Privacy Policy

2. What Information We Collect

We collect personal information directly from you when you interact with our website across five functional areas:

• Contact Inquiries: Full name, email address, phone number, area of interest, and message content.
• Consultation Bookings: Full name, email address, phone number, consultation category, preferred appointment date, preferred time, and engagement context.
• Training Registrations: First name, last name, professional email address, phone/WhatsApp number, organization/employer name, job designation, and selected course.
• Document Review Submissions: Full legal name, email address, descriptive notes, and special financial documents (such as financial statements, tax documentation, payroll sheets, and banking records) that you upload for review.
• Member Network Sign-Up: Full name and professional email address.

3. Purpose and Lawful Grounds for Processing

4. Direct Marketing & Unsubscribe Rights (Section 69)

In accordance with Section 69 of POPIA, we strictly prohibit unsolicited direct marketing. You will only receive follow-up emails, educational invitations, or practice newsletters if you tick the optional, unbundled marketing consent box when submitting an enquiry.

Every marketing communication we send includes a direct, one-click Unsubscribe Link. You can also opt out at any time by visiting our Unsubscribe Portal or emailing our Information Officer. Once unsubscribed, you are immediately added to our electronic suppression list.

5. Third-Party Operators & Service Providers

We do not sell, rent, or lease your personal information. We share personal information only with trusted third-party service providers ("Operators" under Section 20 of POPIA) who assist in delivering our services:

• Infrastructure & Hosting Operator: Namecheap, Inc. provides managed cloud server and database infrastructure.
• Electronic Mail Services: Host MTA relay handles transactional acknowledgements and scheduled client notifications.

All operators are contractually bound under written Operator Agreements to process data solely on our written instructions and maintain strict confidentiality.

6. Cross-Border Transfers of Personal Information (Section 72)

Our web servers and MySQL databases are hosted on dedicated infrastructure managed by Namecheap, Inc. located in the United States. Accordingly, your personal information is transmitted and stored outside of the Republic of South Africa.

In compliance with Section 72(1) of POPIA, we ensure cross-border transfers satisfy statutory requirements through:

• Contractual Binding (§72(1)(a)): Written Data Processing Agreements requiring the operator to adhere to confidentiality and security standards substantially equivalent to POPIA.
• Informed Consent (§72(1)(b)): Transparent disclosure of hosting locations to you at the point of collection.
• Technical Safeguards (§72(1)(a)): Enforced TLS in-transit encryption, non-executable filesystem permissions, and access controls.

7. Data Retention & Destruction (Section 14)

Under Section 14 of POPIA, we retain personal information only for as long as is necessary to fulfill the purpose for which it was gathered, or as required by South African statutory law:

• Tax & Accounting Client Records: Retained for a mandatory statutory period of 5 years in terms of Section 29 of the Tax Administration Act 28 of 2011 and Section 24 of the Companies Act 71 of 2008.
• General Website Enquiries (Unconverted): Retained for a maximum of 12 months from the date of last contact, after which records are anonymized or permanently deleted.
• Administrative Security Logs: Retained for 24 months for security audit trails and rate-limiting forensics.

Upon expiry of the applicable retention schedule, electronic records and files are deleted using secure deletion protocols.

8. Security Safeguards (Section 19)

In accordance with Section 19 of POPIA, we implement appropriate, reasonable technical and organizational measures to prevent loss, damage, or unauthorized access to personal information:

• In-Transit Encryption: Mandatory TLS encryption (HTTPS 301 redirection) across all pages, forms, and administrative dashboards.
• Database Protection: Parameterized PDO prepared statements on 100% of SQL queries, eliminating SQL injection vulnerabilities.
• Upload File Security: Client uploads are stored with randomized hex filenames in an isolated folder where direct script execution is disabled (`php_flag engine off`).
• Brute-Force Rate Limiting: Administrative portals enforce automated IP-based lockout after 5 consecutive failed login attempts.
• Access Auditing: Administrative views, edits, and exports of lead records are logged in an immutable `admin_access_logs` register.

9. Your Statutory Data-Subject Rights

Under Sections 23 to 25 of POPIA, South African data subjects hold the following rights:

To exercise any of these rights, submit a formal request via our online Data Subject Request Portal or contact our Information Officer directly. We will respond within 30 calendar days.

10. Children's Privacy

Our website and services are directed strictly at businesses, adult professionals, and individuals aged 18 and older. We do not knowingly collect or process personal information relating to minors under 18 years of age without verifiable parental or guardian consent in accordance with Section 34 of POPIA.

11. Automated Decision-Making

We do not subject you to decisions based solely on automated processing or profiling that result in legal consequences or significantly affect you. All advisory evaluations and file reviews are conducted personally by qualified practitioners.