Protecting your personal information

Who we are

Dignity South Africa (Dignity SA NPC, registration 2025/680715/08; registered public benefit organisation 930088978) is the responsible party for the personal information you give us in the Dignity Navigator. Our Information Officers are our Executive Directors, who can be reached at [email protected].

What we collect

• Your account details: name, email address and, if you give it, your WhatsApp number and postal address.
• Your Navigator answers: the reflections, choices, names and contact details you enter in the courses, including the people you nominate to act for you.
• Your trusted people: the name, email address and, if you give it, phone number of each, your relationship to them, and what each one is for, such as your health care, your money and estate, or your funeral wishes, memories and messages.
• Documents you upload to your vault, such as a Will, a signed Section 7 Mandate, a Living Will or policy papers, and, if you add them, photos and video messages.
• A record of each document you email: which document, to whom, when, and whether it was delivered.
• The dates of your 30 free days and of any lock, your reminder and referral requests, and a record of when you accepted this statement.

Some of this is special personal information under POPIA: reflections about the end of life can reveal health, religious or moral views, and documents such as a Living Will record your wishes about medical treatment. We treat all of it with the highest care.

Some of what you enter is about other people, such as your trusted people, the people you name to act for you, and anyone who appears in a photo or video message you add. Please let them know that you have shared their details with us, and ask anyone who appears in a photo or video message for their permission before you add it. When we email someone a document or an invitation for you, our email tells them who we are and why we have their details.

Why we collect it

• To give you the Dignity Navigator: to save your progress, make your documents, keep them together and show you the right next step.
• To do what you ask us to do, such as emailing a document to the people you choose, inviting someone to log in, sending you a reminder to review your Will or introducing you to a provider you asked about.
• To email you about your Navigator, such as reminders before your 30 free days end and before a locked Navigator is deleted.
• To keep the service working safely, including preventing abuse, not emailing addresses that have asked us to stop or cannot receive email, and keeping backups.

We will not use your Navigator information for any other purpose unless the law requires it. We do not sell personal information.

Our lawful basis

Where we ask for your consent, that consent is the basis for processing, and you may withdraw it at any time. Some processing is necessary to provide the service you have joined or to meet a legal duty.

A document you email can contain special personal information, such as your wishes about medical treatment, and once delivered it may be kept outside South Africa. So we ask for your consent each time you send one, on the screen where you confirm what will go to whom.

Where your information is kept and how it is protected

Your answers, your documents and our backups are stored entirely in South Africa, on Amazon Web Services in Cape Town, copied across at least three physically separate data centres so that they would survive the loss of an entire data centre. Our database and document storage are encrypted at rest. Each of your Navigator answers is also encrypted with AES-256, using a key unique to you, before it is saved. Those keys are protected by a separate key service under DignitySA's control rather than kept in our database, so a copy of the database cannot be read on its own. Your documents and their names are encrypted in storage. Information travels over encrypted connections, backups are encrypted before they leave our systems, and any use of the keys that protect your answers and documents, other than by the Navigator itself and our automatic backups, automatically sends an alert to our administrators.

A document you choose to email leaves our storage. It is sent through Amazon Web Services' email service in Cape Town, which keeps no copy once the email has been delivered, and is then kept by the recipient's email provider, such as Gmail or Outlook, which may keep it outside South Africa.

Our other emails, such as reminders, invitations and receipts, are sent through an email service in the United States, which keeps a copy of each for 30 days and is bound by contract to protect them. They never contain your answers or documents.

Who can see it

In the normal course of the service, only you and the people you choose can read your Navigator answers and open your documents.

You decide what each of your trusted people is for, such as your health care, your money and estate, or your funeral wishes, memories and messages. Unless you invite them to log in, they receive only the documents you choose to email them, as described under "Documents you send".

With full access, you can also invite your trusted people to log in. A person you invite sees everything you have saved and every document in your vault, but only after they accept your invitation, and they can only view, never change. If you choose to share only some parts of your Navigator with someone, for example your funeral wishes, memories and messages but not your health care or your money and estate, they see only those parts. You can see when each person last looked, and you can remove anyone's access at any time.

DignitySA's everyday staff tools show your progress and account details, such as which steps you have completed and whether you have unlocked full access, but never your answers, nor the contents or names of your documents. Because DignitySA holds the encryption keys, opening your answers and documents is technically possible, so we allow it only through a break-glass procedure, and only for one of four reasons: you asked us for help; a verified request after your death, or if you can no longer decide for yourself; a legal order; or a security incident.

Under that procedure, one administrator must ask, giving the reason, and a different administrator must approve, each confirming with a code from their own authenticator. An approved request can be used once, read-only, for at most 60 minutes, and every step and every document opened is recorded. We will always tell you when a request has been approved, and for a request after your death or loss of capacity we also tell the people you invited who have accepted.

If you choose people to be given access only after your death, or if you can no longer decide for yourself, we give it only when one of them asks with proof, such as a death certificate, and two different administrators have checked and approved the request. Where it is possible, we tell you before access is given.

Nothing is shared with anyone else unless you ask us to, for example by emailing a document or requesting an introduction to a provider, and we tell you what will be shared before you confirm. Our service providers, such as our hosting, storage and email services, process data on our instructions and under contract.

Documents you send

You can email the documents you make in the Navigator, such as your Section 7 Mandate or your Living Will, to your trusted people, and attach a signed copy or other documents you have uploaded. Before each send, we show you what will go to whom, and ask for your consent to that send.

• The email comes from the Dignity Navigator and names you, and replies to it go to your email address.
• Once delivered, the email and its documents are in the recipient's inbox, outside our storage and our protection. Their email provider may keep them outside South Africa, and anyone who can open that inbox can read them.
• A sent document cannot be called back. Removing someone from your trusted people, or deleting your information, stops further emails but does not delete what they already have.
• We keep a record of each send: which document, to whom, when, and whether it was delivered. We do not keep a copy of the email, or of the document made for it.
• Each email tells the person who we are, why they have received it, and how to ask us to stop. If they ask, we send them nothing more and tell you.

How long we keep it

Your Navigator information is kept for as long as you keep your account, or until you delete it yourself on the Your information page or ask us to delete it.

If you start with 30 days free, you can get full access at any time, and with it your Navigator is never locked. If you haven't got full access by the end of the 30 days, or of the free extra month if you take it, your Navigator is locked. We keep everything in it safely, and you can still sign in to read and download it, but you can't change anything or send documents from it. You can get full access, or delete everything, at any time. We email you reminders during the following year, and if your Navigator is still locked a year after it was locked, we delete everything in it and tell you that we have.

When a profile is deleted, its Navigator answers, requests, trusted people, record of documents sent and vault documents are deleted with it. Documents you have emailed stay with the people you sent them to. Records of payments are kept for as long as the law requires for our accounts.

Deleted information may persist in encrypted backups for up to about 13 months before it is removed in turn: monthly backups are kept for 12 months, and a locked safety copy of each backup, which nobody, DignitySA included, can delete early, for 35 days after that.

Your rights

• To know what personal information we hold about you and to receive a copy. You can download a copy of your Navigator information yourself on the Your information page, linked at the foot of every Navigator page.
• To have inaccurate information corrected.
• To have your information deleted, or to withdraw your consent. You can delete your Navigator information yourself on the Your information page, or email [email protected]. This cannot reach documents you have already emailed, which only the people you sent them to can delete.
• To object to processing, and to complain to the Information Regulator of South Africa (www.inforegulator.org.za) if you believe your information has been mishandled.

Changes to this statement

If we change this statement in a way that matters, we will ask you to read and accept it again before you continue. You can read the current version at any time from the link at the foot of every Navigator page, where you will also find answers to common questions about your privacy.