POPIA Information Notice

This notice is issued in terms of section 18 of the Protection of Personal Information Act 4 of 2013 (POPIA) and describes how DigMe Solutions (Pty) Ltd processes personal information.

1. Responsible Party

2. Information Officer

Our designated Information Officer is responsible for ensuring compliance with POPIA. All requests relating to your personal information should be directed to:

3. Categories of Personal Information Processed

In the course of providing accounting, tax, payroll, and independent financial verification services, we process the following categories of personal information:

• Identifying information: names, ID numbers, passport numbers (including copies of passport bio-pages), dates of birth
• Contact details: addresses, telephone numbers, email addresses
• Financial information: income, expenditure, bank account details and statements, investment and pension records, property valuations, statements of assets and liabilities
• Tax information: tax reference numbers, tax returns, SARS assessments and correspondence
• Employment information: payroll data, IRP5 details, leave records, UIF information
• Company information: CIPC registration data, shareholding structures, director details
• Immigration-related financial information: where we are engaged to prepare independent accountant’s reports (factual findings reports) in support of visa or permanent residence applications, we process the financial and identifying information of the applicant (and, where applicable, an accompanying spouse) necessary to perform the agreed-upon procedures

We do not intentionally process special personal information (such as race, health, or criminal records) in the ordinary course of our services.

4. Purposes of Processing

Personal information is processed for the following purposes:

• Providing accounting, bookkeeping, tax compliance, payroll, and financial advisory services
• Submitting tax returns, provisional tax returns, and VAT returns to SARS
• Filing annual returns and other documents with the CIPC
• Preparing and submitting payroll declarations (EMP201, EMP501) to SARS and the UIF
• Preparing independent accountant’s reports (factual findings reports under ISRS 4400) and related engagement documentation in support of visa and permanent residence applications, at the instruction of the applicant
• Communicating with clients about their financial affairs and deadlines
• Complying with our legal, professional, and regulatory obligations
• Managing our client relationships, billing, and practice administration

5. Lawful Grounds for Processing

We process personal information on the following grounds permitted by POPIA section 11:

• Contractual necessity: processing is required to perform our service agreement with you
• Legal obligation: certain processing is required to comply with tax law, the Companies Act, and other legislation
• Legitimate interest: for practice management and service delivery purposes that do not outweigh your privacy interests
• Consent: for any processing not covered above, we obtain your explicit consent

6. Disclosure of Personal Information

We disclose personal information only where necessary for the purposes above, including to:

• SARS, the CIPC, the UIF, and the Compensation Fund, where required to perform statutory filings on your behalf
• Immigration practitioners acting for you: where we prepare an independent accountant’s report for a visa or permanent residence application, the report is provided to you and, on your instruction, to the immigration agent handling your application
• Our professional body (SAIPA) and regulators, where required for professional oversight or by law
• Operators (service providers) who process information on our behalf, as described in section 7

We do not sell personal information or share it for third-party marketing.

7. Operators and Automated Processing

We use third-party service providers (operators under POPIA section 20) to deliver our services. These include cloud accounting software (Xero), email and document storage (Google Workspace), our practice management and hosting platforms (Supabase, Netlify), and artificial-intelligence tools used to assist with document preparation and analysis (Anthropic). Operators process personal information on our instructions under written terms requiring confidentiality and appropriate security safeguards.

Where AI tools are used, they assist our staff with preparation and checking. All professional work — including any report, return, or finding we issue — is performed, reviewed, and approved by a responsible person. We do not make automated decisions that have legal or similarly significant effects on you within the meaning of POPIA section 71.

8. Security Safeguards and Breach Notification

In line with POPIA section 19, we apply reasonable technical and organisational measures to protect personal information, including access controls on our systems, encryption of data in transit and at rest on our hosting platforms, and restriction of client records to authorised staff. In the event of a security compromise affecting your personal information, we will notify the Information Regulator and affected data subjects as required by POPIA section 22.

9. Data Subjects’ Rights

As a data subject under POPIA, you have the following rights:

• Right to access (section 23): request a description of the personal information we hold about you and the right to request a copy
• Right to correction or deletion (section 24): request correction of inaccurate, irrelevant, or excessive information, or deletion of information we are not lawfully entitled to retain
• Right to object (section 11(3)): object to the processing of your personal information on reasonable grounds
• Right to withdraw consent: withdraw consent to processing at any time, where processing is based on consent
• Right to complain: lodge a complaint with the Information Regulator

10. How to Submit a Request

To exercise any of the rights above, submit a written request to our Information Officer:

• By email: info@digme.co.za
• Subject line: “POPIA Request — Your full name”

We will acknowledge your request within five business days and respond substantively within 30 days. We may require you to verify your identity before processing a request.

11. Retention and Destruction

We retain personal information for the periods required by law (see our Privacy Policy for details) and thereafter securely destroy or de-identify it. Records relating to completed engagements, including independent accountant’s reports and their supporting documentation, are retained for the period required by tax legislation, the Companies Act, and our professional body’s requirements, after which they are securely destroyed.

12. Cross-Border Transfers

Some of the operators listed in section 7 (including Xero, Google, Supabase, Netlify, and Anthropic) store or process data on servers outside South Africa. We only use third-party processors that are subject to laws, binding corporate rules, or binding agreements that provide an adequate level of protection for personal information, consistent with POPIA section 72.

13. Complaints to the Information Regulator

If you are not satisfied with how we have handled your personal information or your request, you may lodge a complaint with the Information Regulator: