Privacy Policy

PRIVACY POLICY

FOR

GROUP OF COMPANIES

(hereinafter referred to as “BVSA”)

Version 3 — November 2026

1. DEFINITIONS

As per the context of the Protection of Personal Information Act (POPIA) and the Promotion of Access to Information Act (PAIA), the following definitions are applicable:

“Cookies” are small data files sent from a server to your web browser or mobile device that are stored on your browser cache or mobile device.

“Data Subject” means the person to whom Personal Information relates.

“Information Officer” means the person acting on behalf of BVSA and discharging the duties and responsibilities assigned to the “head” of BVSA by POPIA and PAIA. The Information Officer is duly authorised to act as such, and such authorisation has been confirmed by the “head” of BVSA in writing.

“Operator” means a person who processes Personal Information for a Responsible Party in terms of a contract or mandate, without coming under the direct authority of that party, and includes providers of cloud-based software and artificial intelligence tools used by BVSA.

“Personal Information” means information about an identifiable, living, natural person and, where applicable, an identifiable, existing juristic person, including, but not limited to –

1. information relating to the race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language and birth of the person;
2. information relating to the education or the medical, criminal or employment history of the person or information relating to financial transactions in which the person has been involved;
3. any identifying number, symbol or other particular assigned to the person;
4. the address, fingerprints or blood type of the person;
5. the personal opinions, views or preferences of the person;
6. correspondence sent by the person that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the contents of the original correspondence;
7. the views or opinions of another individual about the person; and
8. the name of the person where it appears with other Personal Information relating to the person or where the disclosure of the name itself would reveal information about the person.

“Processing” means any operation or activity or any set of operations, whether or not by automatic means, concerning Personal Information, including –

1. The collection, receipt, recording, organisation, collation, storage, updating, or modification, retrieval, alteration, consultation or use;
2. Dissemination by means of transmission, distribution or making available in any other form; or
3. Merging, linking, as well as restriction, degradation, erasure, or destruction of information.

“Responsible Party” means a public or private body or any other person which, alone or in conjunction with others, determines the purpose and means for Processing Personal Information.

2. INTRODUCTION

As part of our commitment to protect Personal Information, while providing a professional service to our staff and clients, this policy provides information regarding information privacy at BVSA. Each company in the BVSA group of companies listed in Annexure A that processes a Data Subject’s Personal Information is the Responsible Party for that information, and can be contacted at 29 Veldkornet Street, Swellendam, 6740 and info@bvsa.co.za.

3. PROTECTION OF PERSONAL INFORMATION

BVSA is capturing, Processing, storing, and communicating Personal Information to perform its business functions. For a full list of the records, please refer to the POPIA & PAIA Manual, available on request at info@bvsa.co.za.

BVSA discloses Personal Information to Operators, such as providers of email and document management services, accounting, payroll and practice management software, and artificial intelligence tools, including where the Personal Information forms part of client data that BVSA accesses from a client’s accounting software, such as Xero, with the client’s authorisation. Such disclosure is made only to the extent necessary for the Operator to provide its services to BVSA, and in terms of a written agreement that requires the Operator to process the information only with BVSA’s knowledge or authorisation, to treat it as confidential, and to maintain appropriate security measures as contemplated in sections 20 and 21 of POPIA. Artificial intelligence tools are used only on business terms under which client data is not used to train the provider’s models by default.

In particular, where a client has authorised BVSA to access its Xero organisation, BVSA connects to Xero through Xero’s official API, using an integration that BVSA built and controls. Authorised BVSA staff may process that client’s Xero data, on BVSA’s instructions, for bookkeeping, accounting, reporting and review work. For that purpose, the following Operators may receive that data, either through the integration or where BVSA staff provide reports and extracts to them directly:

• Microsoft (Microsoft Azure, which hosts the integration, Microsoft 365 Copilot and Copilot Studio);
• OpenAI (ChatGPT Business); and
• Anthropic (Claude Team).

These Operators process the data on the terms described above, including business terms under which client data is not used to train their models by default. BVSA applies appropriate human review to their output where professional judgement is involved.

BVSA discloses Personal Information to third parties other than Operators, such as the South African Revenue Service, the Companies and Intellectual Property Commission, other regulatory authorities, courts and law enforcement agencies, only where required or permitted by law, or with the consent of the Data Subject.

Where BVSA uses cloud-based Operators, Personal Information may be stored or processed outside South Africa, including in the United States of America, New Zealand, the European Union, Australia and Asia. BVSA transfers Personal Information outside South Africa only where one of the grounds in section 72 of POPIA applies, namely where:

1. the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection which effectively upholds principles for reasonable Processing substantially similar to the conditions for the lawful Processing of Personal Information in POPIA, and includes provisions substantially similar to section 72 relating to the further transfer of Personal Information from the recipient to third parties in a foreign country;
2. the Data Subject consents to the transfer;
3. the transfer is necessary for the performance of a contract between the Data Subject and BVSA, or for the implementation of pre-contractual measures taken in response to the Data Subject’s request;
4. the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the Data Subject between BVSA and a third party; or
5. the transfer is for the benefit of the Data Subject, it is not reasonably practicable to obtain the Data Subject’s consent, and, if it were reasonably practicable, the Data Subject would be likely to give it.

Transfers to Operators are ordinarily made on the ground in item a. above, on the basis that the Operator is bound by a written agreement providing such protection.

A Data Subject may request from the Information Officer the identity of the third parties, or categories of third parties, who have or have had access to his, her or its Personal Information.

BVSA is accountable and a Responsible Party in ensuring that the Personal Information of a Data Subject is:

• processed lawfully, fairly, and transparently;
• processed only for the purposes for which it was collected;
• not processed for a secondary purpose unless consent is provided;
• accurate and kept up to date;
• not kept for longer than necessary;
• processed in accordance with integrity and confidentiality principles; this includes physical and organisational measures to ensure that Personal Information, in both physical and electronic form, is subject to an appropriate level of security when stored, processed, and communicated; and
• processed in accordance with the rights of Data Subjects, where applicable.

4. DATA COLLECTION

Data is only collected and processed as per the specifications in POPIA and the process is outlined within the POPIA & PAIA Manual.

BVSA collects Personal Information directly from the Data Subject wherever possible. Where Personal Information is collected from another source, such as a client, a client’s accounting software (for example, Xero) with the client’s authorisation, or a public record, it is collected in accordance with section 12 of POPIA. Where BVSA is required by law to collect Personal Information, including under tax and anti-money-laundering legislation where applicable, the supply of that information is mandatory; otherwise it is voluntary. If requested Personal Information is not provided, BVSA may be unable to provide its services or to comply with its legal obligations.

Data is processed for the following purposes:

• To administer our services to you;
• To respond to your requests;
• To distribute communications relevant to your use of our services, such as updates or information about your use of our services;
• As may be necessary to support the operation of our services, such as for billing, account maintenance, and record-keeping purposes;
• To send you BVSA solicitations, product announcements, and the like that we feel may be of interest to you. Electronic direct marketing is sent only to existing clients in respect of BVSA’s similar services, or to other persons who have consented to receive it, as required by section 69 of POPIA. You may “opt out” of receiving these marketing materials at any time, free of charge.
• In other manners after subsequent notice is provided to you and/or your consent is obtained, if necessary.

5. COOKIE POLICY

We use functional (or required) Cookies that are necessary for this site to function, as well as analytics Cookies, such as those used by Google Analytics, to understand how visitors use the site. We do analyse the use of this website to measure the audience, and, where possible, use the resulting information in aggregated or de-identified form rather than to identify individual visitors.

We also use advertising Cookies, such as those set by Google Ads, to measure our advertising and to show BVSA advertisements to people who have visited our site. You can block or delete these Cookies through your browser settings.

Cookies and tracking technologies are used to provide the following usability features via our website:

• Required for the website to function correctly, and provide you with an optimal experience.
• Enhance and customise functionality, so that for example, details are only entered on the first visit to the site.
• To gain an understanding of how our visitors are using the site to improve functionality and the services on offer.

In the instances where we partner with third-party services that may use various tracking technologies to provide certain services or features on our sites, such as analytics and on-site messaging, Cookies are used to collect data. These Cookies may collect online identifiers, such as IP addresses or device identifiers, which may constitute Personal Information. BVSA itself does not use this data to identify you by name, and it is kept separate from the Personal Information about you as a user that we collect.

Note that in the event that Cookies are disabled or rejected, it may affect the website and the services may not work as they are supposed to.

6. CONTACT US

Subject to POPIA and PAIA, a Data Subject has the right to: (a) ask whether BVSA holds his, her or its Personal Information and request access to it; (b) request the correction or deletion of Personal Information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully; (c) object, on reasonable grounds, to the Processing of his, her or its Personal Information, and object at any time to Processing for direct marketing; (d) withdraw consent where Processing is based on consent; and (e) lodge a complaint with the Information Regulator (www.inforegulator.org.za; POPIAComplaints@inforegulator.org.za). Requests for access to records are dealt with in terms of the POPIA & PAIA Manual.

If you have any questions about our privacy policy, please contact us via email at info@bvsa.co.za.

ANNEXURE A – BVSA GROUP OF COMPANIES

The following companies form part of BVSA. Each is the Responsible Party for the Personal Information it processes, and can be contacted at 29 Veldkornet Street, Swellendam, 6740 or info@bvsa.co.za: