Privacy Policy

Last updated: 25 September 2026

1. Introduction

Thabethe Accountants (“Thabethe Accountants”, “we”, “us” or “our”) respects the privacy and confidentiality of personal information entrusted to us.

This Privacy Policy explains how we may collect, use, store, disclose and protect personal information when individuals:

• Visit www.thabetheac.co.za

• Submit an enquiry or consultation request;

• Communicate with us;

• Become or act on behalf of a client;

• Supply information in connection with accounting, taxation, payroll, compliance, financial reporting or advisory services; or

• Otherwise interact with Thabethe Accountants.

We process personal information in accordance with applicable South African law, including the Protection of Personal Information Act 4 of 2013 (“POPIA”).

2. Responsible Party

For purposes of POPIA, Thabethe Accountants will act as the responsible party where it determines the purpose and means by which personal information is processed.

Where we process personal information on behalf of a client under a professional engagement, our role and responsibilities may also be determined by the nature of that engagement and applicable law.

3. Personal Information We May Process

Depending on your interaction with us, personal information may include:

Identification information

• Name and surname;

• Identity or registration information where legitimately required;

• Job title or position;

• Employer or organisation details.

Contact information

• Email address;

• Telephone or mobile number;

• Business address;

• Physical or postal address.

Business information

• Company or entity information;

• Registration details;

• Directorship or ownership information;

• Business records;

• Financial and operational information.

Accounting and financial information

Where relevant to a professional engagement, this may include:

• Accounting records;

• Invoices and supporting documents;

• Financial statements;

• Bank-related information;

• Asset and liability information;

• Transactional records;

• Payroll information;

• Financial reporting information.

Tax and statutory information

Where relevant, this may include:

• Taxpayer information;

• Tax reference information;

• VAT information;

• PAYE-related information;

• Information required for SARS submissions or correspondence;

• Information relating to other statutory or regulatory submissions.

Employee information

Where a client engages us to provide payroll or related services, we may process personal information concerning the client’s employees where authorised and necessary for the relevant service.

Communications

We may retain correspondence, enquiries, instructions and other communications exchanged with us.

Website and technical information

Depending on the technologies used on the Website, information may include:

• IP address;

• Browser information;

• Device information;

• Website interaction data;

• Cookies or similar technical identifiers; and

• Security and access information.

4. How We Obtain Personal Information

We may obtain personal information:

• Directly from you;

• From a client who is authorised to provide the information;

• From an employer or organisation you represent;

• Through Website forms;

• During a professional engagement;

• Through correspondence and communications;

• From public records or lawful public sources;

• From regulatory or statutory bodies where lawfully available;

• From service providers acting on our behalf; or

• From other lawful sources relevant to a professional engagement.

Where information concerning another individual is supplied to us, the person supplying it is responsible for having appropriate authority or another lawful basis to provide that information where required.

5. Purposes for Processing Personal Information

Personal information may be processed for legitimate and lawful business and professional purposes, including:

• Responding to enquiries;

• Assessing requests for professional services;

• Establishing and managing client relationships;

• Performing agreed accounting and bookkeeping services;

• Providing payroll and secretarial services;

• Providing tax and SARS compliance services;

• Preparing financial reports or financial statements;

• Providing IFRS or financial-reporting advisory services;

• Supporting regulatory and statutory compliance;

• Communicating with clients and authorised representatives;

• Verifying identities where necessary;

• Maintaining client and business records;

• Managing billing, administration and payments;

• Meeting legal, regulatory, tax and professional obligations;

• Protecting the security and integrity of our systems;

• Preventing or investigating unlawful activity;

• Managing legal claims or disputes;

• Operating and administering the Website; and

• Communicating information about our services where permitted by applicable law.

We will not knowingly process personal information for purposes incompatible with the purpose for which the information was originally collected unless permitted by law.

6. Lawful Processing

Thabethe Accountants processes personal information only where there is an appropriate basis recognised under applicable law.

Depending on the circumstances, processing may occur because:

• The data subject has consented;

• Processing is necessary for the conclusion or performance of an agreement;

• Processing complies with a legal obligation;

• Processing protects a legitimate interest of the data subject;

• Processing is necessary for the proper performance of a public-law duty where applicable; or

• Processing is necessary to pursue the legitimate interests of Thabethe Accountants or a third party, subject to the rights of the data subject.

Where consent is relied upon, consent may be withdrawn subject to applicable law and any lawful consequences of the withdrawal.

7. Special Personal Information

Certain professional engagements may involve information that qualifies as special personal information under POPIA.

Where such information is processed, it will only be processed where an appropriate legal basis or authorisation exists and where it is necessary for the relevant lawful purpose.

8. Sharing of Personal Information

Thabethe Accountants does not sell personal information.

Personal information may, where necessary and legally permitted, be disclosed to:

• Employees or authorised personnel who require access for legitimate purposes;

• Operators and technology or professional service providers acting on our behalf;

• SARS and other relevant statutory authorities;

• CIPC or other regulatory bodies where applicable;

• Professional advisers;

• Auditors, independent reviewers or assurance providers where relevant and authorised;

• Courts, regulators, law-enforcement agencies or other authorities where disclosure is required or permitted by law; or

• Other parties where the data subject has authorised disclosure.

Any operator processing personal information on our behalf is expected to process the information only for authorised purposes and subject to appropriate confidentiality and security requirements.

9. Cross-Border Processing

Where personal information is transferred outside South Africa, any such transfer will be handled subject to applicable requirements governing transborder information flows, including POPIA.

Where relevant, appropriate safeguards, contractual protections, consent or another legally recognised basis will be applied.

This provision does not mean that all personal information is necessarily transferred outside South Africa.

10. Information Security

Thabethe Accountants takes reasonable and appropriate technical and organisational measures intended to protect personal information against:

• Loss;

• Unauthorised access;

• Unlawful processing;

• Destruction;

• Alteration;

• Disclosure; and

• Misuse.

Access to personal information is limited according to legitimate operational and professional requirements.

No electronic system or method of internet transmission can, however, be guaranteed to be completely secure.

11. Personal Information Breaches

Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, Thabethe Accountants will address the incident in accordance with applicable legal obligations, including notification requirements where applicable.

12. Retention of Information

Personal information will be retained only for as long as reasonably necessary for the purpose for which it was collected or subsequently processed, subject to:

• Legal requirements;

• Tax and financial-record obligations;

• Professional requirements;

• Contractual obligations;

• Legitimate business requirements; and

• The establishment, exercise or defence of legal claims.

Where information is no longer lawfully required, it will be securely destroyed, deleted or de-identified where appropriate.

13. Accuracy of Personal Information

We take reasonable steps to ensure that personal information under our control is sufficiently accurate, complete and updated where necessary for the purposes for which it is processed.

Clients and data subjects are encouraged to notify us when relevant personal information changes or is incorrect.

14. Your Rights

Subject to POPIA and other applicable legislation, a data subject may have the right to:

• Ask whether we hold personal information about them;

• Request access to personal information;

• Request correction of inaccurate or incomplete information;

• Request deletion or destruction of information where legally permissible;

• Object to certain processing;

• Withdraw consent where processing is based on consent;

• Object to direct marketing;

• Request information about third parties or categories of third parties to whom personal information has been disclosed where applicable; and

• Lodge a complaint with the Information Regulator.

Certain access requests may be dealt with under PAIA and the applicable PAIA procedures.

These rights are subject to limitations and exceptions provided for in law.

15. Direct Marketing

Where Thabethe Accountants sends electronic direct marketing communications, such communications will be managed in accordance with applicable South African requirements.

Recipients may request that qualifying direct marketing communications cease.

A request to stop marketing communications does not necessarily prevent communications required for an existing professional engagement, legal obligation, account administration or another lawful non-marketing purpose.

16. Cookies and Website Technologies

The Website may use cookies or similar technologies necessary for functionality, security, performance or website analytics.

Cookies are small pieces of information stored through a user’s browser or device.

Depending on the configuration of the Website, users may be able to manage certain cookies through their browser settings or available Website controls.

Disabling some cookies may affect parts of the Website’s functionality.

17. Third-Party Websites

Our Website may contain links to external websites.

Thabethe Accountants is not responsible for the privacy practices of third-party websites, and users should review the privacy notices applicable to those services.

18. Children’s Personal Information

The Website is primarily intended for persons seeking business or professional accounting-related services.

We do not intentionally use the Website to solicit personal information directly from children.

Where children’s personal information forms part of information legitimately processed during a professional engagement, it will be processed only where authorised or otherwise permitted by law.

19. PAIA and Access to Records

Requests for access to records held by Thabethe Accountants may be governed by the Promotion of Access to Information Act 2 of 2000 (PAIA).

The firm’s PAIA Manual should be consulted for information regarding available records and the procedure for submitting a PAIA request.

20. Complaints to the Information Regulator

A person who believes their personal information has been processed contrary to POPIA may contact Thabethe Accountants so that the matter can be assessed.

A data subject also has the right to lodge a complaint with the Information Regulator of South Africa in accordance with the procedures made available by the Regulator.

Current contact and complaint-submission details for the Information Regulator are available from the Regulator’s official website.

21. Changes to This Privacy Policy

This Privacy Policy may be updated periodically to reflect legal, regulatory, technological or operational developments.

The current version will be made available on the Website together with its latest revision date.

22. Privacy Contact

Privacy-related enquiries, objections, correction requests or other POPIA-related requests may be addressed to:

Information Officer
Thabethe Accountants
Suite N, 4th Floor
Menlyn Corporate Park
175 Corobay Avenue
Pretoria, South Africa

Email: info@thabetheac.co.za
Website: https://thabetheac.co.za