1. Our commitment
The Protection of Personal Information Act 4 of 2013 ("POPIA") sets out how personal information must be lawfully collected, used, stored, shared and destroyed in South Africa.
As a bookkeeping practice, our clients trust us with their financial records and often with their employees' payroll information. Protecting that information is central to how we work.
This page summarises how we comply with POPIA and how you can use your rights. For details of what information we collect and why, please read our Privacy Policy.
2. Our Information Officer
Our Information Officer makes sure we comply with POPIA and deals with requests and questions about personal information.
Information Officer: Roxanne De Coning, BisAcc Bookkeeping
Email: roxanne@bisacc.co.za
WhatsApp: 083 261 7958
Postal address: P.O. Box 747, Betty's Bay, 7141
3. How we meet POPIA's conditions
POPIA sets eight conditions for lawful processing of personal information. This is how we apply them:
| Condition | What it means at BisAcc |
|---|---|
| Accountability | We take responsibility for complying with POPIA, and we have an Information Officer who oversees it. |
| Processing limitation | We collect only the information we need, lawfully and in a reasonable way, and where possible directly from you or your business. |
| Purpose specification | We collect information for specific purposes, such as responding to enquiries, keeping your books and meeting legal record-keeping duties. We keep it only as long as needed. |
| Further processing limitation | We don't use information for purposes unrelated to why it was collected. |
| Information quality | We take reasonable steps to keep records complete, accurate and up to date. Monthly reconciliations help with this. |
| Openness | We explain what we collect and why in our Privacy Policy and on this page. |
| Security safeguards | We use secure cloud software, strong passwords and restricted access to protect information against loss and unauthorised access. |
| Data subject participation | You can ask to see, correct or delete your personal information, as explained below. |
4. Your rights
As a "data subject" under POPIA, you have the right to:
- Be informed when your personal information is being collected, and why.
- Access your information: ask whether we hold personal information about you, and request a copy of it.
- Correct or delete your information: ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully. You can also ask us to destroy or delete records we're no longer allowed to keep.
- Object to processing: object, on reasonable grounds, to us processing your personal information.
- Object to direct marketing: object at any time to your information being used for direct marketing.
- Not be subject to automated decisions: not be subject to decisions based solely on automated processing that significantly affect you. We don't make decisions this way.
- Complain: lodge a complaint with the Information Regulator.
Some rights have legal limits. For example, we may need to keep certain financial records for a minimum period under tax legislation, even if you ask us to delete them. If that applies, we'll explain why.
5. How to make a request
- Contact our Information Officer by email at roxanne@bisacc.co.za.
- Tell us what you're asking for: for example, access to your information, a correction, deletion or an objection. Include enough detail for us to find the relevant records.
- Confirm your identity. To protect your information, we'll need to verify who you are before we release or change anything. We may ask for a copy of your ID.
We'll respond as soon as reasonably possible, and generally within 30 days. There is no charge to ask whether we hold your information or to correct it. If a fee applies to providing copies of records, as permitted under the Promotion of Access to Information Act (PAIA), we'll tell you before we proceed.
6. When we work on a client's behalf
When we keep a client's books or run their payroll, we process personal information about the client's employees, customers and suppliers. In that role, we act as the client's "operator" under POPIA. This means we:
- process that information only for the services the client has engaged us for, and on their instructions;
- keep it confidential and don't disclose it unless the law requires it, or the client asks us to (for example, to our tax partner for submissions);
- apply appropriate security measures to protect it; and
- tell the client immediately if we believe the information has been accessed or acquired by an unauthorised person.
Our clients remain the responsible party for that information. That includes having a lawful reason to process it and informing their employees and other data subjects. If you're an employee, customer or supplier of one of our clients and have a request about your information, please contact that business first. We'll help them respond.
7. Security compromises
If we have reasonable grounds to believe that personal information we hold has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and the affected data subjects as soon as reasonably possible. Where we hold the information on behalf of a client, we'll notify that client immediately. We'll explain what happened, the possible consequences, what we're doing about it, and what you can do to protect yourself.
8. Complaints
If you're concerned about how we've handled your personal information, please contact our Information Officer first. We'd like the chance to put things right.
If you're not satisfied with our response, you have the right to lodge a complaint with the Information Regulator (South Africa):
Information Regulator (South Africa)
Website: inforegulator.org.za