Back to Encircle
Legal

Privacy Policy

Effective date: 1 June 2026 · Last updated: 9 June 2026

Who we are

MRM Tech (Pty) Ltd (“Encircle”, “we”, “us”) is a responsible party as defined in the Protection of Personal Information Act 4 of 2013 (POPIA). We operate the Encircle governance intelligence platform.

Our Information Officer is responsible for ensuring POPIA compliance. Contact details are at the end of this policy.

What personal information we collect

We collect and process the following categories of personal information:

  • Account information: name, email address, job title, and organisation name when you register.
  • Usage data: how you interact with the Platform, pages visited, features used, assessment answers.
  • Communication records: emails and messages you send to us.
  • Payment information: billing contact details. Card payments are processed by our payment provider and we do not store card numbers.
  • Technical data: IP address, browser type, device identifiers, and access logs.

Why we process your information

We process your personal information for the following purposes:

  • Providing and improving the Platform (performance of contract).
  • Creating and managing your account.
  • Generating governance scores, assessments, and remediation tasks.
  • Communicating with you about your account, updates, and support.
  • Billing and subscription management.
  • Improving our AI features and framework mappings (using aggregated, de-identified data).
  • Complying with our legal obligations.
  • Detecting and preventing fraud and security incidents.

Legal basis for processing (POPIA conditions)

We process personal information on one or more of the following grounds:

  • Contract: processing is necessary to deliver the Platform services you have subscribed to.
  • Legitimate interest: improving platform security and functionality.
  • Legal obligation: to comply with applicable South African law.
  • Consent: for marketing communications (you can withdraw consent at any time).

How we share your information

We do not sell your personal information. We share it only in the following circumstances:

  • Service providers: cloud hosting, analytics, email delivery, and payment processing providers who process data on our behalf under written operator agreements.
  • Professional advisors: auditors and legal counsel under confidentiality obligations.
  • Encircle Network partners: only if you explicitly request an introduction to an auditor or advisor through the Platform.
  • Legal requirements: if required by law, court order, or regulatory authority.
  • Business transfers: in the event of a merger, acquisition, or sale of assets, subject to the acquiring party maintaining equivalent privacy protections.

International transfers

Some of our service providers are located outside South Africa. Where personal information is transferred to a third country, we ensure that adequate safeguards are in place as required by POPIA §72, including contractual protections equivalent to those required under POPIA.

How long we keep your information

We retain your personal information for as long as your account is active and for a reasonable period thereafter to comply with our legal obligations, resolve disputes, and enforce our agreements. On account closure, we will retain data for a maximum of 3 years unless a longer period is required by law.

Security

We implement appropriate technical and organisational security measures to protect your personal information against unauthorised access, loss, or destruction. See our Security page for details.

Your rights

Under POPIA, you have the right to:

  • Request access to the personal information we hold about you (POPIA §23).
  • Request correction of inaccurate or incomplete information (POPIA §24).
  • Request deletion of your personal information in certain circumstances.
  • Object to processing based on legitimate interest.
  • Withdraw consent for marketing communications at any time.
  • Lodge a complaint with the Information Regulator of South Africa.

To exercise any of these rights, email our Information Officer at privacy@encircle.co.za. We will respond within 30 days.

Cookies

We use essential cookies required for the Platform to function, and analytics cookies to understand how the Platform is used. On this website, analytics cookies are set only if you accept them when asked, and declining sets no analytics cookie at all. You can also control non-essential cookies through your browser settings. Disabling certain cookies may affect Platform functionality.

Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or in-Platform notification. The effective date at the top of this page shows when the policy was last updated.

Contact our Information Officer

Information Officer
MRM Tech (Pty) Ltd
Email: privacy@encircle.co.za
General: anton@encircle.co.za

Information Regulator of South Africa: justice.gov.za/inforeg

Book a demo

Tell us about your organisation.

Tell us a little about your organisation and we’ll walk you through Encircle against the frameworks that actually apply to you.

Early sign-on offer
Early access clients get preferential launch pricing and priority onboarding. Applies to all requests submitted before platform launch.

Encircle Network

Are you a specialist in your industry?

Join the Encircle Network and help businesses get governance-ready. We connect consultants, auditors and legal advisors with organisations working through their Encircle score. Tell us about your practice and we’ll be in touch about becoming an Encircle partner.

About you

Your practice