Privacy Policy

Last Updated: 16 February 2025  ·  SkyL4rk Digital (PTY) LTD (SA)  ·  SkyL4rk UK LTD (UK)

1. Introduction

TermsCon ("we", "us", "our"), operated by SkyL4rk Digital (PTY) LTD and SkyL4rk UK LTD, is committed to protecting your personal information and processing it lawfully, transparently, and securely.

This Policy describes how we collect, use, retain, share, and protect personal data in connection with the TermsCon platform. It applies to all users of our website (termscon.com), client portal (vault.termscon.com), and APIs.

2. Scope of This Policy

This Policy applies to:

• Account holders and their authorised users;
• Visitors to our website;
• Signatories and other individuals whose personal data is included in Documents created, uploaded, sent, or processed via TermsCon.

Where you submit personal data about third parties (e.g., Signatories), you are responsible for ensuring you have a valid lawful basis to do so and for providing those individuals with appropriate privacy notices.

3. Information We Collect

Account and registration data

Full name, email address, phone number, company name, VAT number, billing address, and payment information (processed securely through PayFast — we do not store card numbers).

Usage and platform data

Documents created or uploaded, metadata (timestamps, IP addresses, device/browser type), signing events, audit log entries, token balances, and subscription history.

Identity verification data (via Verilink)

Where biometric identity verification is used, Verilink processes facial images, liveness checks, and ID document scans. TermsCon receives and retains a verification result and confidence score — not raw biometric templates. Verilink processing is governed by the Verilink Privacy Policy.

Compliance screening data

Where AML, PEP, or sanctions screening is requested, we transmit the relevant data fields to screening APIs and retain the result for compliance record-keeping purposes.

Communications

Content of emails or messages sent to our support or sales team.

Ownership Structure and Cap Table data

Where you use the Ownership Infrastructure Services, we collect and process: Holder identity and KYC records, Cap Table composition and ownership percentages, Structural Event records (issuances, transfers, dilutions, buyouts), wallet addresses (Managed and External), governance approval records, and Structural Event audit logs. Wallet addresses are treated as personal data where they can be linked to an identified individual.

Blockchain and on-chain data

Structural Events confirmed on the Ethereum network generate public, permanent on-chain records. These records contain wallet addresses and cryptographic hashes — not names, identity documents, or directly identifying information, which are stored exclusively in TermsCon's encrypted off-chain infrastructure. By using the Ownership Infrastructure Services you acknowledge that on-chain records are public, permanent, and outside TermsCon's ability to delete or modify once confirmed.

4. Lawful Basis for Processing

We process personal data on the following legal grounds:

5. How We Use Your Information

• To create and manage your Account and provide the Services;
• To process payments and manage your subscription and token balance;
• To enable document creation, sending, signing, and verification workflows;
• To conduct AML, KYC, and sanctions screening as requested or required by law;
• To maintain audit trails for legal enforceability of signed Documents;
• To detect, prevent, and investigate fraud or security incidents;
• To communicate service updates, billing alerts, and support responses;
• To improve platform performance and user experience (aggregated, anonymised analytics);
• To comply with applicable legal and regulatory obligations.

6. Data Retention

We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by applicable law:

Upon expiry of applicable retention periods, data is securely deleted or anonymised.

7. Data Sharing and Sub-Processors

We do not sell your personal data. We share data only with the following categories of recipients where necessary to deliver the Services:

Where data is transferred outside South Africa, we ensure appropriate safeguards are in place (POPIA Section 72 authorisation or equivalent, Standard Contractual Clauses for GDPR transfers).

8. International Data Transfers

Some of our sub-processors are located or process data outside South Africa. Where this occurs, we rely on:

• POPIA Section 72: We ensure the recipient country provides an adequate level of protection, or we have binding contractual safeguards in place.
• GDPR (UK/EU users): Transfers to third countries rely on Standard Contractual Clauses (SCCs) — Module 2 (Controller to Processor) — as approved by the European Commission and UK ICO.

9. Data Storage and Security

• Encryption in transit: All data transmitted to and from TermsCon is encrypted using TLS 1.2 or higher.
• Encryption at rest: Sensitive data fields are encrypted at rest using AES-256.
• Document integrity: Signed Documents are protected by multi-server SHA-256 hash cross-verification. Any post-signature modification is immediately detectable.
• Access controls: Role-based access controls and audit logging are applied to all administrative access to production systems.
• Incident response: We maintain a documented incident response procedure. In the event of a data breach affecting your rights and freedoms, we will notify you and, where required, the Information Regulator within the timeframes prescribed by law.

10. Your Rights

Depending on your jurisdiction, you have the following rights in relation to your personal data:

To exercise any of these rights, contact our Information Officer at privacy@termscon.com. We will respond within 30 days (POPIA) or one month (GDPR).

Note that some rights are subject to legal and regulatory retention obligations — we cannot delete AML screening records or signed Document audit trails before their statutory retention period expires.

11. Right to Lodge a Complaint

If you believe we have not handled your personal data lawfully, you have the right to lodge a complaint with the relevant supervisory authority:

We would appreciate the opportunity to address your concerns directly before you contact a regulator — please reach out to us first at privacy@termscon.com.

12. Cookies and Tracking Technologies

We use cookies and similar technologies to ensure platform functionality, enhance security, and understand how our platform is used. You can control non-essential cookie preferences through your browser settings.

Cookie categories

We do not use advertising or cross-site tracking cookies. To opt out of Google Analytics, use the Google Analytics Opt-out Browser Add-on.

13. Children's Privacy

The Services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child's data has been submitted to our platform without appropriate authority, please contact privacy@termscon.com and we will take prompt steps to delete it.

14. Access to Information (PAIA)

In terms of the Promotion of Access to Information Act 2 of 2000 (PAIA), you have the right to request access to records held by TermsCon. Our PAIA manual is available on request from our Information Officer at privacy@termscon.com.

15. Changes to This Privacy Policy

We may update this Policy from time to time to reflect changes in our practices, technology, or applicable law. We will notify you of material changes via email or a prominent notice on the platform at least 14 days before the changes take effect. We encourage you to review this page periodically.

16. Contact Information

For any questions, requests, or concerns relating to this Privacy Policy or your personal data: