This Privacy Policy explains how Thangana Group collects, uses, stores and protects personal information when you visit our website or engage our services.
We are a South African firm and we aim to align our practices with the Protection of Personal Information Act, 2013 (POPIA) and generally accepted privacy principles.
This Policy applies to website visitors, prospective clients and existing clients whose information we process in the course of providing tax, accounting, training and related advisory services.
For more detail on our internal governance of personal information, please also refer to our POPIA Compliance page.
Depending on how you interact with us, we may collect the following categories of information:
- Basic contact details: name, surname, email address, phone number and preferred method of contact.
- Identification and profile details: ID or passport number, date of birth, tax number, company registration details and director information where relevant.
- Financial and tax-related information: payroll information, income and expense details, bank account details for payment processing, SARS correspondence, VAT records and supporting documentation.
- Business information: company name, trading name, business address, industry, shareholder and officer details and other compliance-related documents.
- Communication records: messages sent via our website forms, email, phone calls, messaging platforms and meeting notes.
- Website usage data: limited technical information such as IP address, browser type, pages visited and timestamps, typically collected through cookies or analytics tools.
We collect information directly from you, from publicly available sources where lawful and, where appropriate, from third parties such as SARS or your previous accountant, with your knowledge or consent where required.
We use personal information only for lawful purposes connected to our professional services and the operation of our business, including to:
- Respond to enquiries, provide quotes and schedule consultations.
- Deliver our services, such as preparing personal and corporate tax returns, VAT submissions, training and company registrations.
- Verify your identity and maintain accurate client records.
- Communicate with you about your mandates, deadlines, regulatory changes and other important updates.
- Issue invoices, process payments and maintain financial records.
- Comply with legal, regulatory and professional obligations, including our duties towards SARS and other regulators.
- Improve our services, website and client experience through analytics and feedback.
- Send you relevant news, resources or marketing communications, where the law allows and where you have not opted out.
We will not sell your personal information, and we do not use it for unrelated purposes without a lawful basis and, where required, your consent.
We process personal information in line with POPIA’s conditions for lawful processing and, where applicable, other recognised privacy standards. Depending on the context, our legal basis may include:
- Your consent: for example, when you ask us to contact you, sign up to receive resources or agree to certain marketing communications.
- Performance of a contract or to take steps at your request before entering into a contract: such as when you engage us to provide tax, accounting or training services.
- Compliance with legal and regulatory obligations: including obligations under tax, company, anti-money laundering and other applicable laws.
- Legitimate interests: where we use your information in a way that is necessary for our business, reasonably expected and does not unfairly infringe your privacy rights, for example to manage our practice, improve services or protect our legal rights.
Where we rely on consent, you may withdraw it at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawal of consent may affect our ability to provide certain services.
We treat your information as confidential and only share it when it is necessary, lawful and appropriate. This may include sharing with:
- Relevant authorities and regulators such as the South African Revenue Service (SARS), the Companies and Intellectual Property Commission (CIPC) and other bodies where required for filings, registrations or compliance.
- Trusted service providers who support our operations, such as IT, cloud hosting, document management, email, analytics and professional advisors, under confidentiality and data protection obligations.
- Banks, payment processors and similar institutions to process payments and refunds.
- Other third parties where you instruct us to share information or where we are legally compelled to do so.
We do not permit our service providers to use your information for their own independent purposes. When information is transferred or accessed outside South Africa, we take steps to ensure that appropriate safeguards are in place where required by law.
We take reasonable, appropriate technical and organisational measures to protect personal information against loss, misuse, unauthorised access, disclosure, alteration or destruction.
These measures may include secure systems and devices, access controls, password protection, staff awareness, regular backups and limiting access to personal information to people who need it to perform their duties.
We keep personal information only for as long as it is needed for the purposes for which it was collected and to meet legal, regulatory, tax, accounting or reporting requirements. In general:
- Client and matter records are kept for the retention periods required or recommended under tax and company law and professional rules.
- Financial and billing records are kept for the periods required under applicable tax and financial legislation.
- Enquiry and marketing-related information is kept for a shorter period and reviewed regularly, with an option for you to opt out.
When information is no longer needed, we take reasonable steps to delete, destroy or de-identify it in a secure manner.
As a data subject, you have certain rights regarding your personal information, subject to applicable law. These may include the right to:
- Ask whether we hold personal information about you and request access to that information.
- Request that we correct or update inaccurate, incomplete or outdated information.
- Request deletion or restriction of your information where there is no lawful reason for us to keep or use it further.
- Object, on reasonable grounds, to certain types of processing, including direct marketing.
- Withdraw consent where processing is based on your consent, without affecting processing that has already happened lawfully.
- Lodge a complaint with the Information Regulator if you believe your rights have been infringed.
To exercise your rights or to obtain more detail on how we handle requests, please contact us using the details in the Contact Details & Updates section or refer to our POPIA Compliance page.
Our website may use cookies and similar tools to help it function properly and to understand how visitors use our pages.
Cookies are small files placed on your device that remember certain information about your visit, such as your preferences or which pages you viewed. We use them mainly to improve performance, keep the site secure and see which content is most useful to visitors.
You can usually choose to accept, refuse or delete cookies through your browser settings. If you disable cookies, some parts of the site may not work as intended, but you will still be able to access key information about our services.
We do not use cookies to profile individual visitors in a way that produces legal or significant effects about them.
If you have any questions about this Privacy Policy or how we handle personal information, please contact us via the details on our Contact page or by using the enquiry form provided there.
When you contact us, please provide enough information for us to identify you and understand your request. We may need to verify your identity before we can respond to certain requests.
We may update this Privacy Policy from time to time to reflect changes in our services, practices or legal requirements. The updated version will be posted on this page with an updated effective date.
This Privacy Policy was last updated on 1 January 2025.