1) What personal information we process

• Identity & contact data: name, email address, phone number, company and role, physical/postal address.
• Engagement data: information you provide via our contact forms, emails, meetings, and documents relevant to tax and advisory services.
• Technical & usage data: IP address, device/browser info, pages viewed, and cookies/analytics (see our Cookie Policy).
• Financial & compliance data: limited data necessary to perform tax compliance work, billing, and regulatory obligations.

2) How and why we collect it (lawful basis)

We collect personal information directly from you (e.g., forms, email, meetings) and from lawful third-party sources where appropriate (e.g., public records or on your instruction). We process it on the following POPIA grounds:

• To perform a contract or take steps at your request (providing tax and advisory services, proposals, onboarding).
• To comply with law (tax, anti-money laundering/know-your-client (KYC), record-keeping).
• Legitimate interests (running and improving our practice, securing our systems, managing client relationships), balanced against your rights.
• Consent where required (e.g., certain optional communications). You may withdraw consent at any time by emailing info@bkftaxco.co.za.

3) What we use your information for

• Providing, managing, and improving our tax and business advisory services.
• Responding to enquiries and communicating about engagements.
• Billing, account administration, and client relationship management (CRM).
• Legal, regulatory, and professional obligations and audits.
• Securing our website, email, and systems; preventing fraud and abuse.
• Analytics to understand website performance and user experience (see Cookie Policy).

4) Sharing and disclosure

We do not sell your personal information. We may share it with:

• Authorised staff and professional advisers who are bound by confidentiality.
• Service providers/Operators (e.g., secure email, hosting, document management, analytics) under written agreements meeting POPIA requirements.
• Regulators and authorities where required by law or to protect our legal rights.
• Third parties on your instruction (e.g., when collaborating with your other advisers).

5) Cross-border transfers

Some service providers may process data in other countries. Where cross-border transfers occur, we use providers that implement appropriate safeguards and protections consistent with POPIA (e.g., contractual commitments and robust security). By engaging with us and using our Site, you acknowledge such transfers may occur as necessary to deliver our services.

6) Security

We use technical and organisational measures appropriate to the nature of the information (access controls, encryption in transit where applicable, least-privilege access, staff confidentiality). No system is perfectly secure; we continually review and improve our safeguards.

7) Retention

We retain personal information only as long as necessary for the purposes set out above, including to comply with legal, tax, and professional record-keeping requirements. When no longer required, we securely delete or de-identify it.

8) Your rights under POPIA

• Access your personal information we hold.
• Correction of inaccurate or incomplete information.
• Deletion (erasure) where POPIA allows.
• Objection to certain processing, or request restriction.
• Data portability where technically feasible and appropriate.
• Withdraw consent where processing relies on consent.

To exercise your rights, contact us at info@bkftaxco.co.za. You may also lodge a complaint with the Information Regulator (South Africa). See the Regulator’s official website for current contact details.

9) Cookies and analytics

We use necessary cookies to operate the Site and, where enabled, analytics cookies to understand how the Site is used. For details, please see our Cookie Policy. You can manage cookies in your browser settings.

10) Children

Our services are intended for adults and business users. We do not knowingly collect personal information of children without appropriate consent and legal basis.

11) Third-party links

Our Site may link to third-party websites. Those sites operate under their own privacy terms. We are not responsible for their content or practices.

13) Changes to this Policy

We may update this Policy from time to time. Material changes will be reflected by updating the “Last updated” date above. Continued use of our Site and services after changes indicates acceptance of the updated Policy.