Accountability Policy

1.1 Local Processing Commitment: Legal Ozzie operates through secure, encrypted API calls to our AI inference provider (Groq Cloud). UNDER NO CIRCUMSTANCES is your data used for AI model training, fine-tuning, or any form of machine learning improvement. Our AI processes queries in real-time and discards them immediately after response generation. No conversation data, case details, or personal information is retained by the AI provider for any purpose beyond the immediate response.

1.2 Zero Data Training Guarantee: We have explicitly configured our AI integration with a strict NO-TRAINING clause. The Llama 3.3 70B model processes your queries in stateless isolation. Each request is independent — no context is saved, no conversations are logged by the AI provider, and no data is extracted for model improvement. This is contractually enforced with our technology partners.

1.3 NexGen Nova Technology Oversight: The platform infrastructure, AI integration, and security architecture are engineered and maintained by NexGen Nova. NexGen Nova acts as the technology custodian and is bound by the same accountability standards outlined herein. Any technology subcontractors engaged by NexGen Nova are also bound by these policies through enforceable contractual agreements.

1.4 Human Oversight: All AI-generated outputs are subject to human review by qualified legal professionals at Mavuya Inc before being used as part of any legal advice, strategy, or client communication. Legal Ozzie is an assistive tool — it does not replace professional legal judgment.

2.1 Regulatory Compliance: We operate in full compliance with:

• POPIA (Protection of Personal Information Act, South Africa) — Act 4 of 2013
• GDPR (General Data Protection Regulation, EU) — For our international clients
• CPA (Consumer Protection Act, South Africa) — Act 68 of 2008
• Electronic Communications and Transactions Act (ECTA) — Act 25 of 2002

2.2 Data Classification & Handling: All client data is classified as Confidential and handled with the highest security protocols:

• Personal identifiable information (PII) is encrypted at rest using AES-256 encryption
• Data in transit is protected using TLS 1.3 encryption
• Passwords are hashed using bcrypt (PHP password_hash with PASSWORD_DEFAULT)
• Database access is restricted to authorized personnel only
• Session data is secured with HTTP-only, SameSite=Strict cookies
• Secure Cloud Storage: All client documents are securely stored using Cloudflare R2 object storage, providing enterprise-grade encryption, global redundancy, and zero-trust access controls

2.3 Data Retention & Deletion: Client data is retained only for the duration of the attorney-client relationship plus 5 years as required by South African legal ethics rules. Upon request, clients may exercise their right to erasure (where legally permissible) by submitting a formal request to compliance@mavuyainc.co.za. All data deletion is verified and certified.

2.4 Breach Notification Protocol: In the unlikely event of a data breach, Mavuya Inc commits to:

• Notify affected parties within 72 hours of discovery (GDPR-compliant)
• Notify the Information Regulator (South Africa) within 72 hours
• Provide full transparency on the scope, impact, and remediation steps
• Offer identity protection support where applicable
• Conduct a full post-incident review with NexGen Nova security team

3.1 Access Control: We enforce a strict Role-Based Access Control (RBAC) system. Every user — whether admin, consultant, or client — has access only to the data and functions explicitly authorized for their role. Access logs are maintained and audited regularly.

3.2 Authentication Security: Multi-factor authentication is available and encouraged for all admin accounts. Password policies require minimum 8 characters with complexity requirements. Account lockout is enforced after 5 failed login attempts, with a 15-minute cool-down period. All login attempts are logged with IP address, user agent, and timestamp.

3.3 Audit Logging: Every action performed within the system — including data access, modifications, exports, and login events — is logged with:

• Timestamp (UTC+2, South African Standard Time)
• User ID and role
• IP address and device fingerprint
• Action type and affected resources
• Before/after values for data modifications

Audit logs are immutable and retained for a minimum of 7 years.

3.4 Vulnerability Management: NexGen Nova conducts regular security assessments, penetration testing, and code audits. Critical vulnerabilities are patched within 24 hours. We maintain a coordinated vulnerability disclosure policy.

4.1 Jurisdiction & Governing Law: This policy is governed by the laws of the Republic of South Africa. Any disputes arising from the use of this platform shall be subject to the exclusive jurisdiction of the courts of South Africa.

4.2 Attorney-Client Privilege: All communications, documents, and data shared through the platform are protected by attorney-client privilege under South African common law and the Legal Practice Act, 2014 (Act 28 of 2014). Mavuya Inc and NexGen Nova take all reasonable steps to preserve this privilege.

4.3 Compliance Officer: Mavuya Inc has appointed a dedicated Compliance Officer responsible for:

• Monitoring compliance with all applicable data protection laws
• Conducting annual policy reviews and updates
• Handling data subject access requests (DSARs)
• Managing breach response and notification procedures
• Liaising with the Information Regulator and other authorities

4.4 International Compliance: For clients outside South Africa, we also comply with applicable international data protection frameworks, including GDPR for EU residents, UK GDPR for UK residents, and other local data protection laws as applicable.

5.1 Technology Partners: Our AI inference is provided by Groq Cloud. We have contractually ensured that:

• No client data is stored on Groq servers beyond the duration of the API call
• No data is used for training or improving Groq's models
• All data transmitted to Groq is encrypted in transit
• Groq is SOC 2 compliant and adheres to strict data processing agreements

5.2 Infrastructure Partners: Our hosting infrastructure is provided by XAMPP/Apache (development) with production-grade cloud hosting options available. All cloud infrastructure partners are selected based on their compliance with ISO 27001, SOC 2, and local data residency requirements.

5.3 NexGen Nova Oversight: As the technology architect and maintainer, NexGen Nova provides:

• Continuous security monitoring and threat detection
• Regular platform updates and vulnerability patches
• Architecture review and compliance validation
• Incident response and disaster recovery

6.1 Your Rights: As a user of the Mavuya Inc platform, you are entitled to:

• Right to Access: Request a copy of all personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your data where legally permissible
• Right to Restrict Processing: Request limitation of how we use your data
• Right to Data Portability: Request transfer of your data to another service provider
• Right to Object: Object to certain types of data processing
• Right to Complain: Lodge a complaint with the Information Regulator (South Africa)

6.2 Exercising Your Rights: To exercise any of these rights, please contact:
Email: info@mavuyainc.co.za
Address: Suite 66, First Floor, Arcade Walk Through, Corner of West Burger Street & Elizabeth Eybers Street, Bloemfontein Central, 9301, Free State, South Africa
Phone: 051 430 0113 / 061 589 8975
Fax: +27 86 608 6300
Response Time: We will respond to all requests within 21 calendar days as required by POPIA.

6.3 Complaints: If you are not satisfied with our response, you have the right to lodge a complaint with:
Mavuya Inc Attorneys:
Email: info@mavuyainc.co.za
Phone: 051 430 0113 / 061 589 8975
Address: Suite 66, First Floor, Arcade Walk Through, Corner of West Burger Street & Elizabeth Eybers Street, Bloemfontein Central, 9301, Free State, South Africa

Or lodge a complaint with the Information Regulator of South Africa:
Website: www.justice.gov.za/inforeg/
Email: complaints@inforegulator.org.za

7.1 Internal Enforcement: Violation of this policy by any Mavuya Inc employee, contractor, or partner may result in:

• Formal written warning
• Mandatory retraining on data protection and accountability
• Suspension of system access privileges
• Termination of employment or contract
• Legal action in cases of gross negligence or intentional misconduct

7.2 Client Non-Compliance: Clients who misuse the platform (e.g., uploading illegal content, attempting unauthorized access, sharing credentials) may have their accounts suspended or terminated immediately.

7.3 Policy Violations Reporting: Whistleblowers and concerned parties may report policy violations anonymously to: whistleblower@mavuyainc.co.za. All reports are investigated confidentially.

8.1 Review Cycle: This Accountability Policy is reviewed annually by the Mavuya Inc Compliance Officer in collaboration with NexGen Nova's security team. Updates are made as needed to reflect changes in:

• Applicable laws and regulations (POPIA, GDPR, etc.)
• Technology infrastructure and AI capabilities
• Industry best practices and security standards
• Organizational changes at Mavuya Inc or NexGen Nova

8.2 Notification of Changes: Registered users will be notified of material changes to this policy via email and/or platform notification at least 30 days before changes take effect. Continued use of the platform after changes take effect constitutes acceptance of the updated policy.

8.3 Historical Versions: Previous versions of this policy are archived and available upon request for 7 years.