POPIA Privacy Notice

1. Purpose of This Notice

Fahmay Advisory Group respects the constitutional right to privacy and is committed to processing personal information responsibly. This Notice explains how we process personal information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”).

2. Responsible Party

3. What Is Personal Information?

Personal information includes information relating to an identifiable, living natural person and, where applicable, an identifiable existing juristic person. It may include names, identification information, contact details, financial information, tax information, employment information, business information, correspondence, electronic identifiers, location information, transaction information and other information capable of identifying a person.

4. Categories of Data Subjects

• Clients
• Prospective clients
• Directors, members, shareholders, employees and authorised business representatives
• Suppliers and service providers
• Website visitors
• Employees and applicants, where applicable
• Other persons whose personal information we lawfully process

5. Categories of Personal Information

• Identity and contact information.
• Demographic information where relevant.
• Business and company information.
• Financial, accounting and tax information.
• Employment and payroll information where relevant.
• Correspondence and enquiry information.
• Technical and electronic information.
• Transaction information.
• Other information necessary for legitimate professional or legal purposes.

6. Special Personal Information

Where required for legitimate professional or legal purposes, we may process information that falls within POPIA’s categories of special personal information. Such processing will occur only where a lawful basis exists and applicable POPIA requirements are satisfied.

7. Purposes of Processing

• Providing accounting, bookkeeping, tax, VAT, payroll, financial reporting, business advisory and related professional services.
• Company registration, audit support and compilation engagements where applicable.
• Responding to enquiries, arranging consultations and preparing quotations.
• Client administration, invoicing and payment administration.
• Communicating with clients and managing professional relationships.
• Complying with legal, tax, professional and regulatory obligations.
• Maintaining records and managing disputes or legal proceedings.
• Preventing fraud and protecting our systems.
• Improving services and website functionality.
• Other purposes communicated to data subjects and permitted by law.

8. Conditions for Lawful Processing

We are committed to applying POPIA’s principles of accountability, processing limitation, purpose specification, further-processing limitation, information quality, openness, security safeguards and data-subject participation.

9. Lawful Basis

We may process personal information where the data subject has consented; processing is necessary to perform a contract or take pre-contractual steps; processing is necessary to comply with a legal obligation; processing protects a legitimate interest; processing is necessary to pursue a legitimate interest that does not unfairly prejudice the data subject; or another lawful basis under POPIA applies.

10. Voluntary and Mandatory Information

Some information may be necessary to provide services, verify identity, comply with legislation, prepare tax returns, perform accounting functions, issue invoices or fulfil contractual obligations. Where information is mandatory for a service or legal obligation, we will provide appropriate notice where reasonably practicable. Failure to provide required information may prevent us from providing certain services.

11. Disclosure to Third Parties

We may lawfully disclose personal information to SARS, CIPC, regulatory bodies, auditors, legal/professional advisers, technology providers, cloud and email providers, payment/payroll providers, authorised service providers, law-enforcement bodies and courts where reasonably necessary.

12. Operators

Where an external service provider processes personal information on our behalf, we will take reasonable steps to ensure that the provider processes information only for authorised purposes, maintains confidentiality, implements appropriate security measures and complies with applicable legal requirements.

13. Cross-Border Transfers

Personal information may be transferred outside South Africa when we use international technology or service providers. We will take reasonable steps to ensure that such transfers comply with POPIA.

14. Security Measures

We will implement reasonable technical and organisational safeguards appropriate to the information processed. Measures may include access controls, authentication, secure storage, encryption where appropriate, restricted access, backups, monitoring, security updates, confidentiality obligations and incident-management procedures.

15. Personal Information Security Compromise

If we reasonably believe personal information has been accessed or acquired by an unauthorised person, we will investigate, contain and remediate the incident and notify the Information Regulator and affected data subjects where required by POPIA.

16. Retention

Personal information will be retained only for as long as reasonably necessary or legally required. Retention periods may differ based on the type of information, service, contractual requirements, tax/accounting requirements, professional obligations and legal proceedings.

17. Data Subject Rights

• Access to personal information, subject to applicable legal limitations.
• Correction or updating of inaccurate or incomplete information.
• Deletion where a lawful basis for continued retention does not exist and deletion is legally permissible.
• Objection to certain processing.
• Withdrawal of consent where consent is the lawful basis.
• Objection to direct marketing.
• Complaint to us and, where appropriate, the Information Regulator.
• Other rights provided by POPIA.

18. Requests

Requests should be directed to:

We may require reasonable information to verify the identity of the person making a request. Requests will be handled in accordance with applicable legal requirements and procedures.

19. Complaints

If you believe we have processed your personal information unlawfully, please contact us first so that we can investigate. You may also lodge a complaint with the Information Regulator of South Africa where applicable. The Regulator’s current contact details and complaint process should be verified before publication.

20. Changes to This Notice

We may update this Notice periodically. The latest version will be made available on the website.

21. Contact