POPIA Information Notice

1. Who We Are

J Rawat and Company Inc is a registered accounting and auditing firm operating in South Africa. We are a Responsible Party as defined under POPIA, meaning we determine the purpose and means of processing personal information.

2. Information Officer

Our Information Officer is the person accountable for ensuring compliance with POPIA within our organisation:

3. What Personal Information We Process

As an accounting and advisory firm, we process personal information in the course of delivering our services. This may include:

• Identity information (full name, ID number, passport number)
• Contact details (address, telephone, email)
• Financial and tax information (income, expenses, tax reference numbers, bank details)
• Employment information (for payroll services)
• Company registration and directorship details
• Estate and trust details (for estate planning services)
• Correspondence and meeting records

4. Purposes of Processing

We process personal information for the following purposes:

• Providing bookkeeping, accounting, and financial reporting services
• Preparing and submitting tax returns and related filings to SARS
• Conducting audit and assurance engagements
• Processing payroll and related statutory submissions (UIF, SDL, PAYE)
• Providing company secretarial services to CIPC
• Providing estate planning and financial services
• Complying with anti-money laundering (FICA) obligations
• Administering client relationships and communications
• Meeting our own regulatory and professional obligations

5. Lawful Grounds for Processing

We rely on the following grounds for processing personal information under POPIA:

• Contractual necessity: Processing is required to fulfil our professional services mandate
• Legal obligation: Processing required by tax law, companies legislation, FICA, IRBA regulations, and other applicable law
• Consent: Where you have given explicit consent for specific processing activities
• Legitimate interest: For client relationship management and improving our services

6. Special Personal Information

Some of the information we process may qualify as "special personal information" under POPIA (such as ID numbers or financial information). We process such information only to the extent necessary to fulfil our legal and contractual obligations, and we apply enhanced safeguards to its protection.

7. Third Parties and Operators

We may share your personal information with the following parties where lawfully required or permitted:

• SARS — for tax submissions and related filings
• CIPC — for company secretarial matters
• UIF, SETA, and other statutory bodies — in connection with payroll obligations
• Master of the High Court — for deceased estate matters
• IRBA — in connection with audit regulatory requirements
• Cloud and software service providers — used in our operations under data processing agreements

We do not sell, lease, or otherwise monetise personal information.

8. Trans-Border Information Flows

Where personal information is processed by third-party service providers located outside South Africa (for example, cloud software providers), we ensure that adequate data protection measures are in place, consistent with POPIA's requirements for cross-border transfers.

9. Retention of Information

We retain personal information for as long as necessary to fulfil the purposes for which it was collected, and in accordance with applicable legal requirements:

• Tax records: minimum 5 years from date of assessment (as required by the Tax Administration Act)
• Company secretarial records: as required by the Companies Act
• Audit working papers: minimum 5 years from report date
• General client files: minimum 5 years from termination of engagement

10. Your Rights as a Data Subject

Under POPIA, you have the following rights:

• Right of access: Request details of the personal information we hold about you
• Right to correction: Request correction of inaccurate, incomplete, or out-of-date information
• Right to deletion: Request deletion of information where it is no longer necessary for the purpose collected (subject to overriding legal retention requirements)
• Right to object: Object to the processing of your information on grounds relating to your particular situation
• Right to complain: Lodge a complaint with the Information Regulator

To exercise any of these rights, submit a written request to our Information Officer at the contact details above. We will respond within 30 days.

11. Security Measures

We maintain appropriate technical and organisational security measures, including:

• Password-protected and encrypted storage of digital records
• Secure physical storage for paper-based client files
• Role-based access controls limiting access to personal information to authorised personnel only
• Regular staff training on data protection obligations
• Incident response procedures for potential data breaches

12. Data Breach Notification

In the event of a security compromise that is reasonably likely to result in harm to a data subject, we will notify the Information Regulator and affected data subjects as required by section 22 of POPIA.

13. Contact the Information Regulator

If you are not satisfied with our handling of your personal information, you may contact: