POPIA Information Notice

This notice is issued in terms of section 18 of the Protection of Personal Information Act 4 of 2013 (POPIA) and describes how DigMe Solutions (Pty) Ltd processes personal information.

1. Responsible Party

2. Information Officer

Our designated Information Officer is responsible for ensuring compliance with POPIA. All requests relating to your personal information should be directed to:

3. Categories of Personal Information Processed

In the course of providing accounting, tax, and payroll services, we process the following categories of personal information:

• Identifying information: names, ID numbers, passport numbers, dates of birth
• Contact details: addresses, telephone numbers, email addresses
• Financial information: income, expenditure, bank account details, investment records
• Tax information: tax reference numbers, tax returns, SARS assessments and correspondence
• Employment information: payroll data, IRP5 details, leave records, UIF information
• Company information: CIPC registration data, shareholding structures, director details

We do not intentionally process special personal information (such as race, health, or criminal records) in the ordinary course of our services.

4. Purposes of Processing

Personal information is processed for the following purposes:

• Providing accounting, bookkeeping, tax compliance, payroll, and financial advisory services
• Submitting tax returns, provisional tax returns, and VAT returns to SARS
• Filing annual returns and other documents with the CIPC
• Preparing and submitting payroll declarations (EMP201, EMP501) to SARS and the UIF
• Communicating with clients about their financial affairs and deadlines
• Complying with our legal, professional, and regulatory obligations
• Managing our client relationships, billing, and practice administration

5. Lawful Grounds for Processing

We process personal information on the following grounds permitted by POPIA section 11:

• Contractual necessity: processing is required to perform our service agreement with you
• Legal obligation: certain processing is required to comply with tax law, the Companies Act, and other legislation
• Legitimate interest: for practice management and service delivery purposes that do not outweigh your privacy interests
• Consent: for any processing not covered above, we obtain your explicit consent

6. Data Subjects’ Rights

As a data subject under POPIA, you have the following rights:

• Right to access (section 23): request a description of the personal information we hold about you and the right to request a copy
• Right to correction or deletion (section 24): request correction of inaccurate, irrelevant, or excessive information, or deletion of information we are not lawfully entitled to retain
• Right to object (section 11(3)): object to the processing of your personal information on reasonable grounds
• Right to withdraw consent: withdraw consent to processing at any time, where processing is based on consent
• Right to complain: lodge a complaint with the Information Regulator

7. How to Submit a Request

To exercise any of the rights above, submit a written request to our Information Officer:

• By email: info@digme.co.za
• Subject line: “POPIA Request — Your full name”

We will acknowledge your request within five business days and respond substantively within 30 days. We may require you to verify your identity before processing a request.

8. Retention and Destruction

We retain personal information for the periods required by law (see our Privacy Policy for details) and thereafter securely destroy or de-identify it.

9. Cross-Border Transfers

Some of our tools and platforms (including Xero) store data on servers outside South Africa. We only use third-party processors that provide adequate protection for personal information, consistent with POPIA section 72.

10. Complaints to the Information Regulator

If you are not satisfied with how we have handled your personal information or your request, you may lodge a complaint with the Information Regulator: