1. Introduction
Craven Accounting Inc (“we”, “us”, “the practice”) is a registered accounting and tax practice providing accounting, bookkeeping, payroll, taxation and company secretarial services to businesses and individuals in South Africa.
This policy explains what personal information we collect, why we collect it, how we use and protect it, and what rights you have in respect of it. It is issued in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”).
We are the responsible party for the personal information described in this policy.
2. Who to contact
Information Officer: Morné Craven
Email: morne@craven-accounting.co.za
Telephone: +27 66 023 2186
Registered address: 162 Eloff Street, Eloffsdal, Pretoria 0084
Any question, request or complaint about this policy or about how we handle your information should be directed to the Information Officer at the address above.
The registration certificate can be viewed here
3. What information we collect
Identity and contact information
Names, identity or passport numbers, income tax reference numbers, VAT numbers, PAYE and UIF reference numbers, registered and physical addresses, email addresses and telephone numbers.
Business and entity information
CIPC registration details, directors’ and members’ particulars, shareholding information, memoranda of incorporation and related statutory records.
Financial information
Bank statements and banking details, invoices, receipts, general ledger and accounting records, trial balances, annual financial statements, asset registers, and supporting documentation for transactions.
Payroll information
Employee names and identity numbers, salary and wage details, bank account details for salary payment, leave records, tax directives, and UIF, SDL and COID declarations.
Correspondence
Emails, WhatsApp messages, telephone notes and any other communications between you and the practice, including documents you send us through those channels.
Some of this information is special personal information as defined in POPIA, or information relating to children, where it appears in payroll or tax records. We process it only to the extent necessary to perform the services you have engaged us for and to meet our legal obligations.
4. Why we process your information
We process personal information for the following purposes:
- To provide the accounting, bookkeeping, payroll, tax and secretarial services you have engaged us for
- To prepare and submit returns, declarations and statutory filings to SARS, CIPC, the UIF, the Compensation Fund and other regulators on your behalf
- To prepare annual financial statements and management accounts
- To communicate with you about your affairs and respond to your queries
- To issue invoices and collect payment for our services
- To comply with our own legal, regulatory and professional obligations, including those imposed by the Tax Administration Act, the Companies Act, the Financial Intelligence Centre Act and the rules of our professional bodies
- To maintain our records and defend our position in the event of a dispute or regulatory enquiry
The legal bases on which we rely are: the performance of our engagement with you, compliance with obligations imposed on us by law, and our legitimate interests in operating and protecting the practice. Where we rely on your consent, you may withdraw it at any time, subject to any legal obligation we have to retain or submit the information.
5. Who we share it with
Who we share it with
We do not sell your information. We share it only where it is necessary to deliver our services or where the law requires it.
Regulators and authorities
The South African Revenue Service, the Companies and Intellectual Property Commission, the Unemployment Insurance Fund, the Compensation Fund, and other regulators or authorities where a filing, submission or lawful request requires it.
Software and service providers
We use third-party accounting, payroll, document storage and communication platforms in the course of our work. These may include Sage, Xero, QuickBooks, SARS eFiling and e@syFile, and email, messaging and cloud hosting providers. These providers process information on our instruction as operators and are bound to keep it confidential and secure.
WhatsApp
Where you contact us or we contact you via WhatsApp, your phone number and the content of your messages are processed by WhatsApp Ireland Limited and Meta Platforms in accordance with their own privacy terms. We use WhatsApp to send service communications such as reminders, requests for documents and status updates, and to respond to your queries.
Professional advisers
Attorneys, auditors and other professional advisers where we need advice or where a matter requires their involvement.
Third parties at your request
Banks, funders, insurers or prospective purchasers to whom you ask us to provide information about you or your business.
Some of these providers store or process information outside South Africa. Where that happens, we take reasonable steps to satisfy ourselves that the recipient is subject to laws, binding rules or contractual terms that provide an adequate level of protection, as POPIA requires.
6. How long we retain your data
We retain records for as long as we act for you and thereafter for the periods required by law.
Records supporting a tax return must generally be kept for five years from the date the return was submitted, and longer where an audit, objection, appeal or investigation is under way. Company records under the Companies Act are generally retained for seven years. Where different periods apply to the same record, we apply the longer.
Once the applicable retention period has expired and we have no continuing legal or professional reason to keep a record, we destroy or de-identify it..
7. How we protect it
We take appropriate, reasonable technical and organisational measures to protect personal information against loss, damage and unauthorised access, including access controls and authentication on the systems we use, encryption in transit for data sent over the internet, restricted access on a need-to-know basis, secure storage of physical documents, and regular backups.
No system is entirely secure. If a security compromise occurs that affects your personal information, we will notify you and the Information Regulator as POPIA requires.
8. Your rights
Under POPIA you have the right to:
- Ask what personal information we hold about you and request a copy of it
- Ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained
- Object to our processing of your information on reasonable grounds
- Withdraw consent where our processing relies on it
- Complain to the Information Regulator if you believe we have not handled your information lawfully
To exercise any of these rights, contact the Information Officer at the details in section 2. We may need to verify your identity before acting on a request. Some requests may be limited by our obligation to retain records or submit information under tax and company law.
Information Regulator of South Africa
Email: complaints.IR@justice.gov.za
Website: https://inforegulator.org.za
9. Website
Our website may use cookies and similar technologies to operate correctly, remember your preferences and understand how the site is used. You can disable cookies in your browser, although parts of the site may not work as intended if you do.
If you complete a contact form on our website, we use the details you provide to respond to your enquiry.
10. Changes to this policy
We may update this policy from time to time. The current version is always available on our website, and the date at the top shows when it was last revised.