Privacy Policy

MML Attorneys Inc.(“MML”, “we”, “us”) is a firm of attorneys practising in Cape Town, South Africa, with offices in Durbanville and Pinelands. We are the responsible party for the personal information described in this policy, as that term is used in the Protection of Personal Information Act 4 of 2013 (POPIA).

Our Information Officer is Ismaiel Mohamed, reachable at durbanville@mmlinc.co.za.

This policy covers our website and the online consultation booking service available on it. It does not cover the handling of client matter files, which is governed by our mandate and by the rules of the Legal Practice Council.

When you book a consultation

• Your name, email address and contact telephone number.
• The nature of your matter and any notes you choose to give us, so the attorney can prepare.
• The attorney, date, time and format (in person, telephone or video) you selected.

You choose what to put in the notes field. Please do not include sensitive detail there — the consultation itself is the place for that.

When you are a member of our staff

• Your work email address and name, held in Google Firebase Authentication. Accounts are created by our administrator; there is no public sign-up.
• Your consulting hours, buffers, days off, office, biography and profile photo, which appear on your public booking page.
• An authorisation credential for your linked Google Calendar (see below).

When you browse the website

• Standard technical information handled by our hosting provider, such as IP address, browser type and pages requested.
• Aggregate usage statistics, where analytics is enabled — see Cookies and analytics.

This section applies only to MML attorneys and staff who choose to connect a Google Calendar so that clients can book them online. It does not apply to clients booking a consultation — booking never requires a Google account.

What we request, and why

• See free/busy information (calendar.readonly) — so the booking page can offer only times when the attorney is genuinely free, and never double-book them.
• Create and manage consultation events (calendar.events) — so a confirmed booking is written into the attorney’s calendar, the client receives an invitation, and a cancellation removes it again.
• Your Google account email address (userinfo.email, openid) — so the dashboard can show which account is connected.

What we actually read

We query Google’s free/busy endpoint, which returns only the start and end times of existing entries. We do not read, store or display the titles, descriptions, guests, attachments or locations of your existing calendar events.

What we store

• An OAuth refresh token and short-lived access token, held server-side in Google Firestore. These are kept in a private area that our database security rules make unreadable to any browser, and are never sent to the client.
• The connected Google account email address and the identifier of the calendar you selected.
• For each consultation booked through the website: the event identifier and links returned by Google, so we can update or cancel it later.

Free/busy times are requested live when a client opens a booking page. They are not copied into our database.

What we never do

• We do not sell or rent Google user data.
• We do not use it for advertising, and we do not transfer it to advertising platforms, data brokers or resellers.
• We do not use it to train, retrain or improve any generalised artificial intelligence or machine learning model.
• No human at MML reads your Google data except where you have explicitly asked us to for support, where it is necessary for security purposes or to comply with the law.

How to withdraw access

Choose Disconnect on the Calendar page of your MML staff dashboard. This revokes the token with Google, deletes the stored credential, and removes you from the public booking page. You can also revoke access at any time from your Google account permissions. Consultations already in your calendar are not deleted.

• To show genuinely available consultation times and to confirm, reschedule or cancel a booking.
• To contact you about a consultation you have booked with us.
• To let the attorney prepare for your consultation.
• To operate, secure and improve the website and booking service.
• To meet our legal, regulatory and professional obligations.

We do not send marketing email off the back of a consultation booking, and we do not use your booking details for any purpose unrelated to the appointment.

We do not sell personal information. We share it only with:

• Google (Firebase and Google Calendar) — authentication, database and calendar services that make the booking system work.
• Our hosting provider — which serves the website and processes requests on our behalf.
• The attorney you booked, and the administrative staff supporting them.
• Authorities or regulators, where we are legally obliged to disclose.

These providers process data on servers that may sit outside South Africa. Where personal information is transferred across borders, we rely on the provider being subject to safeguards that give effect to principles for lawful processing that are substantially similar to POPIA, as section 72 of POPIA requires.

• Consultation bookings are retained as a record of the appointment, including after cancellation, for as long as we need them for the purpose they were collected and to meet our professional and statutory record-keeping duties.
• Google credentials are deleted as soon as a staff member disconnects their calendar.
• Staff accounts are removed when a person leaves the firm.

Where information is no longer needed and we are not required to keep it, we delete or de-identify it.

• All traffic to the website is encrypted in transit using HTTPS.
• Staff sessions use signed, HTTP-only cookies. Signing out revokes the session on the server, not only in the browser.
• Database security rules deny browsers any direct access. Every read and write goes through our server.
• Google refresh tokens are held in a private area that is unreadable to any client, at any time.

No system is perfectly secure. If a breach affects your personal information, we will notify you and the Information Regulator as POPIA requires.

Under POPIA you have the right to:

• Ask what personal information we hold about you, and get a copy.
• Ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date or unlawfully obtained.
• Object to processing on reasonable grounds.
• Withdraw consent where our processing relies on it.
• Complain to the Information Regulator.

To exercise any of these, email durbanville@mmlinc.co.za. See our POPIA page for more, including how to reach the Regulator.

We use a small number of cookies that are necessary for the site to work — in particular a session cookie that keeps staff signed in to the dashboard. These cannot be switched off without breaking sign-in.

Where Google Analytics for Firebase is enabled, it collects aggregate usage statistics. It is loaded only in the browser, only where supported, and it is not used to build a profile of you as an individual.

The booking service is intended for adults. We do not knowingly collect the personal information of a child without the consent of a competent person. If you believe we have, contact us and we will delete it.

We may update this policy as our services change or the law requires. The date at the top always reflects the current version. Material changes affecting how we handle Google user data will be reflected here before they take effect.

For any question about this policy or your personal information: