Privacy policy
This page is a draft awaiting legal review. It describes how the site works today, but the wording may change before launch.
Who we are
The Draft Clinic is run by Dr Kalonji in South Africa (“we”, “us”). We are the responsible party for your personal information under the Protection of Personal Information Act 4 of 2013 (POPIA). Our Information Officer is Dr Kalonji, reachable at help [at] draftclinic [dot] com.
What we collect and why
| When | What we collect | Why | Lawful basis (POPIA s11) |
|---|---|---|---|
| You ask for a free guide | Your email address and the guide you chose | To email you the guide | Your request |
| You tick “Send me occasional tips” | Your email address, the guide, the date you agreed | To send occasional tips | Your consent (s69), optional |
| You request a call | Name, email, level of study, deadline, what you need | To arrange the call | Your request |
| You book a call in our calendar | Whatever the booking form asks (name, email, time) | To hold the call | Your request |
| You send a question | Name, email, topic and your message | To reply to you | Your request |
| Any form | A salted, one-way hash of your IP address | To stop spam and repeated submissions | Legitimate interest |
If you ask for a guide without ticking the tips box, we do not keep your email address. We use it once, to send the guide.
We never collect ID numbers, financial details or special personal information (such as health, religion or biometrics). Please don’t include these in messages.
Your drafts
Drafts you show on a call stay on your screen. We don’t keep a copy unless you email one to us, and we delete emailed drafts within 30 days of your last session.
Children
Some visitors are school learners under 18. POPIA requires a parent or guardian’s consent before we process a child’s personal information, so our forms ask anyone under 18 to check with a parent or guardian first. A parent or guardian can ask our Information Officer to review or delete their child’s information at any time.
Who we share it with
These service providers (“operators”) process information for us, on our instructions, under written agreements:
| Provider | What they do for us | Where |
|---|---|---|
| Vercel Inc. | Hosts the website and runs the forms | Forms run in the United Kingdom (London) |
| Neon | Stores the tips mailing list | United Kingdom (London) |
| Resend | Sends the emails you ask for | United States |
| Calendly LLC | Our booking calendar, once it is switched on | United States |
| Google (Meet) | The video call itself | Google’s global network |
Some of your information is processed outside South Africa. We transfer it only under the conditions in POPIA section 72: the provider is bound by law or agreement to protection substantially similar to POPIA, and the transfer is needed to provide what you asked for.
We never sell your personal information.
How long we keep it
- Guide requests without the tips box: not stored by us. Our email provider keeps a delivery record for a short period for troubleshooting.
- Tips mailing list: until you unsubscribe. We then keep only a record of the opt-out, so we don’t contact you again.
- Call requests and questions: 24 months after our last contact with you, then deleted.
- Calendar bookings: 24 months after the call, then deleted from the calendar.
- Spam-protection records (hashed IP addresses): deleted within a day.
How to be removed
- From the tips list: use the unsubscribe link in any tips email, or email help [at] draftclinic [dot] com.
- Everything else: email help [at] draftclinic [dot] com and say what you’d like removed. We reply within 30 days and may ask you to confirm it’s you.
Your other rights
Under POPIA you may:
- ask whether we hold information about you, and for a copy (s23);
- ask us to correct or delete it (s24);
- object to processing, including direct marketing, at any time (s11(3));
- withdraw consent at any time. This does not affect processing that already happened;
- complain to the Information Regulator (South Africa): inforegulator.org.za.
How we protect it
All traffic is encrypted (HTTPS). The mailing list is stored encrypted by our database provider, and access is limited to people who need it, with two-factor sign-in. If we believe your information has been accessed without authorisation, we will tell you and the Information Regulator, as POPIA section 22 requires.
Cookies
Our own website sets no cookies. See the cookie policy for the booking calendar.
Changes
If we change this policy in a way that matters, we will update the version and date above. If it affects information you have already given us, we will tell you by email.