Privacy notice

Who we are

Chovia Accounting (Pty) Ltd (registration number 2025/861103/07) is a firm of Chartered Management Accountants providing accounting, tax, payroll, CIPC and reporting services to businesses across South Africa. In this notice, “we”, “us” and “our” mean Chovia Accounting (Pty) Ltd.

We are the responsible party for the personal information described in this notice, as defined in the Protection of Personal Information Act, 4 of 2013 (“POPIA”). This notice explains what personal information we collect, why we collect it, how we protect it, and the rights you have.

Information we collect

When you contact us or use our website

• Your name, email address, phone number and business name
• What you tell us in your message or during a call or WhatsApp conversation

When you become a client

• Identity and contact details of owners, directors, members, shareholders and beneficial owners: names, ID or passport numbers, addresses, phone numbers and email addresses
• Tax information: income tax, VAT, PAYE and other tax reference numbers, and correspondence with SARS
• Company information and records held with CIPC
• Financial information: bank statements, invoices, slips, contracts, loan accounts and other accounting records
• Payroll information about your employees, where we run payroll for you: names, ID numbers, tax numbers, bank details, salaries, leave and deductions

Information we do not ask for

We do not intentionally collect special personal information (such as health, religious or biometric information) or information about children, except where it is part of records you give us for a legal purpose, for example a medical aid deduction on a payslip or a minor’s details on a tax return.

Where we get it from

We collect personal information directly from you wherever we can. In the course of our work we also receive it from other sources, for example:

• SARS eFiling and other SARS records, when we act as your tax practitioner
• CIPC records, for company and beneficial ownership information
• Your bank, through bank feeds and statements you authorise
• You, about your employees, directors and shareholders, when you ask us to run payroll or company filings
• Public records

Where you give us information about other people, such as your employees, please let them know that you have shared it with us for these purposes.

Is providing information voluntary?

Giving us personal information is voluntary. However, much of what we ask for is required by law, for example by the Income Tax Act, the Tax Administration Act and the Companies Act, so that returns and filings can be made. If information is not provided, we may not be able to provide the service, and filings may be late or incorrect, which can lead to penalties.

How we use your information

We only use personal information for the purposes we collected it for, or for purposes closely related to them:

We do not sell personal information. We do not send marketing messages unless you have asked for them, and you can opt out at any time.

Using information for a new purpose

We will not use your personal information for a purpose that is not compatible with the purpose we collected it for, unless you consent, the law requires or allows it, or it is needed for legal proceedings, as section 15 of POPIA allows. If we plan to use it for a new purpose, we will tell you first.

Who we share it with

We share personal information only where needed to provide our services or where the law requires it:

• Authorities: the South African Revenue Service, the Companies and Intellectual Property Commission, the Department of Employment and Labour (UIF and COIDA) and other regulators
• Software we use to deliver our services (“operators”): Xero (accounting), Dext and Hubdoc (document capture), SimplePay (payroll) and Google (email and Google Drive file storage). We only use the tools your business needs.
• Banks and lenders, when you ask us to provide them with financial statements or other information
• Professional advisers, such as attorneys or auditors, where needed and under a duty of confidentiality

Our operators may only process your information on our instructions and must keep it secure and confidential, as required by sections 20 and 21 of POPIA.

Information stored outside South Africa

Some of the cloud services we use store information on servers outside South Africa. Before we use a provider, we check that your information will be protected to a standard substantially similar to POPIA, through the law of the country concerned, binding agreements or the provider’s own binding rules, as section 72 of POPIA requires.

How long we keep it

We keep personal information only for as long as we need it for the purpose it was collected, or for as long as the law requires. As a guide:

• Tax records: at least 5 years from the date of submission, as required by the Tax Administration Act
• Company accounting records and annual financial statements: at least 7 years, as required by the Companies Act
• Payroll records: at least 5 years for tax purposes (the Basic Conditions of Employment Act requires at least 3 years)
• Enquiries that do not lead to an engagement: up to 12 months

When information is no longer needed, we delete or destroy it securely, or de-identify it.

Keeping it accurate

We take reasonable steps to keep personal information complete, accurate, not misleading and up to date. Please tell us when your details change. If you tell us that information we hold is incorrect, we will stop using the disputed information, where reasonably possible, until its accuracy has been checked, and correct it where needed.

How we protect it

We take appropriate, reasonable technical and organisational measures to keep personal information secure, as section 19 of POPIA requires. These include:

• Reputable cloud systems with encryption and two-factor sign-in
• Access limited to people who need it to do their work
• Passwords and access keys stored separately from client files
• Confidentiality duties on everyone who handles client information
• Regular backups, kept separately from the working files
• Agreements with our operators that require them to keep information confidential and secure, and to tell us immediately of any breach

If we believe your personal information has been accessed or acquired by an unauthorised person, we will notify you and the Information Regulator as soon as reasonably possible, as section 22 of POPIA requires.

Our website and cookies

Our website does not use analytics, advertising, social media or other tracking cookies, and we do not use web beacons or tracking pixels. That is why you do not see a cookie banner.

• The site loads fonts from Google Fonts, which means your browser connects to Google’s servers and shares your IP address with Google.
• When you use the contact form, the details you enter are sent to us so we can respond.
• When you tap a WhatsApp link, your conversation with us is subject to WhatsApp’s own privacy policy.

If we ever add analytics or other non-essential cookies, we will update this notice and ask for your consent before setting them. You can also block or delete cookies at any time in your browser settings.

Your rights

Under POPIA you have the right to:

• Ask whether we hold personal information about you, and ask for a copy of it (section 23)
• Ask us to correct or delete information that is inaccurate, out of date, incomplete, misleading or unlawfully obtained (section 24)
• Object to the processing of your information on reasonable grounds, and object to direct marketing at any time (section 11(3))
• Withdraw your consent, where we rely on consent
• Lodge a complaint with the Information Regulator

To use any of these rights, contact our Information Officer below. We may need to confirm your identity first. Some requests may be limited where the law requires us to keep records, for example for SARS. Requests for records are handled under our PAIA manual.

Contact our Information Officer

If you are not satisfied with how we have handled your personal information, you may complain to the Information Regulator:

Changes and governing law

We may update this notice from time to time. The latest version will always be on this page, with the date it was last updated.

This notice is governed by the laws of the Republic of South Africa.