POPIA Compliance

1. Introduction

Ditheko Accountants (Pty) Ltd ("Ditheko", "we", "our", "us") is committed to full compliance with the Protection of Personal Information Act 4 of 2013 (POPIA), South Africa's primary data protection legislation. This page sets out how we give effect to the eight conditions for lawful processing of personal information and how we uphold the rights of data subjects.

POPIA came into full effect on 1 July 2021. All responsible parties (organisations that determine the purpose and means of processing) are legally obligated to comply. As a professional accounting and tax practice, we take this obligation seriously.

2. Our Information Officer

In terms of section 55 of POPIA, every responsible party must appoint an Information Officer. Our designated Information Officer is responsible for ensuring our compliance with POPIA and handling all data subject requests.

• Information Officer: Director, Ditheko Accountants (Pty) Ltd
• Email: privacy@ditheko.com
• Phone: 010 746 0427
• Address: Building 10, Thornhill Office Park, 84 Bekker Road, Vorna Valley, Midrand, 1686

Our Information Officer has been registered with the Information Regulator of South Africa as required by law.

3. The Eight Conditions for Lawful Processing

POPIA sets out eight conditions that must be satisfied for the processing of personal information to be lawful. We adhere to all eight:

• Accountability: We take full responsibility for all personal information in our possession and have implemented appropriate measures to ensure POPIA compliance.
• Processing limitation: We collect personal information only for a specific, explicitly defined, and lawful purpose. We do not process information in a manner incompatible with that purpose.
• Purpose specification: We inform data subjects of the purpose of collection at the time of collection and retain information only as long as necessary.
• Further processing limitation: Any further processing of personal information is compatible with the purpose for which it was originally collected.
• Information quality: We take reasonable steps to ensure that the personal information we hold is complete, accurate, and up to date.
• Openness: We maintain this POPIA statement and our Privacy Policy to ensure transparency about our processing activities.
• Security safeguards: We implement appropriate, reasonable technical and organisational measures to prevent loss, damage, or unauthorised destruction or access to personal information.
• Data subject participation: We respect data subjects' rights to access, correct, and delete their personal information upon request.

4. Categories of Personal Information Processed

In the course of providing professional accounting, tax, and advisory services, we process the following categories of personal information:

• Identifying information: Full name, ID number, date of birth, tax reference number (TRN)
• Contact details: Physical address, email address, telephone number
• Financial information: Bank account details, income and expenditure records, SARS correspondence, financial statements
• Business information: Company registration number, VAT number, CIPC documents
• FICA information: Proof of identity, proof of address, beneficial ownership information (as required by the Financial Intelligence Centre Act)
• Website interaction data: IP address, browser information, pages visited (see our Cookie Policy)

We do not process special personal information (such as health, religious, or biometric data) unless specifically required by law or with explicit consent.

5. Lawful Bases for Processing

We process personal information on the following lawful grounds under POPIA section 11:

• Consent: Where you have given us specific, informed, and voluntary consent to process your information for a defined purpose.
• Contractual necessity: Where processing is necessary to perform a contract you are party to, or to take steps at your request prior to entering into a contract.
• Legal obligation: Where processing is required to comply with South African legislation, including the Income Tax Act, VAT Act, Companies Act, and FICA.
• Legitimate interest: Where processing is necessary for our legitimate interests, provided those interests are not overridden by your rights and freedoms.

6. Your Rights as a Data Subject

Under POPIA, you have the following rights which you may exercise at any time:

• Right to be notified (Section 18): You have the right to be informed when we collect your personal information and why.
• Right of access (Section 23): You may request confirmation of whether we hold your personal information and obtain a copy of that information.
• Right to correction or deletion (Section 24): You may request that we correct inaccurate, irrelevant, excessive, or outdated information, or delete it.
• Right to object (Section 11(3)): You may object, on reasonable grounds, to the processing of your personal information.
• Right to withdraw consent (Section 11(1)(a)): Where processing is based on consent, you may withdraw it at any time without penalty, without affecting the lawfulness of prior processing.
• Right not to be subject to automated decision-making (Section 71): You have the right not to be subject to a decision made solely by automated means that has legal or similarly significant effects.
• Right to lodge a complaint (Section 74): You have the right to complain to the Information Regulator if you believe your rights under POPIA have been infringed.

To exercise any of these rights, please submit a written request to our Information Officer at privacy@ditheko.com. We will acknowledge your request within 3 business days and respond substantively within 30 calendar days, as required by POPIA.

7. Data Retention

We retain personal information only for as long as necessary for the lawful purpose for which it was collected, or as required by applicable South African legislation:

Category	Retention Period	Legal Basis
Client financial records and tax documentation	Minimum 5 years	Income Tax Act / VAT Act
FICA due diligence documents	5 years after end of business relationship	Financial Intelligence Centre Act
Company records and CIPC documents	Duration of engagement + 7 years	Companies Act
Contact enquiries and correspondence	12 months or until resolved	Legitimate interest
Website analytics data	14 months (anonymised thereafter)	Legitimate interest

Upon expiry of the applicable retention period, personal information is securely destroyed or anonymised in a manner that prevents reconstruction.

8. Data Security Measures

In accordance with POPIA section 19, we have implemented the following security safeguards to protect your personal information:

• HTTPS encryption across all web communications
• Restricted access controls — only authorised personnel may access client data
• Secure password-protected systems and encrypted file storage
• Confidentiality agreements with all staff, contractors, and third-party service providers
• Regular security assessments and staff awareness training

In the event of a data breach that poses a risk to your rights and freedoms, we will notify both you and the Information Regulator as soon as reasonably possible, as required by POPIA section 22.

9. Third-Party Sharing & Operators

We do not sell, rent, or trade your personal information. We may disclose personal information to the following third parties, only where necessary and subject to appropriate safeguards:

• SARS — for tax submissions and queries, as required by law
• CIPC — for company registration and annual returns
• Financial Intelligence Centre — for FICA compliance reporting
• Cloud accounting software providers (Sage, Xero) — as operators processing data on our behalf under written agreements
• Website and email hosting providers — as operators bound by data processing terms
• Law enforcement or courts — only where required by law or court order

All operators (third parties who process personal information on our behalf) are contractually required to process personal information only on our instructions and to implement adequate security measures.

10. Cross-Border Transfers

In terms of POPIA section 72, personal information may only be transferred to a third party in a foreign country if that country has adequate data protection laws, or if you have consented, or if the transfer is necessary for the performance of a contract. Our cloud software providers (Sage, Xero) may store data on servers outside South Africa. We have assessed that these providers meet adequate data protection standards comparable to POPIA.

11. Complaints Procedure

If you believe that Ditheko Accountants has violated your rights under POPIA, you may:

• Step 1: Submit a written complaint to our Information Officer at privacy@ditheko.com. We will investigate and respond within 30 calendar days.
• Step 2: If your complaint is not resolved to your satisfaction, you may escalate to the Information Regulator of South Africa.

Information Regulator contact details:

• Website: www.inforegulator.org.za
• Email (complaints): PAIAComplaints@inforegulator.org.za
• Email (general enquiries): inforeg@justice.gov.za
• Tel: 012 406 0112

12. Updates to this Statement

We review and update this POPIA compliance statement periodically to reflect changes in our processing activities or South African data protection law. The "Last Updated" date at the top of this page will reflect any amendments. Material changes will be communicated where reasonably possible.