Privacy Policy
This notice explains personal information handling across the Livi workspace, authentication services and shared document access. It covers employees, contractors, authorised business users and people whose information appears in business records.
01Who is responsible and how to contact us
Enabling Solutions operates Livi for its business activities. Where it determines why and how personal information is processed, it acts as the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA). For client-controlled information, responsibilities depend on the actual arrangement and applicable contract; Enabling Solutions may process that information on the client’s instructions.
Send privacy enquiries or requests to helpdesk@enablingsolutions.co.za, marked Privacy request, for referral to the Information Officer or appropriate responsible party. Include enough information to locate the record, but do not send passwords or unnecessary identity documents. Identity or authority may need to be verified before information is disclosed.
02Information collected and its sources
Depending on the features used, Livi processes names, business contact details, account identifiers, department and role information, permissions, profile details, form responses, approvals, signatures, customer and supplier records, contracts, sales information, support tickets, messages, attachments and reports. Records can include information about people who do not have a Livi account.
Information comes from users, administrators, authorised colleagues, business contacts, shared documents and configured connected systems. Technical information is also collected when the service is accessed. Only provide information needed for the task and that you are authorised to share; raise inaccurate or excessive records with the record owner or Helpdesk.
03Authentication, device information and location
Login audit records can include the account or email identifier, successful or unsuccessful outcome, failure reason, login method, verification status, Remember me selection, IP address, browser, operating system, device details, session identifier and event time. The audit service can send a public IP address to ipinfo.io to resolve an approximate city, region and country.
The current sign-in flows require device location permission. They submit latitude, longitude and, where available, reported accuracy and timestamp. Coordinates are stored in the session and can appear in authentication diagnostic logs. Device location can be more precise than IP-based location. Declining permission or an unavailable location service can prevent sign-in; contact Helpdesk if you cannot satisfy this requirement.
This collection supports the location-enabled sign-in process, security investigation and troubleshooting. The sign-in request is not a notice of continuous location tracking. Browser permission alone does not establish a lawful basis for unrelated uses; any additional location processing requires its own purpose and appropriate notice.
04Purposes and lawful grounds
Personal information is processed to administer accounts and permissions, authenticate users, complete business workflows, maintain client and supplier records, provide support, communicate about work, deliver requested features, protect the service, investigate incidents and meet applicable recordkeeping obligations.
The applicable POPIA justification depends on the activity and may include contractual necessity, a legal obligation, protection of a legitimate interest, or consent where appropriate. Collection should be relevant and not excessive. Processing for a materially different purpose requires an assessment of compatibility or another lawful justification. Signing in is not blanket consent to every possible use of information.
05Required information and sensitive records
Account credentials, verification information and required workflow fields may be necessary to provide a particular service. Failure to provide them can prevent authentication, submission or completion of a business process. Optional information should not be supplied unless relevant. Ask the record owner or Helpdesk where a required field appears excessive.
Special personal information, including health, biometric or criminal-behaviour information, and information about children is subject to additional POPIA restrictions. Do not submit it without an authorised purpose and appropriate safeguards. A device may use a fingerprint or face to unlock a passkey; that should not be treated as permission to upload biometric images to Livi.
06Cookies, sessions and browser storage
The workspace uses session and request-security mechanisms to maintain sign-in state and protect interactions. Selecting Remember me can maintain authentication beyond the current browser session. Browser storage is also used for interface state, such as sign-in notices and the previously displayed security tip.
You can clear browser storage and manage cookies through browser settings, but doing so may sign you out, remove preferences or prevent some functions. Use a private or shared device cautiously. Connected services and externally loaded resources may process technical requests under their own notices; this notice does not promise that every third-party resource is free of tracking.
07Business records, communications and monitoring
Forms, approvals, file activity, support discussions, collaboration records, technical diagnostics and administrative changes may be visible to authorised participants and reviewers according to permissions and business needs. Work records may be reviewed for troubleshooting, security, audit, investigation and operational continuity.
Monitoring must be proportionate and limited to an authorised purpose. Administrative access is not permission to inspect unrelated personal information. Avoid unnecessary private details in work communications and report inappropriate access. Applicable privacy rights remain in place when using a work system.
08AI and connected service processing
Where AI features are used, prompts, selected context, uploaded files and generated responses may be processed by configured AI services. Other integrations may exchange account, operational or document information needed for their selected function. The exact information depends on the feature, permissions and configuration.
Do not send credentials or information that is not approved for the selected provider. This notice does not make a blanket claim about provider training, retention or hosting locations; the applicable provider terms and company configuration must be checked for the intended use. AI-assisted outputs require human review, and concerns about a consequential automated decision can be raised through the privacy contact route.
09Recipients and external document sharing
Information may be available to authorised colleagues, managers, workflow approvers, support staff, administrators and other personnel who need it for their duties. It may also be processed by service providers supporting hosting, authentication, communications, security, AI or connected business services, according to the feature in use.
Approved external recipients may receive shared files or business records. A share link can expose information to anyone who obtains that link while it remains usable, so recipients and permissions must be checked carefully. Disclosures to advisers, authorities or other parties must have an appropriate legal or contractual basis. Operators must act under authorised instructions and applicable confidentiality and security requirements.
10Cross-border processing
Cloud services and integrations may involve processing outside South Africa. The country and recipients depend on the configured provider and service. Do not assume that every record remains in South Africa.
Before a transfer, the responsible party must establish an applicable basis under section 72 of POPIA, such as adequate protection through law or a binding arrangement, or another permitted ground. Ask the privacy contact for information about transfers relevant to your records. A general reference to cloud services is not evidence that a particular transfer has been assessed or approved.
11Retention, correction and deletion
Retention depends on the record type, purpose, legal and contractual duties, audit needs, security requirements and any preservation hold. This notice does not prescribe a single fixed period for all records. Information must not be retained beyond what is justified, and retention arrangements should support deletion, de-identification or restricted processing when appropriate.
Closing an account or deleting a visible record may not immediately remove associated business records, logs, archives or backups. Where retention is required, access and use should be restricted appropriately. Ask the privacy contact about the period or criteria applicable to a specific record, or request correction of inaccurate information.
12Security and incident response
Livi includes account authentication, permission controls, session controls and audit logging. Multi-factor authentication, passkeys and other safeguards apply according to configuration. Users must protect devices and credentials, review recipients and report suspected compromise. No safeguard guarantees that information can never be lost, accessed or disclosed without authority.
Report suspected compromise promptly to Helpdesk without spreading exposed information. Incidents require assessment, containment and preservation of relevant evidence. Where POPIA section 22 applies, the responsible party must notify the Information Regulator and affected people as soon as reasonably possible after discovery, subject to the statutory qualifications and permitted delays.
13Your rights and requests
Subject to POPIA and applicable exceptions, you may ask whether personal information is held about you, request access, seek correction or deletion of qualifying records, object to processing on applicable grounds, and withdraw consent where consent is the basis. Withdrawal does not undo lawful earlier processing or automatically stop processing supported by another lawful ground.
Requests may require identity verification, prescribed procedures and, where legally permitted, a fee. Deletion and access rights are not absolute: legal retention, third-party rights and other statutory restrictions may apply. Ask for the reason where a request is refused or limited. Enquiries involving another organisation’s records may need to be referred to that responsible party. No fixed response deadline is promised by this notice beyond applicable legal requirements.
14Complaints and notice updates
You may raise concerns through the privacy contact route, and you may complain directly to South Africa’s Information Regulator about alleged unlawful processing. An internal complaint is not a prerequisite to exercising a statutory complaint right. The Regulator’s official complaints page explains current submission channels.
This notice may change when the workspace, providers or processing purposes change. Material changes should be communicated appropriately, and new consent obtained where required. Publication of a notice does not certify legal compliance or replace the responsible party’s duty to implement and demonstrate lawful processing.
Contact and references
Contact Helpdesk for platform questions or referral of a privacy request.
Protection of Personal Information Act (POPIA) · Information Regulator complaints