Privacy Notice

Processing notice issued in terms of section 18 of the Protection of Personal Information Act 4 of 2013 (POPIA)
Version 1.0 · Effective 18 August 2026 · Next review 18 August 2027

1. Who we are

Focus Legal is an industrial relations and human resources consultancy operating from Kempton Park, Gauteng. For the purposes of POPIA, the responsible party is:

Responsible party	Focus Legal (Pty) Ltd
Registration number	2017/350119/07
Physical address	90 Van Riebeeck Road, Kempton Park Ext 4, Kempton Park, 1619, South Africa
Information Officer	Monique Coetzee, Director. Registered as Information Officer with the Information Regulator.
E-mail	legal@focuslegal.co.za
Telephone	+27 69 119 6978

2. What this notice covers

This notice applies to Focus Legal (Pty) Ltd and to both of the websites it operates — focuslegal.co.za and disciplinary.co.za (Disciplinary Guide). It explains how we handle personal information when you:

• contact us through this website, by WhatsApp, by e-mail or by telephone;
• engage us as a client, or work for a client that has engaged us;
• are an employee, former employee or applicant of a client, and your information reaches us in the course of a matter;
• download or purchase a template or guide from Disciplinary Guide;
• are a supplier, service provider or business contact.

In some engagements we act as a responsible party in our own right (for example, our client records and our own staff). In others we act as an operator processing personal information on the written instruction of a client — for example, when we run a disciplinary process or a section 189 consultation on a client's behalf. Where we act as an operator, the client's own privacy notice governs the processing and we process only as instructed, in terms of section 20 and 21 of POPIA and the operator agreement between us.

3. Personal information we collect

Category	Typical information
Enquiry information	Name, company name, approximate number of employees, subject of the enquiry, contact number, e-mail address and whatever you choose to tell us in your message.
Client and contact records	Name, position, business contact details, company registration and bargaining council details, billing information.
Employee information (matter files)	Name, identity or employee number, job title, employment history, remuneration, contracts, warnings, disciplinary records, grievance records, attendance and leave records, performance records, incident statements and evidence.
Dispute records	CCMA and bargaining council referrals, case numbers, rulings, awards, settlement agreements, correspondence.
Correspondence	E-mails, WhatsApp messages, letters, file notes and call notes.
Website technical data	Standard web server logs kept by our hosting provider (IP address, date and time, page requested, browser type). See section 11.

4. Why we process it, and on what lawful basis

Purpose	Justification under section 11 of POPIA
Responding to your enquiry and quoting for work	Steps taken at your request before concluding a contract; your consent where you voluntarily send us information
Rendering the consulting services agreed with a client	Necessary for the performance of a contract
Preparing for and conducting disciplinary enquiries, grievances, incapacity and retrenchment processes	Necessary to pursue the legitimate interests of the client as employer, and to comply with obligations imposed by the LRA and BCEA
Representing an employer at the CCMA or a bargaining council	Necessary for the establishment, exercise or defence of a right or obligation in law
Instructing attorneys where a matter proceeds to the Labour Court	Necessary for the establishment, exercise or defence of a right or obligation in law
Invoicing, accounting and tax records	Compliance with an obligation imposed by law
Keeping our own records of advice given, for our protection	Our legitimate interests

5. Special personal information

Industrial relations work frequently involves special personal information as defined in section 26 of POPIA — in particular information concerning a person's health (incapacity and medical certificates), trade union membership, race or ethnic origin (employment equity reporting), and criminal behaviour (alleged misconduct such as theft, fraud or assault).

We process this information in reliance on section 27 of POPIA, and specifically on the authorisations that permit processing where it is necessary for the establishment, exercise or defence of a right or obligation in law, and where processing is necessary to comply with an obligation of employment law. Where none of those authorisations apply, we obtain consent.

We ask you not to send us health records, identity numbers or details of alleged misconduct in a first enquiry message. Send us the outline; we will tell you what we actually need.

6. Where the information comes from

Most personal information comes directly from you, or from the client who engaged us. In the course of a matter we may also receive information from a client's managers and witnesses, the CCMA or a bargaining council, a trade union, an employee's representative, medical practitioners (where a certificate is submitted), attorneys instructed on a matter, and publicly available sources such as the CIPC register.

7. Who we share it with

We do not sell personal information and we do not share it for marketing purposes. We share it only where it is necessary to do the work, or where the law requires it:

• the client that engaged us, and the managers within that client who are dealing with the matter;
• the CCMA, bargaining councils, and the Department of Employment and Labour;
• the chairperson of a disciplinary enquiry, where an independent chairperson is appointed;
• attorneys and counsel instructed on a matter, including Labour Court proceedings;
• the opposing party and their representative, where the rules of a forum require disclosure of a bundle;
• our IT, e-mail and website hosting providers, and our accountants and auditors, under confidentiality obligations;
• any person to whom we are required by law, a court order or a regulator to disclose the information.

8. Transfers outside South Africa

We operate from South Africa and our work is done here. Our websites and our e-mail are hosted by Afrihost on infrastructure located in the Republic of South Africa. Records held in our e-mail and on our web servers therefore do not leave the Republic.

Two flows do cross the border, and we identify them so that you can choose to avoid them:

• WhatsApp. WhatsApp is operated by Meta Platforms and messages you send us there are processed on infrastructure outside the Republic. If you would prefer your information to stay in South Africa, telephone or e-mail us instead.
• Card payments made on disciplinary.co.za are processed by Yoco Technologies (Pty) Ltd, a South African company, whose payment infrastructure and card scheme partners may process transaction data outside the Republic. We never receive or store card details.

Where personal information is transferred outside the Republic we do so only on a basis permitted by section 72 of POPIA — in practice, because the recipient is subject to a law or binding agreement that provides an adequate level of protection, because the transfer is necessary to perform a contract with the data subject, or because the data subject has consented.

WhatsApp is operated by a third party and is not controlled by us. Messages you send us on WhatsApp are handled in terms of WhatsApp's own terms and privacy policy. If you would prefer not to use WhatsApp, e-mail or telephone us instead.

9. How long we keep it

Record	Retention
Unsuccessful enquiries	12 months from last contact, then deleted
Client matter files (contracts, policies, disciplinary and dispute records)	5 years from the conclusion of the matter, or longer where a dispute, review or prescription period is still running
Records an employer is obliged to keep under the BCEA	3 years from the date of the last entry, in terms of section 31 of the Basic Conditions of Employment Act. Where a bargaining council collective agreement, a sectoral determination or a written client instruction requires a longer period, that longer period applies.
Invoices, accounting and tax records	5 years, in terms of the Companies Act and the Tax Administration Act
Records held as an operator on behalf of a client	As instructed by the client; returned or destroyed on termination of the engagement

We delete or de-identify personal information once the retention period ends, unless we are required or entitled by law to keep it for longer.

10. How we keep it safe

In terms of section 19 of POPIA we take appropriate, reasonable technical and organisational measures to secure the integrity and confidentiality of personal information. These include access-controlled devices and accounts, password protection and multi-factor authentication where available, encrypted transmission of this website, locked physical storage for hard-copy files, confidentiality undertakings from anyone who works on our files, and restricting access to matter files to the people who need them.

If there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and the affected data subjects as required by section 22 of POPIA.

11. Our websites

This website is deliberately simple, and that is a privacy decision:

• It sets no cookies. There is no analytics, no advertising pixel and no tracking of any kind.
• It loads nothing from third parties. No external fonts, no content delivery networks, no embedded maps or social widgets. Every file the page loads comes from focuslegal.co.za.
• The enquiry form does not submit anything. It runs entirely in your browser and simply assembles a message. When you press the button, your own WhatsApp or e-mail program opens with that message already typed. Nothing is stored on this website and nothing is sent anywhere until you choose to send it.
• Links to other websites (the CCMA, the Department of Employment and Labour, the Information Regulator, LinkedIn, Google Maps) leave this site. We are not responsible for how those sites handle your information.

Afrihost keeps standard web server access logs, which include your IP address, for security and diagnostic purposes. The retention period for those logs is determined by the hosting provider and not by us, and we do not access them except to investigate a security incident.

disciplinary.co.za (Disciplinary Guide) is operated by the same company and sells document templates. It is built on the same principles as this site: it sets no cookies, runs no analytics and loads nothing from a third party. The documents a buyer builds there are generated in the buyer’s own browser and their contents are never transmitted to us. We receive only the order information the payment provider passes back — name, e-mail address, amount and order reference. Card details are entered on Yoco’s systems and are never seen or stored by us. That site has its own Privacy Notice.

12. Your rights

Subject to POPIA and to the Promotion of Access to Information Act 2 of 2000 (PAIA), you have the right to:

• be told whether we hold personal information about you, and to request access to it (sections 23 and 24 of POPIA, read with PAIA — see our PAIA Manual);
• request correction, destruction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully (section 24);
• object, on reasonable grounds, to processing that relies on legitimate interests (section 11(3));
• withdraw consent where processing was based on consent, without affecting processing already carried out;
• not be subject to a decision based solely on automated processing (section 71) — we do not make automated decisions;
• lodge a complaint with the Information Regulator (section 74).

To exercise a right, e-mail legal@focuslegal.co.za. Requests to access, correct or delete must be made on the prescribed forms — Form 2 for a request for access, and Form 3 for a request to correct or delete — which are available from the Information Regulator's website. We will respond within the period prescribed by PAIA. We may ask you to verify your identity before we act, and we may refuse a request on a ground permitted by PAIA or POPIA, in which case we will tell you why.

Where the information you are asking about belongs to a matter file we hold as an operator for a client employer, we will refer your request to that client, who is the responsible party.

13. Complaints

Please raise a complaint with us first — e-mail legal@focuslegal.co.za and we will respond in writing. You are also entitled to complain directly to:

The Information Regulator (South Africa)	JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 P.O. Box 31533, Braamfontein, Johannesburg, 2017 POPIA complaints: POPIAComplaints@inforegulator.org.za PAIA complaints: PAIAComplaints@inforegulator.org.za General enquiries: enquiries@inforegulator.org.za inforegulator.org.za

14. Changes to this notice

We review this notice at least annually and whenever our processing changes. The current version is always published at focuslegal.co.za/privacy.html. Material changes will be brought to the attention of existing clients in writing.