Privacy notice.

This notice explains how swan786 ventures collects, uses, shares, stores and protects personal information. It is issued in terms of the Protection of Personal Information Act 4 of 2013 ("POPIA") and should be read with our terms of engagement.

It applies to visitors to this website, to our clients, and to the people whose information our clients ask us to process — most often their employees, directors, customers and suppliers.

It is written to be read rather than to be survived. Where a term has a specific meaning under POPIA, we use it in that sense.

"Personal information" is any information that identifies a living person or an existing company — a name, an identity number, a tax number, an email address, banking details, employment history, and a great deal else besides.

A "responsible party" decides why and how personal information is processed. An "operator" processes it on behalf of a responsible party, on that party's instruction, without deciding the purpose.

Which of the two we are depends on the information. For our own business records and for enquiries through this site we are the responsible party. For your accounting and payroll records we are your operator, and you remain the responsible party.

Every responsible party in South Africa must designate an Information Officer, who is registered with the Information Regulator and is accountable for compliance with POPIA and with the Promotion of Access to Information Act 2 of 2000 ("PAIA").

Our Information Officer can be reached at swan786ventures@gmail.com. Please mark the subject line "POPIA" so it is routed correctly.

Requests for access to records held by us are dealt with under PAIA. A formal request is made on the prescribed form and, where a fee is payable, we will tell you the amount before doing the work.

If you submit the enquiry form we receive your name, your business name, your email address, your telephone number, the nature of the enquiry, how far behind your books are, and anything else you choose to write in the message.

The form does not send itself. You choose the channel — WhatsApp, Gmail, Outlook or your own mail client — and the message is handed to that application. Where a copy is also posted to our enquiry endpoint, that copy contains only what you entered.

This site sets no advertising, analytics or tracking cookies, runs no third-party scripts, and embeds nothing from another domain. We do not build profiles of visitors and we do not sell or share anything with data brokers.

Our hosting provider processes standard server logs, including IP addresses, for security and delivery. Those logs are not used to identify individuals.

During an engagement we process the records the work requires: bank and card transaction data, tax invoices issued and received, supplier and customer details, payroll and employee records, loan account movements, identity numbers and tax reference numbers where a statutory return requires them, and supporting documents.

We process this as your operator, on your documented instruction, only for the purposes of the engagement. We do not use client data for our own purposes, and we do not use it to train anything.

Where an engagement includes payroll we necessarily process the personal information of your employees: identity numbers, tax numbers, banking details, remuneration, and where relevant medical aid and retirement fund membership. Some of that is "special personal information" under POPIA, and it is processed only because a statutory return — EMP201, EMP501, IRP5, IT3(a), UIF or COIDA — obliges it.

Your employees may exercise their POPIA rights through you as their employer, or directly with us. Either route works.

POPIA requires a lawful basis for every processing activity. Ours are these.

Performance of a contract — processing your records is the engagement. There is no way to keep a ledger without processing what is in it.

Compliance with a legal obligation — VAT, PAYE, UIF, SDL, COIDA and CIPC filings are required by law, and each requires specific personal information to complete.

Legitimate interests — responding to an enquiry you sent us, keeping our own business records, and protecting our systems.

Consent — where none of the above applies. Consent given can be withdrawn at any time, and withdrawing it does not make earlier processing unlawful.

Revenue and regulatory authorities, where a statutory return requires it: the South African Revenue Service, the Companies and Intellectual Property Commission, the Department of Employment and Labour, and the Compensation Fund.

Parties you nominate — most commonly your accountant, auditor, accounting officer, bank, funder or attorney. We act on your instruction and do not volunteer your records to anyone.

The software providers that host the ledger, the payroll and the document capture, each under a written operator agreement requiring them to process only on instruction and to secure what they hold.

We do not sell personal information, we do not rent mailing lists, and we do not disclose anything to any other authority unless legally compelled. Where we are compelled, we will tell you unless the law prohibits us from doing so.

Several of the accounting, payroll and document-capture platforms used in this work store data on servers outside South Africa. Section 72 of POPIA permits a transfer across the border where the recipient is subject to a law or binding agreement giving broadly comparable protection, where you have consented, or where the transfer is necessary to perform the contract with you.

We rely on the contractual protections in our agreements with those providers, and on the necessity of the transfer to do the work you engaged us for.

The specific platforms used on your engagement, and the regions in which they host data, are named in your engagement letter.

Section 19 of POPIA requires appropriate, reasonable technical and organisational measures. Ours are: read-only bank access wherever your institution supports it; multi-factor authentication on every system, including SARS eFiling and CIPC; encrypted document exchange; access limited to the people on your engagement; and no client records held on local machines or removable media.

Access is reviewed when a person joins or leaves an engagement, and is revoked in full on the day an engagement ends.

No system is beyond compromise. Where a security compromise affects your personal information we will notify you and the Information Regulator as soon as reasonably possible after establishing what happened, as section 22 requires, and tell you what was affected and what to do about it.

Enquiry correspondence that does not lead to an engagement is deleted once it is clearly no longer relevant.

Client accounting records are kept for the periods the law requires. The Companies Act 71 of 2008 requires accounting records to be retained for seven years. The Tax Administration Act 28 of 2011 generally requires records supporting a return to be retained for five years from the date the return was submitted, and longer where an audit, objection, appeal or investigation is open.

Where a record is subject to more than one period, we keep it for the longer one. After that it is destroyed or de-identified.

When an engagement ends your data is exported to you in full, together with a handover memo, and our copies are retained only for the statutory periods above.

You may ask us to confirm, free of charge, whether we hold personal information about you, and to provide a description of it.

You may request a copy of that information. A prescribed fee may apply to the copy, and we will tell you the amount before we do the work.

You may ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, and to destroy or delete a record we are no longer authorised to retain.

You may object, on reasonable grounds, to processing that relies on legitimate interests, and you may withdraw a consent you previously gave.

You may object at any time to your information being used for direct marketing, and we will stop.

Send any of these to swan786ventures@gmail.com. We respond within a reasonable period and in any event within the timeframes POPIA and PAIA allow.

Section 69 of POPIA restricts unsolicited electronic marketing. We do not run marketing campaigns to purchased lists and we do not send unsolicited bulk email.

If you have enquired or engaged with us, we may occasionally write to you about the service you asked about. Every such message carries a way to stop it, and stopping it costs you nothing.

If you are unhappy with how we have handled your information or a request, tell us first at swan786ventures@gmail.com. Most things are resolved quickly at that stage.

If you remain unsatisfied you may complain to the Information Regulator (South Africa). POPIA complaints go to POPIAComplaints@inforegulator.org.za and PAIA complaints to PAIAComplaints@inforegulator.org.za. Current contact details and complaint forms are published at inforegulator.org.za.

We update this notice when the law changes or when what we do with information changes. The date below is the date of the version you are reading.

Material changes affecting existing clients are communicated directly rather than left to be noticed.