7.4 We may remove or restrict a child’s information where lawful authority cannot be established.

8. How We Collect Personal Information

8.1 We may collect Personal Information: directly from you (when you register, create or update your Life File, upload documents, nominate a Trusted Person, activate or renew a Membership, use the referral programme, request a Wallet withdrawal or submit an Access Request):

from others who lawfully provide it (such as a Trusted Person, executor, authorised representative or family member);
from service providers (such as payment, identity-verification and fraud-prevention providers);
from professional advisers or authorities where lawfully permitted;
automatically through your use of the Platform, including cookies and similar technologies;
and from public or official records where reasonably necessary and lawful..

8.2 Where we receive information from someone other than the Data Subject, we may take reasonable steps to verify the source, authority, accuracy and lawfulness of the information, and, where required by the GDPR or UK GDPR, we will provide the information required by Article 14 within the applicable time limits unless an exemption applies.

9. Why We Process Personal Information

9.1 We process Personal Information to: run your Account and the Platform (registration, verification, access, and creating and maintaining your Life File and documents); manage Memberships, payments, renewals, referrals and the Wallet; nominate and communicate with Trusted Persons and handle Access Requests, including verifying identity and authority and processing estate payments; send operational, security, legal and Membership communications, reminders and support; keep the Platform and Accounts secure and prevent and investigate fraud; maintain audit and access-control records and improve the Platform; enforce our Terms and Conditions and establish, exercise or defend legal rights; and comply with legal, regulatory and court requirements, or any other compatible lawful purpose.

10. Lawful Grounds for Processing

Under POPIA, YourLifeFile may process Personal Information because: you have consented to the processing;
the processing is necessary to perform a contract with you;
the processing is necessary to take steps at your request before entering into a contract;
the processing is required to comply with a legal obligation;
the processing protects your legitimate interests or those of another person;
the processing is necessary to pursue YourLifeFile’s legitimate interests or those of a third party, where your rights do not override those interests;
or another lawful ground recognised under POPIA applies..

10.2 Where the GDPR or UK GDPR applies, YourLifeFile relies on the following lawful bases under Article 6(1): (a) your consent; (b) performance of a contract with you, or steps taken at your request before entering into a contract (for example, registering your Account, providing the Platform and processing your Membership); (c) compliance with a legal obligation (for example, tax, accounting and regulatory obligations); (d) protection of the vital interests of you or another person (for example, in medical-emergency or incapacity situations); and (f) YourLifeFile’s or a third party’s legitimate interests, where these are not overridden by your interests or fundamental rights and freedoms (for example, securing the Platform, preventing fraud, administering Access Requests and improving the service).

10.3 Where we rely on legitimate interests under Article 6(1)(f), you may request further information about the relevant balancing assessment using the contact details in section 47.

10.4 Consent is not necessarily the only lawful basis on which YourLifeFile processes Personal Information. Where you withdraw consent, YourLifeFile may continue processing information where another lawful basis applies or where retention is required for legal, security, transactional or dispute-resolution purposes.

11. Whether Information Is Mandatory or Voluntary

11.1 Some Personal Information is mandatory because it is required to register and verify an Account:

provide the Platform service;
process payment;
protect Account security;
comply with legal requirements;
or verify an Access Request, Wallet withdrawal or estate payment..

11.2 Other information, particularly information entered into a Life File, is provided voluntarily.

11.3 If mandatory information is not provided, YourLifeFile may be unable to complete your registration:

activate or renew your Membership;
provide a requested service;
verify your identity;
approve an Access Request;
process a Wallet withdrawal;
make an estate payment;
or comply with your instruction..

12. Information We Do Not Require

YourLifeFile does not require you to provide passwords for external accounts;
online-banking usernames or passwords;
PIN numbers;
one-time passwords;
authentication codes;
security-question answers;
full payment-card security codes;
cryptocurrency private keys;
cryptocurrency wallet seed phrases;
or other credentials that can be used to access or transact on an external account..

12.2 You must not enter or upload this information. If you disregard this warning and provide prohibited credentials, you do so contrary to the Platform rules and materially increase the risk of unauthorised access or financial loss.

12.3 YourLifeFile may remove, restrict or quarantine information that appears to contain prohibited credentials.

13. Information About Other People

13.1 Your Life File may contain Personal Information about other people, such as a Trusted Person, beneficiary, family member, dependant, executor, attorney, financial adviser, insurance intermediary, healthcare provider, emergency contact or service provider.

13.2 Where you provide Personal Information relating to another person, you confirm that: you are authorised or otherwise legally entitled to provide it:

you have a lawful and legitimate reason for doing so;
you will provide only information relevant to your Life File;
the information is accurate to the best of your knowledge;
you will update or remove the information when it is no longer correct or necessary;
and, where required by law, you have informed the person that their information will be processed through YourLifeFile..

13.3 You remain responsible for ensuring that Personal Information you provide about another person is processed lawfully. Where the GDPR or UK GDPR applies to such information, you acknowledge that YourLifeFile processes it as Controller for the limited purposes described in this Privacy Policy.

14. Payment Processing

14.1 Online payments may be processed through iKhokha’s payment services or another payment provider approved by YourLifeFile.

14.2 The payment provider may process information required to initiate and complete a transaction:

authenticate the payer;
confirm payment status;
prevent fraud;
process reversals or refunds;
resolve payment disputes;
and maintain lawful transaction records..

14.3 YourLifeFile may receive transaction references, amounts, payment outcomes and other information required to activate or administer your Membership. YourLifeFile does not ordinarily store full payment-card details.

14.4 Your use of a payment provider may also be subject to that provider’s own terms and privacy policy.

15. Email Preferences and Communications

YourLifeFile may send registration and verification messages;
security alerts;
password-reset communications;
Membership activation and payment confirmations;
renewal and expiry reminders;
Life File completion reminders;
Life File review and update reminders;
Trusted Person notifications;
Access Request notifications;
Wallet and Referral Reward notifications;
estate-payment communications;
support responses;
legal notices;
service announcements;
and other operational communications..

15.2 You may be able to manage selected optional communication preferences through your Account.

15.3 Communications that are necessary for Account administration, security, legal compliance, Membership management, payment processing, Access Requests or Platform operation cannot always be disabled while your Account remains active.

15.4 YourLifeFile will not send direct marketing communications without a lawful basis and will provide an appropriate means of opting out where required. Where the GDPR or UK GDPR applies, direct marketing will be conducted only in accordance with the applicable consent and objection requirements, and you may object to direct marketing at any time.

16. Cookies and Similar Technologies

16.1 The Platform may use cookies, browser storage, session storage and similar technologies to enable essential Platform functionality:

keep you signed in during a valid session;
remember registration or workflow progress;
maintain security;
prevent fraudulent activity;
remember selected preferences;
measure Platform performance;
identify technical errors;
and understand how the Platform is used..

16.2 Some cookies may be necessary for the Platform to function correctly. Where non-essential cookies or similar technologies are used, YourLifeFile will provide appropriate information and, where required by applicable law (including the GDPR, UK GDPR and applicable e-privacy rules), obtain your consent.

16.3 You may be able to control cookies through your browser settings. Blocking essential cookies may prevent parts of the Platform from functioning properly. Further information may be provided in a separate Cookie Policy or cookie notice.

17. Automated Processing and Decision-Making

17.1 YourLifeFile may use automated rules to support routine Platform functions, including calculating Membership dates:

activating or suspending access following payment or expiry;
calculating Referral Rewards;
updating Wallet balances;
sending reminders;
identifying incomplete registration steps;
detecting suspicious login activity;
flagging potentially duplicated registrations;
and identifying Life Files that may be eligible for a retention review..

17.2 Material Access Request, estate-payment, fraud, Wallet-withdrawal and permanent-deletion decisions are intended to remain subject to appropriate human review and approval.

17.3 YourLifeFile does not intend to make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you, except where permitted under applicable law. Where Article 22 of the GDPR or UK GDPR applies, you have the right not to be subject to such a decision unless it is necessary for a contract, authorised by law, or based on your explicit consent, and in those cases you may request human intervention, express your point of view and contest the decision.

18. Sharing of Personal Information

18.1 YourLifeFile does not sell your Personal Information and does not disclose Personal Information to unrelated third parties for their own direct-marketing purposes.

18.2 We may share Personal Information with: our authorised staff and Administrators; service providers who support the Platform (such as hosting, backup, cybersecurity, payment, communication, and identity-verification and fraud-prevention providers); our professional advisers (such as attorneys, auditors and accountants); Trusted Persons, executors or authorised estate representatives following an approved Access Request; healthcare or legal professionals where appropriate and lawfully authorised; regulators, courts, law-enforcement agencies and public authorities; a successor or purchaser in a lawful business transfer; and anyone else where you consent or where disclosure is otherwise lawful.

18.3 Only information reasonably necessary for the applicable purpose should be disclosed. Where recipients act as Operators or Processors, they are subject to the safeguards described in section 20.

19. Access by YourLifeFile Personnel

19.1 Authorised personnel may access Personal Information where reasonably necessary for customer support:

identity verification;
Access Request administration;
Wallet or estate-payment verification;
security monitoring;
fraud investigation;
technical maintenance;
troubleshooting;
legal compliance;
audit;
data recovery;
or another legitimate operational purpose..

Access should be restricted according to the person’s role;
limited to what is reasonably required;
protected through authentication and access controls;
subject to confidentiality obligations;
and logged or auditable where appropriate..

19.3 Administrator access does not give personnel unrestricted authority to use Member information for personal or unrelated purposes.

20. Service Providers, Operators and Processors

20.1 YourLifeFile may appoint Operators (Processors) to process Personal Information on its behalf, including providers of cloud hosting:

database services;
document storage;
data backups;
cybersecurity;
software development;
technical maintenance;
email and messaging;
payment processing;
identity verification;
analytics;
support services;
and professional services..

20.2 Where required, Operators and Processors will be subject to written agreements requiring them to process Personal Information only for authorised purposes and on documented instructions; maintain appropriate confidentiality; implement reasonable and appropriate security safeguards; notify YourLifeFile of suspected security compromises without undue delay; assist with lawful data-subject requests where necessary; engage sub-processors only under equivalent obligations; and return or delete information when their services end, subject to legal retention requirements. Where the GDPR or UK GDPR applies, these agreements will contain the terms required by Article 28.

21. Trusted Person and Access Request Disclosures

21.1 Nominating a Trusted Person does not give that person immediate access to your Life File. Personal Information may only be disclosed through an Access Request after the applicable verification, review and approval procedures have been completed.

21.2 When considering an Access Request, YourLifeFile may verify the requestor’s identity, authority or relationship and the Member’s death, illness or incapacity:

contact the Member, other Trusted Persons, an executor, attorney or healthcare professional where appropriate;
request additional evidence;
limit the categories of information disclosed;
delay disclosure while a dispute or concern is investigated;
reject the request;
or refer the matter for legal review..

21.3 Access may be restricted to the information reasonably necessary for the circumstances. An approved Access Request does not automatically give the requestor authority to transact on accounts, amend policies, change legal documents, act as executor or exercise another legal power.

22. Disclosure Required by Law

22.1 YourLifeFile may disclose Personal Information where reasonably necessary to comply with a court order, subpoena or legal process:

comply with an obligation imposed by law;
respond to a lawful request from a regulator or public authority;
investigate suspected fraud, cybercrime or unlawful conduct;
protect the rights, property or safety of a Member or another person;
establish, exercise or defend a legal claim;
or enforce the YourLifeFile Terms and Conditions..

22.2 Where lawful and appropriate, YourLifeFile will consider the validity and scope of a request before disclosing information.

23. Cross-Border and International Transfers

23.1 YourLifeFile is operated from South Africa. Some Operators, cloud systems, support systems or backup facilities may be situated outside South Africa.

23.2 Where Personal Information is transferred outside South Africa, YourLifeFile will take reasonable steps to ensure that the transfer is permitted under section 72 of POPIA, including by considering whether the recipient is subject to a law, binding corporate rules or agreement providing adequate protection:

the transfer is necessary for the performance of a contract;
the transfer is necessary for pre-contractual measures requested by the Data Subject;
the transfer benefits the Data Subject and obtaining consent is not reasonably practicable;
the Data Subject has consented to the transfer;
or another lawful basis applies..

23.3 Where Personal Information protected by the GDPR or UK GDPR is transferred to a country outside the EEA or the United Kingdom that is not the subject of an adequacy decision, YourLifeFile will implement an appropriate transfer mechanism under Chapter V of the GDPR or the equivalent UK provisions, such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, or another lawful safeguard, together with any supplementary measures reasonably required. You may request a copy of, or information about, the relevant safeguard using the contact details in section 47.

23.4 YourLifeFile may implement contractual, organisational and technical safeguards for cross-border processing.

24. Users Outside South Africa

24.1 YourLifeFile’s legal processes and privacy framework are primarily designed for South African users and South African law. Other countries may have different requirements relating to privacy:

consumer protection;
identification;
estate administration;
medical information;
electronic documents;
access requests;
data retention;
and cross-border transfers..

24.2 If you use the Platform from another country, YourLifeFile may request additional information:

apply additional verification procedures;
delay an Access Request while foreign documentation is reviewed;
decline a request that cannot reasonably or lawfully be verified;
or restrict Platform functionality where necessary..

24.3 You are responsible for obtaining advice regarding laws applicable in your jurisdiction.

25. Security Safeguards

25.1 YourLifeFile will take reasonable and appropriate technical and organisational measures intended to protect Personal Information against loss:

damage;
unauthorised destruction;
unlawful access;
unauthorised alteration;
unauthorised disclosure;
misuse;
and other unlawful processing..

25.2 Safeguards may include access and authentication controls (such as role-based access, secure password handling and two-factor authentication where implemented):

encrypted communications and secure hosting and storage;
logging, audit trails and security monitoring;
data backups;
malware and file-security scanning;
software updates and vulnerability management;
incident-response procedures;
and confidentiality and access restrictions on staff and service providers..

25.3 No electronic system, database, communication channel or security process can be guaranteed to be completely secure.

26. Your Security Responsibilities

You are responsible for selecting a secure and unique password;
keeping your login details confidential;
protecting the email account linked to your Account;
protecting your devices from unauthorised access;
logging out of shared or public devices;
not sharing authentication codes;
not uploading external-account credentials;
reviewing security notifications promptly;
keeping your contact information current;
and notifying YourLifeFile promptly of suspected unauthorised access..

26.2 You should contact YourLifeFile immediately if you believe your Account has been compromised:

your password has been disclosed;
your email account has been compromised;
someone has accessed your Life File without authority;
a suspicious Access Request has been made;
or a Wallet transaction appears unauthorised..

27. Security Compromises and Personal Data Breaches

27.1 If YourLifeFile has reasonable grounds to believe that Personal Information has been accessed or acquired by an unauthorised person, YourLifeFile will investigate and take reasonable steps to contain and mitigate the incident.

27.2 Where required under POPIA, YourLifeFile will notify the Information Regulator and affected Data Subjects as soon as reasonably possible after establishing that a compromise has occurred.

27.3 Where the GDPR or UK GDPR applies, YourLifeFile will notify the competent Supervisory Authority of a personal data breach without undue delay and, where feasible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals, and will notify affected Data Subjects without undue delay where the breach is likely to result in a high risk to them.

A notification may include information about the nature of the compromise;
the information that may have been affected;
the possible consequences;
steps taken by YourLifeFile;
recommended protective measures;
and contact details for further information..

27.5 Notification may be delayed where permitted by law, including where a law-enforcement authority determines that immediate notification may impede an investigation.

28. Accuracy and Quality of Information

28.1 YourLifeFile relies substantially on information provided by Members and other authorised persons. You are responsible for ensuring that your information is accurate:

keeping your Life File current;
correcting inaccurate information;
removing outdated documents;
updating Trusted Person details;
reviewing your Life File regularly;
ensuring that uploaded documents are complete and readable;
and ensuring that information about other persons is lawfully provided..

YourLifeFile does not ordinarily verify whether a policy remains active;
a document is legally valid;
a Will has been properly signed;
a beneficiary nomination remains valid;
an account remains open;
a professional remains appointed;
an uploaded document is the most recent version;
or the information is sufficient for a particular legal, medical, financial or estate purpose..

29. Data Minimisation

29.1 You should record only Personal Information that is reasonably relevant to the purpose of your Life File. You should avoid uploading entire documents where only a reference is necessary:

unrelated information about third parties;
obsolete information;
duplicate documents;
credentials or security codes;
excessive medical information;
or information that could create unnecessary privacy or security risks..

29.2 YourLifeFile may introduce tools, prompts or limits intended to encourage appropriate and proportionate information storage.

30. Data Retention

30.1 YourLifeFile retains Personal Information only for as long as reasonably necessary for the purpose for which it was collected, or as required or permitted by law.

The applicable retention period may depend on the status of the Membership;
the nature of the information;
the purpose of processing;
legal and regulatory requirements;
payment and transaction requirements;
fraud and security risks;
pending disputes;
Access Requests;
estate-administration processes;
Wallet balances or payments;
legal claims;
and the Data Subject’s lawful instructions..

31. Membership and Life File Retention Lifecycle

A Life File may move through the following lifecycle: Active (the Member has an active Membership and may use the Platform);
Suspended (Platform access has been restricted, including after trial expiry, Membership expiry, non-payment, a security concern or a breach);
Archived (the Life File is retained securely but is not ordinarily accessible through the suspended Account);
Eligible for Deletion (the applicable retention period has ended and the Life File may be considered for permanent deletion);
and Permanently Deleted (deletion has been approved and implemented, subject to limited lawful records and normal backup cycles)..

31.2 Where a Membership expires, is suspended or is terminated, the associated Life File may be archived and retained for up to five years from the applicable suspension, expiry, termination or archive date. The five-year period is a maximum internal retention period and does not mean that every category of information will necessarily be retained for exactly five years.

31.3 Information may be retained for a shorter or longer period where the Data Subject lawfully requests deletion:

retention is required by law;
a payment or Wallet record must be retained;
a dispute or legal claim exists;
fraud or unlawful conduct is being investigated;
an Access Request remains unresolved;
an estate-payment process remains incomplete;
a court or regulator requires preservation;
or another lawful retention reason applies..

32. Retention Following the Death of a Member

32.1 Where an Access Request based on the death of a Member is approved, the Membership may be suspended:

the Life File may be archived;
approved access may be granted;
the deceased Member’s Wallet may enter the estate-payment process;
relevant verification and audit records may be retained;
and the five-year retention lifecycle may begin from the applicable deceased or archive date..

32.2 Before permanent deletion is considered, YourLifeFile may require completion of the approved Access Request:

completion of any estate Wallet payment;
confirmation that the Wallet balance is zero;
resolution of any dispute or legal hold;
expiry of the retention period;
and Administrator approval..

32.3 Note: the GDPR and UK GDPR generally do not apply to the personal data of deceased persons, but may continue to apply to information about living third parties (such as beneficiaries or Trusted Persons) contained in a deceased Member’s Life File.

33. Reactivation and Creation of a New Life File

33.1 Where permitted under the Terms and Conditions, a Member whose Account has been suspended may elect to pay the applicable outstanding Membership Fees and restore the existing Life File; or register a new Account and create a new Life File from the beginning.

33.2 Where a person chooses to register a new Account instead of restoring the previous Account, the previous Life File will not automatically transfer to the new Account:

the person may be required to confirm an instruction to delete the previous Life File;
identity verification may be required;
the previous Life File may be scheduled for deletion following internal approval;
and the deletion may be irreversible once completed..

34. Permanent Deletion

34.1 Deletion is not necessarily automatic immediately after a retention period ends. Before permanent deletion, the Life File must be identified as eligible for deletion:

legal, security, audit, estate, Wallet and Access Request holds must be considered;
the appropriate Administrator must approve the deletion;
and the deletion process must be completed..

After permanent deletion, the Life File cannot ordinarily be restored;
documents and information may be permanently lost;
associated data may be deleted, anonymised or de-identified;
and limited records may remain where required for legal, transactional, audit, security or dispute-resolution purposes..

34.3 Deletion from active systems may not immediately remove information from every encrypted backup. Backup copies may remain securely restricted until overwritten or deleted through normal backup-retention cycles.

35. Anonymised and De-Identified Information

35.1 YourLifeFile may create aggregated, statistical, anonymised or de-identified information for purposes including Platform improvement:

system performance analysis;
security monitoring;
usage reporting;
business planning;
and research into general Platform functionality..

35.2 Where information has been properly de-identified or anonymised so that it cannot reasonably be linked to a Data Subject, it may no longer constitute Personal Information under POPIA or personal data under the GDPR or UK GDPR.

35.3 YourLifeFile will not intentionally re-identify properly de-identified information except where permitted by law or necessary to test whether de-identification measures remain effective.

36. Your Rights

36.1 Subject to POPIA and other applicable law, you may have the right to: be told when we collect your Personal Information and confirm whether we hold it:

access it;
have it corrected or, where legally permitted, deleted;
object to processing (including direct marketing) and withdraw consent;
ask who has had access to it and the reasons for certain automated decisions, where applicable;
and complain to us or to the Information Regulator, or bring civil proceedings where the law allows..

36.2 Where the GDPR or UK GDPR applies, you additionally have, subject to the conditions and exemptions in those laws, the right of access (Article 15); the right to rectification (Article 16); the right to erasure or the “right to be forgotten” (Article 17); the right to restriction of processing (Article 18); the right to data portability, allowing you to receive certain data in a structured, commonly used and machine-readable format and to have it transmitted to another controller where technically feasible (Article 20); the right to object to processing based on legitimate interests or to direct marketing (Article 21); rights in relation to automated decision-making and profiling (Article 22); the right to withdraw consent at any time without affecting prior processing; and the right to lodge a complaint with a Supervisory Authority.

36.3 We will respond to a GDPR or UK GDPR rights request without undue delay and in any event within one month of receipt, which may be extended by up to two further months where necessary taking into account the complexity and number of requests, in which case we will inform you of the extension. Requests are ordinarily free of charge, although a reasonable fee may be charged, or a request refused, where it is manifestly unfounded or excessive.

36.4 All of these rights may be subject to lawful limitations, including the protection of another person’s rights, legal privilege, confidentiality, security, fraud prevention, legal retention obligations and the establishment or defence of legal claims.

37. Requests for Access

37.1 You may ask us to confirm whether we hold your Personal Information and to give you access to it. We may first ask you to verify your identity (or your authority to act for someone else) and to give us enough detail to locate the information, including by completing a request form.

37.2 A reasonable fee may be charged where permitted by law, particularly where copies or extensive records are requested. Access may be refused or limited where permitted under POPIA, the Promotion of Access to Information Act, the GDPR, the UK GDPR or another applicable law.

38. Correction, Erasure and Restriction Requests

38.1 You may request correction or deletion of Personal Information that is inaccurate; irrelevant; excessive; out of date; incomplete; misleading; obtained unlawfully; or no longer authorised to be retained. Where the GDPR or UK GDPR applies, you may also request restriction of processing in the circumstances set out in Article 18.

38.2 YourLifeFile may require identity verification before making a change. A deletion, erasure or restriction request may be declined or delayed where retention or continued processing is reasonably necessary for compliance with law:

proof of payment or Membership transactions;
security and fraud prevention;
pending Access Requests;
estate administration;
Wallet reconciliation;
legal claims;
dispute resolution;
audit requirements;
or another lawful purpose or exemption..

39. Objection to Processing

39.1 You may object to certain processing of your Personal Information where POPIA, the GDPR or the UK GDPR permits an objection, including processing based on legitimate interests and processing for direct marketing.

Your objection should identify the Personal Information concerned;
describe the processing to which you object;
state the grounds for your objection;
and include sufficient information to verify your identity..

39.3 YourLifeFile will assess the objection and may continue processing where there are compelling legitimate grounds that override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims. Where the objected-to processing is necessary to provide the Platform, YourLifeFile may be unable to continue providing the relevant service.

40. Withdrawal of Consent

40.1 Where processing is based on your consent, you may withdraw that consent at any time by contacting YourLifeFile or using an available Platform function.

Withdrawal of consent does not invalidate processing that occurred before withdrawal;
does not require deletion where another lawful retention basis applies;
may prevent YourLifeFile from providing some or all of the Platform services;
and may result in suspension or closure of your Account where the information is necessary to provide the service..

41. Identity Verification for Privacy Requests

41.1 To protect your Personal Information from unauthorised disclosure, we may ask you to verify your identity before we act on a privacy request - for example, through proof of identity, the email address linked to your Account, in-Account verification, proof of authority where someone acts for you, or a declaration or affidavit.

41.2 YourLifeFile may refuse to disclose information where the requestor’s identity or authority cannot be verified.

42. Complaints to YourLifeFile

42.1 You may submit a privacy complaint to YourLifeFile using the contact details below. Please include your full name:

the email address linked to your Account, where applicable;
a description of the issue;
relevant dates;
supporting information or documents;
and the outcome you are requesting..

42.2 Information Officer: Christo Odendaal

42.3 Email: christo@yourlifefile.co.za

42.4 General email: info@yourlifefile.co.za

42.5 Physical address: 10 Lantana Street, West Acres, Mbombela, Mpumalanga, South Africa, 1201

42.6 YourLifeFile may require identity verification before discussing Personal Information or Account-specific matters.

43. Complaints to a Supervisory Authority

43.1 You have the right to submit a complaint to the Information Regulator if you believe that your Personal Information has been processed in a manner that violates POPIA.

43.2 Information Regulator South Africa

43.3 Website: https://inforegulator.org.za/

43.4 POPIA complaints email: POPIAComplaints@inforegulator.org.za

43.5 General enquiries email: enquiries@inforegulator.org.za

43.6 Telephone: 010 023 5200

43.7 Toll-free number: 0800 017 160

43.8 Physical address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg

43.9 Where the GDPR or UK GDPR applies to you, you also have the right to lodge a complaint with a Supervisory Authority in the EU Member State or the United Kingdom of your habitual residence, place of work or the place of the alleged infringement. In the United Kingdom, the relevant authority is the Information Commissioner’s Office (ICO), https://ico.org.uk/. You should verify the current contact details of any authority on its official website before submitting a complaint.

44. Links to Third-Party Services

44.1 The Platform may contain links to or integrate with third-party services, including payment providers:

cloud-storage providers;
video or audio hosting providers;
email providers;
professional service providers;
financial institutions;
insurers;
medical schemes;
and other external websites or services..

44.2 YourLifeFile does not control how independent third parties process Personal Information. You should review the privacy policies and terms of third-party services before providing information to them.

45. Changes to This Privacy Policy

45.1 YourLifeFile may update this Privacy Policy from time to time to reflect changes to POPIA, the GDPR, the UK GDPR or other laws:

guidance issued by the Information Regulator or another Supervisory Authority;
changes to Platform functionality;
changes to service providers;
security improvements;
changes to Membership, Wallet or Access Request processes;
or other legitimate operational requirements..

45.2 The latest version will be published on the Platform and will display an updated effective date. Where a change is material, YourLifeFile may notify you by email:

display a notice through the Platform;
require you to review the updated policy;
or request renewed consent or acknowledgement where required..

45.3 Your continued use of the Platform after an updated policy becomes effective will be dealt with in accordance with applicable law and the YourLifeFile Terms and Conditions.

46. Relationship With Other Legal Documents

This Privacy Policy must be read together with the YourLifeFile Terms and Conditions;
POPIA Notice / POPIA Consent;
Disclaimer;
Access Request Declaration;
Cookie Policy or cookie notice, where applicable;
and other legal notices displayed through the Platform..

46.2 This Privacy Policy explains how Personal Information is processed. The POPIA Notice / POPIA Consent records the Member’s acknowledgement and consent where consent is relied upon. The Terms and Conditions govern the contractual use of the Platform.

47. Contact Details

47.1 Questions about this Privacy Policy or the processing of Personal Information may be directed to:

47.2 YourLifeFile (Pty) Ltd

47.3 Registration number: 2026/072254/07

47.4 Information Officer: Christo Odendaal

47.5 Information Officer email: christo@yourlifefile.co.za

47.6 General email: info@yourlifefile.co.za

47.7 Physical address: 10 Lantana Street, West Acres, Mbombela, Mpumalanga, South Africa, 1201

47.8 Website: www.yourlifefile.co.za

47.9 EU / UK Representative (Article 27): to be appointed where required; current details will be published on the Platform.

47.10 You may also contact YourLifeFile through the support or contact function available in your dashboard.