Privacy Policy (POPIA)

Last updated: 18 September 2026

1. Who we are

This website, chalaw.co.za, is operated by Cornell Horn Attorneys, trading as CHA Law (“CHA Law”, “we”, “us”), attorneys, notaries and conveyancers practising from Tyger Valley Health Centre, 43 Old Oak Road, Bellville, Cape Town, 7530.

For the purposes of POPIA, CHA Law is the responsible party for the personal information described in this policy.

Information Officer: Cornell Horn, Director
Email: reception@chalaw.co.za (please use the subject line “POPIA request”)
Telephone: 021 891 0505
Post / delivery: Tyger Valley Health Centre, 43 Old Oak Road, Bellville, 7530

2. What this policy covers

This policy applies to personal information we collect through this website, including the call-back form, the contact form and the online consultation booking system, and to information you send us by email or give us by phone when you first contact us.

If you become a client, your information is also governed by our engagement letter and by our professional duties of confidentiality and legal professional privilege.

3. The personal information we collect

Information you give us

Contact details: your name, contact number and email address.
Enquiry and booking details: the service you need, your answers to our intake questions (for example your date of marriage and marital regime, details of a deceased estate, or the address and value of a property), the appointment you choose, and anything else you tell us about your matter.
Will instructions: if you ask us to draft a will, your ID or passport number, marital status, and the names of your spouse or partner, children, heirs, executor and guardian.
Documents you upload, such as an embassy's or authority's instructions for a notarial authentication or apostille.
Documents you send us by email or hand in at our office. These can include death certificates, wills, identity documents, marriage certificates, bank statements, and property and policy documents.

Information about other people

Estate and property matters naturally involve other people: the person who has passed away, spouses, heirs and beneficiaries (sometimes children), executors, buyers and sellers. If you give us information about another person, you confirm that you are entitled to share it with us for the purpose of getting legal advice or services.

Information collected automatically

When you visit the website, our hosting and security provider automatically records technical information such as your IP address, browser type, the pages you request and the date and time of each request. This is used to deliver the website, protect it from attacks and fix faults. We do not use analytics, advertising or tracking cookies. See section 12.

4. Special personal information and children

Some documents, such as a death certificate or a will, can contain special personal information as defined in section 26 of POPIA (for example health information or religious beliefs), or information about children.

We only process this information where it is necessary to establish, exercise or defend a right or obligation in law, where you have given consent, or where another ground in sections 27 or 35 of POPIA applies. We process it only to the extent needed for your matter. For the initial consultation, please send only the documents we ask for.

5. Why we use your information, and our lawful basis

We only process personal information for specific, lawful purposes (sections 11 and 13 of POPIA):

To respond to your enquiry and phone you back, because you asked us to.
To book and hold your consultation, including sending calendar invitations and meeting links. This is a step you asked us to take before any mandate is concluded.
To advise you and, where possible, give you a quote, using the information and documents you give us.
To carry out your matter if you instruct us, under our mandate.
To comply with our legal obligations, including those under the Legal Practice Act, the Financial Intelligence Centre Act (client identification and verification), the Administration of Estates Act, tax legislation and the Deeds Registries Act.
To protect our legitimate interests and those of our clients, for example keeping the website secure and keeping records of advice given.

We do not use your information for automated decision-making or profiling.

6. Direct marketing

We will not send you marketing messages unless you have agreed to receive them, or you are an existing client and the message is about services similar to those we provided to you, as permitted by section 69 of POPIA. Every marketing message will let you opt out free of charge. We never sell, rent or trade personal information.

7. Who we share your information with

Your information is only shared where necessary, and only with:

Our service providers (operators) who process information on our behalf under written agreements requiring confidentiality and appropriate security (sections 20 and 21 of POPIA):
- Microsoft (Microsoft 365: email, calendar and Microsoft Teams), which receives form submissions, bookings, uploaded documents and the emails you send us;
- Cloudflare (website hosting, security and the forms that deliver your submission);
- Zoom, only if you choose a Zoom meeting;
- Google Fonts, which supplies the fonts used on this website and so receives your IP address when a page loads.
Parties involved in your matter, once you have instructed us and only as your matter requires. These include the Master of the High Court, the Deeds Office, the South African Revenue Service, banks and financial institutions, the other party's attorneys, estate agents, bond originators, the courts, and professional advisers we appoint for your matter.
Regulators and authorities where the law requires it, for example the Legal Practice Council or the Financial Intelligence Centre.

8. Information sent outside South Africa

Microsoft, Cloudflare, Zoom and Google may store or process information on servers outside South Africa. We only use providers that are bound by laws, binding corporate rules or agreements providing a level of protection substantially similar to POPIA, as required by section 72. By using the forms and booking system, you acknowledge that your information may be transferred on this basis.

9. How we protect your information

As required by section 19 of POPIA, we take appropriate, reasonable technical and organisational measures to protect personal information against loss, damage and unauthorised access or disclosure. These include:

encrypted (HTTPS) connections for the whole website;
form submissions and bookings delivered straight into our Microsoft 365 mailbox, with nothing kept on the web server;
access to that mailbox restricted to authorised staff;
confidentiality obligations on all staff and service providers.

If we believe your personal information has been accessed or acquired by an unauthorised person, we will notify you and the Information Regulator as required by section 22 of POPIA.

10. How long we keep your information

Enquiries and bookings that do not lead to an instruction are deleted within 12 months, together with any documents you sent or uploaded, unless we need to keep them for a legal reason.
Client files are kept for as long as required by law and professional rules, including at least five years after the end of the business relationship under the Financial Intelligence Centre Act, and for longer where needed to protect our clients' or our own legal rights.
Technical logs kept by our hosting provider are kept for short periods for security purposes.

When information is no longer needed, it is deleted or destroyed, or de-identified so that it can no longer be linked to you (section 14 of POPIA).

11. Your rights

Under POPIA you have the right to:

ask whether we hold personal information about you, and request a copy of it (section 23);
ask us to correct, update or delete information that is inaccurate, out of date, excessive or unlawfully obtained (section 24);
object to our processing of your information on reasonable grounds, or to direct marketing at any time (section 11(3));
withdraw your consent where we rely on consent. This does not affect processing already carried out;
lodge a complaint with the Information Regulator (section 74).

To exercise these rights, contact our Information Officer at the details in section 1. We will ask you to confirm your identity before releasing or changing information. Some requests may be limited by law, for example information protected by legal professional privilege, or records we must keep. Requests for access to records can also be made under the Promotion of Access to Information Act (PAIA). Our PAIA manual is available on request.

12. Cookies

This website does not use analytics, advertising or tracking cookies, and does not build a profile of your visits. Our hosting provider, Cloudflare, may set a strictly necessary security cookie to tell real visitors apart from automated attacks. It does not identify you and cannot be switched off without affecting the security of the site.

13. Using the website does not create a client relationship

Submitting a form, booking a consultation or sending us documents does not by itself make you a client of CHA Law or create a mandate. We will treat everything you send us as confidential all the same.

14. Links to other websites

This website links to other websites, such as our social media pages and government sites. We are not responsible for their privacy practices. Please read their privacy policies.

15. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated.

16. Complaints to the Information Regulator

If you are unhappy with how we have handled your personal information, please contact our Information Officer first so that we can try to resolve it. You also have the right to complain to the Information Regulator:

Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
POPIA complaints: POPIAComplaints@inforegulator.org.za
General enquiries: enquiries@inforegulator.org.za · 010 023 5200
Website: inforegulator.org.za