Privacy Policy

Who we are

TAXFIN ACCOUNTING SOLUTIONS (PTY) LTD (registration 2022/801431/07) is a South African accounting and tax practice based in Hoedspruit, Limpopo, 1380. We determine the purposes and means of processing for our practice administration, website enquiries and service management under the Protection of Personal Information Act, 2013 (POPIA). Where we process records on a client’s instructions, the client may be the responsible party and TaxFin its operator; the role depends on the engagement and processing involved. For privacy requests, use our existing support route: info@taxfinaccounting.co.za.

Information we process

• Account and sign-in data: name, email address, role, sign-in and security records (including multi-factor authentication status) for practice staff and client portal users.
• Client records: company and individual details such as registration or ID numbers, tax reference numbers, addresses, directors, shareholders and beneficial owners.
• Accounting and tax data: ledgers, invoices, bills, bank statements and transactions, financial statements, and tax return and filing records.
• Payroll data: employee names and numbers, pay, deductions, PAYE, UIF, SDL and related certificates, processed for clients who use our payroll services.
• Documents and communications: files uploaded by staff or clients, emails linked to client work in connected mailboxes, and WhatsApp messages and attachments linked to authorised client work.
• Technical data: logs, device and browser information used to keep the service secure and working.

Where information comes from and your choices

We receive information from you, authorised client representatives and staff, documents you provide, connected accounting and payroll systems, authorised bank feeds, and communications relevant to client work.

Our website enquiry form collects your name, email address and message, with optional phone and company details. We store the enquiry and send a notification to the practice to respond. Providing an enquiry is voluntary; without the required contact and message details we cannot respond through that form. Please do not put passwords, one-time codes or sensitive financial documents in an enquiry.

Information needed for an engagement, statutory filing or record-keeping obligation depends on the service. If required information is withheld, we may be unable to complete that work. Optional integrations are separate from submitting an enquiry.

The website uses browser storage for functions including sign-in sessions and limiting repeated enquiry submissions. Clearing browser storage can sign you out or reset local preferences.

Why we use it

To deliver the accounting, tax, payroll, secretarial and advisory services our clients engage us for; to meet our legal, professional and record-keeping obligations; to secure accounts and prevent misuse; and to communicate with clients about their work. We process information on the basis of our contract with clients, legal obligations, and our legitimate interest in running a secure practice.

Authorised bank feeds

For existing clients, bank feeds support accounting and reconciliation by collecting account details, balances, statements and transactions. Where an authorised browser feed is used, a hosted browser accesses the bank’s online portal on the client’s behalf. This uses bank login credentials and session information; it is not a bank-native OAuth connection.

The bank connection requires a recorded client mandate. A client mandate does not replace any permission required under the bank’s terms. For an in-app connection, we receive and store the bank login credentials, with the password encrypted at rest. The credentials are used when needed to sign in through our hosted browser provider, Browserless. Bank login and session information are sensitive and are used to maintain the authorised feed.

You can ask us to stop a feed and remove its stored login, or use the available disconnect control. Local disconnection does not change your bank password or revoke access independently at the bank or another provider. Bank records already obtained remain subject to applicable retention obligations. Never send bank passwords or one-time codes by email, WhatsApp or the website enquiry form.

ChatGPT and AI assistants

When an authorised TaxFin user connects TaxFin Pro to ChatGPT or another AI assistant, connector requests use that signed-in user’s identity and TaxFin permissions. Connecting an assistant does not itself authorise access to another client or service.

Connector tools are designed to limit returned information to the request. For example, payroll tools leave out provider identifiers and raw provider records. Passwords, access tokens and stored credentials are not information you should share with an AI assistant. Actions that change records, send email or post to a ledger require the applicable approval. Tax and statutory submissions require their separate authorised filing process.

Information you share in an AI assistant is also governed by that provider’s own terms and privacy policy.

WhatsApp messaging

TaxFin Messaging connects TaxFin Pro to the WhatsApp Business Platform operated by Meta. When you communicate with us through WhatsApp, we process your phone number or WhatsApp identifier, profile name where supplied, message contents, attachments, message identifiers, timestamps, delivery and read updates, and your messaging consent or opt-out preferences.

Where you have agreed to receive WhatsApp communications, we may use this channel for invoices, statements, document requests, reminders and confirmations about your work. Messages and attachments pass through Meta's WhatsApp services and our connected hosting and storage providers. Authorised practice staff can view records linked to the clients and services they are permitted to access.

You can reply STOP to withdraw consent to further outgoing WhatsApp messages, or contact us by email to change your communication preference. Withdrawing WhatsApp consent does not delete accounting or other records we must retain. To request access, correction or deletion, email info@taxfinaccounting.co.za; we will confirm your identity and explain any records that must be retained.

WhatsApp's own handling of information is described in its Privacy Policy. The current TaxFin integration is a restricted internal pilot; wider client messaging is not enabled.

Who we share it with

We do not sell personal information. We share it only as needed to provide the service, with categories of recipients such as:

• cloud hosting, database, file storage, email delivery and WhatsApp messaging providers, including Meta;
• accounting, payroll and banking integrations that a client or the practice has connected (for example cloud accounting or payroll software and bank feeds);
• AI model providers used to read documents and draft work, which receive only the content needed for the task;
• government and regulatory bodies such as SARS, CIPC and the Department of Employment and Labour, when a client’s work requires it and it has been approved;
• professional advisers, auditors or authorities where the law requires it.

Some providers may process information outside South Africa. Section 72 of POPIA restricts these transfers: an applicable legal basis is required, such as adequate protection under law or a binding agreement, consent, or another permitted ground. Contact us to ask which recipients, countries and transfer protections apply to your service. This notice does not certify a provider’s safeguards.

How long we keep it

We keep information for as long as we need it to provide the service and to meet legal, tax, accounting, professional and security obligations. Accounting and tax records are generally kept for the periods South African law requires. Information that is no longer needed is subject to retention review for deletion or anonymisation, including any continuing legal obligation or dispute. We keep original source evidence rather than replacing it with summaries.

Security

TaxFin Pro uses role, client and service access controls. Bank passwords submitted through the in-app connection are encrypted at rest. Sensitive files are shared through short-lived links. Security and activity records support review. POPIA requires appropriate safeguards and written security arrangements where an operator processes information for a responsible party. No system is perfectly secure; if a security compromise affects your information, we will notify you and the Information Regulator as POPIA requires.

Your rights and choices

You may ask to access, correct or delete your personal information, object to certain processing, or withdraw consent where we rely on it. We will act on these requests unless a legal obligation requires us to keep the information, and will tell you if so. You may disconnect the ChatGPT connector at any time from your AI assistant’s settings.

Send requests to info@taxfinaccounting.co.za. You may also complain to the Information Regulator (South Africa). Its POPIA guidance and forms include objection, correction/deletion and complaint forms. General enquiries: enquiries@inforegulator.org.za; telephone 010 023 5200.

Access to records (PAIA)

For a request for access to records under the Promotion of Access to Information Act, 2000 (PAIA), contact our support route above so that the request can be directed to the appropriate person. The Information Regulator publishes PAIA legislation and guidance. This privacy notice is not a PAIA manual.

Changes

We may update this policy. The date above shows the latest version.