Last updated: 1 August 2026
Effective from: 1 August 2026

1. Who we are

Accounting Connect (Pty) Ltd is a South African accounting, advisory and AI implementation practice. We are the responsible party for the personal information described in this policy, as defined in the Protection of Personal Information Act, 4 of 2013 ("POPIA").

Registered name: Accounting Connect (Pty) Ltd
Registration number: 2018/528820/07
Registered office: 6 Cowley Lane, Oudtshoorn, Western Cape, 6620
Postal address: PO Box 1255, Oudtshoorn, 6620

Information Officer: Brandon Iverach
Deputy Information Officer: Willemien Nel

For all matters relating to your personal information: info@accountingconnect.ai

In this policy, "we," "us," and "our" mean Accounting Connect (Pty) Ltd. "You" means any person whose personal information we process — typically a client, prospective client, website visitor, or someone who contacts us.

2. What this policy covers

This policy explains how we collect, use, store and protect personal information when you:

visit accountingconnect.ai or accountingconnect.co.za;
submit our contact form or use any tool or calculator on our website;
engage us to provide accounting, advisory or AI implementation services;
correspond with us by email, phone, message or in person.

This policy does not cover personal information we process as an operator on behalf of our clients (for example, employee information processed when we run a client's payroll). In those cases, our client is the responsible party and their privacy policy applies. We process that information under written contract, only on the client's instructions, and protect it as required by POPIA.

This policy also does not cover personal information processed by other companies in which our directors hold interests (including property-letting companies). Those companies are separate responsible parties with their own privacy policies.

3. What information we collect

We collect only the information we need to do our work and meet our legal obligations.

From website visitors

Name, email address, company name (optional) and the message you send via our contact form.
Information you submit through any tool or calculator on the site (e.g. tax calculator inputs, name and email for receiving results).
Basic technical information your browser sends automatically (IP address, browser type, pages visited). We do not currently use analytics or tracking cookies. If we add them in future, we will update this policy and ask for your consent where required.

From clients and prospective clients

To deliver accounting, tax, payroll, advisory and AI implementation services we may collect:

Identity information: full name, ID number, passport number, date of birth.
Contact details: address, email, phone.
Tax information: SARS tax number, VAT number, income, deductions, returns and supporting documents.
Financial information: bank account details, transaction records, invoices, statements, financial records.
Company and trust information: registration numbers, beneficial ownership, director and member details, financial statements.
Employment information (where we run payroll): employee names, ID numbers, salary, banking details, tax codes.
Information required under the Financial Intelligence Centre Act, 38 of 2001 ("FICA"): proof of identity, proof of address, source of funds.

How we collect it

Directly from you, in conversation, by email, by document upload, or through forms we send you.
From third parties with your authority (for example, your previous accountant, your bank, SARS, CIPC).
From public sources where relevant (CIPC company searches, SARS verifications, deeds office searches).

We do not buy lists of personal information and we do not collect personal information from sources you would not reasonably expect.

4. Why we collect it

We collect and use your personal information for the following purposes:

To respond to enquiries. When you submit our contact form or email us, we use your information to reply.
To provide professional services. Bookkeeping, financial statements, tax returns, VAT, payroll, CIPC compliance, advisory work and AI implementation cannot be done without the information they require.
To meet legal obligations. SARS, CIPC, FICA, the Companies Act, the Tax Administration Act and similar laws require us to collect, retain and sometimes disclose specific information.
To run our business. Invoicing you, keeping records of work done, managing client relationships.
To improve our service. Understanding what works, what doesn't, and where we can do better.

We do not sell your personal information to anyone, ever. We do not use it for marketing without your consent. We do not currently send marketing emails. If that changes, we will ask for your opt-in first and you will be able to unsubscribe at any time.

5. The legal basis for processing

POPIA requires a lawful basis to process personal information. We rely on the following:

Your consent — when you submit the contact form, use a calculator, or sign an engagement letter.
Performance of a contract — to deliver the services you have engaged us to perform.
Legal obligation — to comply with tax laws, FICA, the Companies Act and similar.
Our legitimate interests — to run, protect and improve our practice, where these interests do not override your rights.

You can withdraw consent at any time by emailing info@accountingconnect.ai. Withdrawing consent does not affect processing already lawfully done. Where we are required by law to keep your information, we cannot delete it on request — we will tell you when this applies.

6. Who we share it with

We do not share your personal information with anyone except as described below.

Operators (service providers acting on our instructions)

We use carefully selected service providers to run our practice. They process personal information only on our instructions, only for purposes we specify, and under written agreement. The main ones are:

Cloud accounting platforms — Sage, Xero, QuickBooks (where used for client work).
Email and productivity — Google Workspace.
Website and database — Lovable Cloud (which uses Supabase). Hosted in the European Union.
Document storage and signing — Google Drive and similar tools.
Workflow and automation — tools like Make.com used to route information between systems.
AI providers — Anthropic (Claude) and OpenAI (ChatGPT) via secure API connections, used for specific tasks under our control. We do not allow these providers to train their models on your information.

Statutory authorities

Where the law requires it, we share information with:

SARS (tax matters);
CIPC (company secretarial and statutory filings);
FIC (suspicious transaction reporting under FICA);
Other regulators or courts where compelled by law or court order.

Other third parties only with your authority

Your bank, attorney, financial advisor, previous accountant, business partners — only where you have asked us to communicate with them.

We require everyone we share information with to protect it to the standards POPIA requires. We do not sell, rent, trade or licence personal information.

7. Where your information is stored

Your information is stored in a combination of locations:

Operational data (website submissions, day-to-day records) — stored with Lovable Cloud / Supabase, hosted in the European Union.
Email and documents — stored with Google Workspace, primarily in EU and US data centres.
Accounting records — stored on cloud accounting platforms (location varies by platform; typically EU, UK or US).
Working files — stored on encrypted devices and in cloud storage controlled by us.

Some of these locations are outside South Africa. POPIA permits cross-border transfers where the receiving country has comparable data protection laws, where the operator is bound by binding corporate rules or standard contractual terms providing adequate protection, or where you have consented. The European Union has data protection laws (GDPR) that meet or exceed South African standards. We rely on these mechanisms for any cross-border transfers.

8. How long we keep it

We keep personal information only as long as we need it.

Contact form and calculator submissions: up to 24 months from your last contact with us, unless you become a client (in which case the engagement record applies).
Client engagement records, accounting records, tax records, financial statements: at least 5 years from the end of the tax year to which they relate, as required by the Tax Administration Act, 28 of 2011. In some cases (Companies Act records, FICA records, deeds-related records) longer retention is required — typically 7 to 10 years.
Records relating to disputes, audits or investigations: until the matter is fully resolved and the prescribed retention period has passed.
Marketing records: we do not currently keep these. If we begin to in future, we will set a retention period and disclose it.

When information is no longer needed and we are not legally required to keep it, we delete or de-identify it.

9. How we protect it

We take POPIA's security obligations seriously.

Technical measures: encryption in transit (HTTPS) and at rest where the platform supports it; access controls; multi-factor authentication on all primary systems; up-to-date software; regular backups.
Organisational measures: confidentiality clauses in employment contracts; access only on a need-to-know basis; staff training on information handling; vetted operators with written agreements.
Physical measures: locked office, secured devices, clean-desk practice for confidential records.

No system is perfectly secure. We will notify you and the Information Regulator if we become aware of a security compromise that affects your personal information, as POPIA requires.

10. Your rights under POPIA

You have the following rights in respect of your personal information. We will help you exercise them at no cost (except where the law allows us to charge a reasonable fee for an access request, in which case we will tell you in advance).

Right to know what we hold. You can ask for a description of the personal information we hold about you and who has had access to it (Section 23).
Right to correct or delete. You can ask us to correct information that is inaccurate, irrelevant, excessive, out of date, misleading or unlawfully obtained (Section 24).
Right to object. You can object to our processing on legitimate-interest grounds, to direct marketing, or to automated decisions (Sections 11(3) and 71).
Right to withdraw consent. Where we rely on consent, you can withdraw it at any time.
Right to complain. You can complain to us, and to the Information Regulator if we have not resolved your complaint to your satisfaction.

To exercise any of these rights, email info@accountingconnect.ai. We will respond as soon as reasonably possible and within 30 days, unless the law allows or requires a longer period (in which case we will tell you).

11. Special personal information and children

POPIA gives extra protection to "special personal information" (race, religion, health, biometrics, sexual life, criminal behaviour, trade union membership, philosophical beliefs) and to children's information.

We do not seek special personal information except where it is strictly necessary for the work — for example, religious denomination on certain SARS-related forms, or health-related deductions on a personal tax return. Where we hold such information, we treat it with additional care and process it only on the lawful bases POPIA allows (Section 27).

We do not knowingly collect personal information of children (under 18) without consent of a competent person. If you believe we hold a child's information without proper authority, contact us and we will investigate and act.

12. Cookies and tracking

At the date of this policy, accountingconnect.ai uses only the cookies strictly necessary for the website to function. We do not use analytics, advertising or tracking cookies.

If we add analytics or other cookies in future, we will update this policy and, where required, ask for your consent before any non-essential cookies are set.

13. Information Regulator

If you have a complaint about how we handle your personal information and you are not satisfied with our response, you can complain to the Information Regulator.

The Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
PO Box 31533, Braamfontein, Johannesburg, 2017
General enquiries: enquiries@inforegulator.org.za
Complaints: POPIAComplaints@inforegulator.org.za
Website: inforegulator.org.za

14. Changes to this policy

We will update this policy when our practice changes, when our service providers change, or when the law changes. The "Last updated" date at the top tells you when we last revised it. Material changes will be notified by email to active clients and by a notice on this page.

15. How to contact us

For any question about this policy, your personal information, or how we process it:

Email: info@accountingconnect.ai
Post: PO Box 1255, Oudtshoorn, 6620
Office: 6 Cowley Lane, Oudtshoorn, 6620

We will respond as quickly as we can and within the timeframes POPIA requires.

How we handle your information.