FIFO Law
Privacy Policy
Effective: 20 February 2026
1. Introduction
This Privacy Policy explains how FIFO Solutions (Pty) Ltd ("FIFO", "we", "us") collects, uses, and protects personal information in connection with the FIFO Law service ("the Service").
FIFO is committed to protecting the privacy of our Subscribers and their clients in accordance with the Protection of Personal Information Act, 2013 (POPIA) and other applicable South African legislation.
2. Responsible Party
The responsible party for purposes of POPIA is:
FIFO Solutions (Pty) Ltd
Registration No. 2026/071559/07
25 Bethel Gardens, 22 Church St, Durbanville, Western Cape, 7550
Information Officer: Riaan Potas
Email: riaan@fifo.systems
Phone: 082 525 4011
3. What Information We Collect
3.1 Subscriber Information (Law Firms)
When a firm subscribes to FIFO Law, we collect and store:
| Information | Purpose |
|---|---|
| Firm name | Display on the branded portal |
| Firm logo | Branding of the portal and PDF quotes |
| Contact person name | Subscription management and support |
| Email address | Invoicing, support, and service notifications |
| Phone / WhatsApp number | Support and WhatsApp integration |
| Subdomain preference | Portal URL configuration |
| Subscription tier and payment status | Service delivery and billing |
3.2 End-User Information (Firm's Clients)
We do not collect, store, or retain any end-user data.
The FIFO Law calculator is a "compute-and-forget" tool. When an end-user enters data (e.g., a property purchase price), the calculation is performed in the user's browser in real time. The inputs and results are:
- Not transmitted to FIFO's servers for storage;
- Not saved to any database;
- Not accessible to FIFO or any third party;
- Lost when the user closes or refreshes the page.
PDF quotes are generated in the browser and are not stored by FIFO.
3.3 Document Storage (Plus Tier Only)
Subscribers on the Plus tier may upload and host client-facing documents (e.g., blank FICA checklists, fee guides, practice resources) through their branded portal ("Uploaded Content").
How document storage works:
- Documents are stored in Google Firebase Cloud Storage;
- Documents are accessible via the Subscriber's branded portal URL;
- FIFO does not access, review, analyse, or share the contents of uploaded documents;
- FIFO acts solely as a hosting platform for Uploaded Content and is not the responsible party (as defined in POPIA) for any personal information that may be contained in documents uploaded by the Subscriber.
Subscriber obligations:
- Uploaded documents must consist of blank templates and general informational resources only;
- Documents must not contain the personal information of identifiable natural persons (e.g., completed FICA forms, client identification documents, identity numbers, or financial details);
- If the Subscriber uploads content containing personal information in breach of this restriction, the Subscriber is the responsible party under POPIA for that personal information and bears sole responsibility for lawful processing, obtaining consent, breach notification, and all other obligations under the Act;
- Full terms governing Uploaded Content — including acceptable use, warranties, indemnification, and FIFO's right to remove content — are set out in clause 12 of the Terms of Service.
Deletion: All uploaded documents are permanently deleted within 30 (thirty) days of subscription termination. The Subscriber must maintain their own independent copies.
3.4 Automatically Collected Information
The Service is hosted on Google Firebase (Google Cloud Platform). Standard web hosting logs may record IP addresses, browser type, pages accessed, and timestamps. This data is collected by Google in accordance with Google's Privacy Policy and is used solely for service delivery and security monitoring. FIFO does not access or analyse this data to identify individual end-users.
4. How We Use Information
| Purpose | Legal Basis (POPIA) |
|---|---|
| Delivering and operating the Service | Performance of a contract (Section 11(1)(b)) |
| Invoicing and payment processing | Performance of a contract |
| Technical support | Performance of a contract |
| Service notifications (rate table updates, maintenance) | Legitimate interest (Section 11(1)(f)) |
| Compliance with legal obligations | Legal obligation (Section 11(1)(c)) |
We do not use Subscriber information for marketing purposes without explicit consent. We do not sell, rent, or share Subscriber information with third parties for their marketing purposes.
5. Who We Share Information With
| Recipient | Purpose | Safeguards |
|---|---|---|
| Google (Firebase) | Hosting the Service | Google Cloud data processing terms |
| Brevo (email) | Sending invoices and service notifications | Brevo GDPR/privacy compliance; SMTP relay only |
| Payment processor (when applicable) | Processing subscription payments | PCI-DSS compliance |
We do not share any information with data brokers, advertisers, or other commercial third parties.
6. Where Information Is Stored
Subscriber configuration data is stored in Google Firebase (Firestore), hosted on Google Cloud Platform infrastructure. All data transmission between users and the Service is encrypted using HTTPS (TLS 1.2+).
6.1 Cross-Border Transfers
Google Cloud Platform infrastructure may store or process personal information in data centres located outside the Republic of South Africa. In accordance with POPIA Section 72, such transfers are permitted on the basis that Google has committed to data processing terms and standard contractual clauses that provide a level of protection substantially similar to that provided under POPIA. Details of Google's data processing commitments are available in the Google Cloud Data Processing Addendum.
7. How Long We Keep Information
| Data | Retention Period |
|---|---|
| Subscriber configuration (firm name, logo, etc.) | Duration of subscription + 30 days |
| Invoices and payment records | 5 years (SA tax legislation) |
| Support correspondence | 2 years from resolution |
| Uploaded Content (Plus tier) | Duration of subscription + 30 days |
| End-user calculator inputs | Not retained (compute-and-forget) |
After the retention period, data is permanently deleted.
8. Your Rights Under POPIA
As a data subject, you have the right to:
- Access — Request confirmation of what personal information we hold;
- Correction — Request correction of inaccurate information;
- Deletion — Request deletion, subject to legal retention requirements;
- Object — Object to processing on reasonable grounds;
- Withdraw consent — Where processing is based on consent;
- Lodge a complaint — With the Information Regulator.
Contact our Information Officer at riaan@fifo.systems. We will respond within 30 days.
Information Regulator (South Africa)
Website: inforegulator.org.za
Email: complaints.IR@justice.gov.za
9. Security
- HTTPS encryption on all web traffic;
- Firebase Authentication for administrative access;
- Firestore security rules restricting data access;
- No storage of end-user data (eliminates the primary risk vector);
- Regular review of access controls.
No system is 100% secure. In the event of a data breach, we will notify affected Subscribers and the Information Regulator in accordance with POPIA Section 22.
10. Cookies
The portal may use essential cookies for basic functionality (e.g., theme preference). We do not use tracking cookies, advertising cookies, or analytics cookies that identify individual users.
11. Children's Information
The Service is intended for use by law firms and their adult clients. We do not knowingly collect personal information from children under 18.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Subscribers will be notified of material changes by email at least 30 (thirty) days before the changes take effect. The "Last Updated" date indicates when it was last revised.
13. Contact
FIFO Solutions (Pty) Ltd
Information Officer: Riaan Potas
Email: riaan@fifo.systems
WhatsApp: 082 525 4011
Address: 25 Bethel Gardens, 22 Church St, Durbanville, Western Cape, 7550