This POPIA Compliance Statement explains how Thangana Group processes and protects personal information in line with the Protection of Personal Information Act, 4 of 2013 (POPIA) and other applicable South African laws. It should be read together with our Privacy Policy, which provides more detailed information about the personal information we collect and use.
Thangana Group acts as a responsible party when we determine the purpose and means of processing personal information, and as an operator when we process information on behalf of our clients. This statement applies to all personal information we handle in the course of providing our tax, compliance, training and related services.
Thangana Group acts as a responsible party when we determine the purpose and means of processing personal information, and as an operator when we process information on behalf of our clients. This statement applies to all personal information we handle in the course of providing our tax, compliance, training and related services.
Thangana Group is committed to lawful, reasonable and transparent processing of personal information. We only collect information that is relevant and necessary for the services we provide and we use it for legitimate, clearly defined purposes.
We strive to:
We strive to:
- Process personal information fairly and in a manner that does not infringe your privacy rights.
- Keep personal information accurate, complete and up to date where reasonably practicable.
- Store personal information securely and protect it against loss, unauthorised access, damage or misuse.
- Respect and enable the rights of data subjects under POPIA.
- Embed privacy and data protection into our day-to-day operations, staff training and client engagements.
Thangana Group has appointed an Information Officer in accordance with POPIA. The Information Officer is responsible for overseeing our compliance with data protection requirements and for acting as the main point of contact for POPIA-related queries.
The Information Officer and any authorised delegates are responsible for:
All employees, contractors and service providers who handle personal information on behalf of Thangana Group are required to follow our data protection policies and to protect personal information at all times.
The Information Officer and any authorised delegates are responsible for:
- Developing, implementing and reviewing data protection policies and procedures.
- Ensuring staff receive appropriate training and guidance on POPIA.
- Monitoring compliance with this POPIA Compliance Statement and our Privacy Policy.
- Coordinating and overseeing responses to data subject requests.
- Managing the investigation, documentation and reporting of data breaches where required.
- Liaising with the Information Regulator and other authorities where necessary.
All employees, contractors and service providers who handle personal information on behalf of Thangana Group are required to follow our data protection policies and to protect personal information at all times.
We use a combination of administrative, technical and physical safeguards to protect personal information:
Administrative measures
Technical measures
Physical measures
Our team receives training and guidance on how to handle personal information securely and in accordance with POPIA and our internal policies.
Administrative measures
- Policies and procedures governing the collection, use, retention and destruction of personal information.
- Confidentiality obligations in employment contracts and agreements with service providers.
- Access to client and employee records restricted to authorised personnel who need the information to perform their duties.
Technical measures
- Password protection and user access controls on systems that store personal information.
- Regular software updates and use of reputable solutions for email, storage and security.
- Backups of key records and reasonable measures to prevent data loss or corruption.
Physical measures
- Secure storage of physical files and documents, with controlled access.
- Reasonable measures to prevent unauthorised access to our offices and equipment.
Our team receives training and guidance on how to handle personal information securely and in accordance with POPIA and our internal policies.
Under POPIA, and subject to certain lawful grounds for processing, you may have the right to:
We may require you to verify your identity and, where permitted by law, to pay a reasonable fee for access requests. More detail about your rights and how to exercise them is provided in our Privacy Policy.
To exercise your rights, please use the contact details in the “Contact Details for POPIA Queries” section below.
- Request confirmation of whether we hold personal information about you.
- Request access to the personal information we hold about you.
- Request the correction or update of inaccurate, incomplete or outdated information.
- Request the deletion or destruction of personal information where POPIA allows this.
- Object to certain forms of processing, including direct marketing.
- Withdraw consent, where processing is based on your consent.
We may require you to verify your identity and, where permitted by law, to pay a reasonable fee for access requests. More detail about your rights and how to exercise them is provided in our Privacy Policy.
To exercise your rights, please use the contact details in the “Contact Details for POPIA Queries” section below.
Thangana Group treats any suspected or actual compromise of personal information seriously. When we become aware of a possible data breach, we will:
If you believe that your personal information may have been compromised while under our control, please notify us immediately using the contact details in the “Contact Details for POPIA Queries” section so that we can investigate.
- Promptly investigate the incident and assess the potential impact.
- Take reasonable steps to contain the incident and secure affected information.
- Document the nature of the breach, affected systems and remedial actions taken.
- Where required by POPIA, notify the Information Regulator and affected data subjects as soon as reasonably practicable.
If you believe that your personal information may have been compromised while under our control, please notify us immediately using the contact details in the “Contact Details for POPIA Queries” section so that we can investigate.
If you have any questions about this POPIA Compliance Statement, our Privacy Policy or how we handle personal information, or if you wish to exercise your data subject rights, please contact our Information Officer using the details provided on our Contact page.
For more detailed information about our processing activities, please refer to our Privacy Policy.
We may update this POPIA Compliance Statement from time to time to reflect changes in our practices or legal requirements. The latest version will always be available on this website.
For more detailed information about our processing activities, please refer to our Privacy Policy.
We may update this POPIA Compliance Statement from time to time to reflect changes in our practices or legal requirements. The latest version will always be available on this website.