# Privacy Notice

> **DRAFT — requires review by a qualified lawyer / POPIA specialist / accountant before use.** This draft is not a notice of a confirmed processing practice. Complete it from the deployed architecture and approved provider contracts before publication.

**Version:** `[SET ONECLOUD_TERMS_VERSION AFTER REVIEW]`  
**Responsible party legal name:** `[OWNER TO COMPLETE]`  
**Information Officer and contact:** `[OWNER TO COMPLETE]`  
**Effective date:** `[DATE]`

## Who this notice would cover

This notice would explain how the OneCloud service provider handles personal information about account holders, invited members, customers, suppliers, employees, and people whose details are entered into a workspace. The customer organisation and service provider may have different responsibilities for those records; a POPIA specialist must confirm the allocation for each use.

## Information and purposes

Depending on enabled features, the service may process account and authentication details, organisation settings, business records, audit events, uploaded documents, email connection details, support requests, payroll or tax workpaper data, billing events, and technical logs. The final notice must identify each actual category, purpose, lawful basis, source, and required-versus-optional field.

## Recipients and locations

`[OWNER TO COMPLETE after choosing the production host and reviewing contracts:]` hosting and database operators; file and backup storage; email or identity providers selected by the customer; payment providers; optional AI providers when enabled; support providers; and any subprocessors. Record each provider's legal entity, service, processing location, and transfer safeguards. Do not treat this draft or the repository dependency list as a complete subprocessor inventory.

## Security, retention, and rights

The service uses access controls, organisation scoping, encryption for selected protected values and backups, and audit records. These controls do not guarantee that an incident cannot occur. Retention periods, deletion behaviour, backup expiry, cross-border transfer safeguards, data-subject request handling, objection and correction procedures, and regulator contact information must be completed from the live operating design and current legal advice.

## Choices and requests

Customers should not enter information they lack authority to use. Requests about data in a customer workspace should normally be directed to that customer organisation. Requests to the provider may be sent to `[INFORMATION OFFICER CONTACT]`. The final notice must explain identity checks, response periods, complaints, and any applicable regulator process.

## Breaches and updates

The provider would investigate suspected compromise under the reviewed breach-response procedure and notify affected parties or regulators when required by applicable law. The final notice must state how material changes are communicated and how historical versions can be obtained.