Privacy Policy

1. Who we are

MGB Accounting and Tax Services Inc. (“MGB Accounting”, “we”, “us”) is an accounting and tax practice based in Roodepoort, Gauteng and Rustenburg, North West. For the purposes of POPIA we are the responsible party for the personal information described in this policy.

Our Information Officer is Morena Balatseng, Director. You can reach the Information Officer at [email protected] or through our contact form.

2. What this policy covers

This policy applies to this website (MGB Accounting and Tax Services at mgbaccounting.co.za) and to the information you submit through it — in particular the Request a Quote form. Once you become a client, the processing of your information is also governed by your engagement letter and the professional and statutory duties that apply to us as SAICA members and registered tax practitioners.

3. Information we collect

We collect the following categories of personal information:

• Contact details you give us in the quote form: your name, email address, contact number and company or business name.
• Your answers to the questions in the quote form — who the quote is for and, for entity registration, NPO, PBO or section 18A enquiries, your stage, legal structure, activity and proposed director and founder numbers; the services you need, NPO/PBO/section 18A assistance, accounting scope and record availability, VAT status, current or planned employment, and other registrations (Customs, COIDA, CIDB) you require, and any notes you add. For a deceased estate, this includes basic details you choose to give us about the deceased person and the estate, such as the date of death, whether there is a will and the status of the Master’s appointment.
• Records you upload, such as bank statements, previous financial statements, VAT reports, SARS letters, optional business cards, flyers, existing designs or entity documents for design quotes, or records relevant to a general enquiry. We also collect the bank-required statement period and your choice of design service. Registration and estate-application documents are requested after engagement, rather than through the initial registration quote. Uploaded records may contain personal information about other people — see section 5.
• Technical information collected automatically when you browse the site: your IP address, browser type, device type, the pages you visit and the date and time of your visit. This is held in ordinary web-server and hosting logs.
• Correspondence — any emails or messages you exchange with us after submitting a request.

We do not ask for special personal information (such as information about your health, religion, race or biometrics) or the personal information of children through this website. If a document you upload happens to contain such information, we process it only to the extent necessary to prepare your quote and perform the services you engage us for.

4. Why we process it and on what basis

We process your personal information for the following purposes and on the following lawful grounds under section 11 of POPIA:

• To prepare and send you a quote and to answer your enquiry — this is necessary to take steps at your request before entering into a contract with you, and you consent to it when you submit the form.
• To send you an acknowledgement of your request by email, including your reference number.
• To provide the services you engage us for — performing our contract with you.
• To comply with our legal obligations, including the Tax Administration Act, the Companies Act, the Financial Intelligence Centre Act (client identification and record-keeping) and the rules of our professional bodies.
• To operate, secure and improve the website — our legitimate interest in keeping the site available, preventing abuse and understanding how it is used.

We do not use your personal information for direct marketing unless you have asked us to, and we never sell it.

5. Uploaded documents

The quote form asks for bank statements where we need them to quote accurately: existing financial statement or bookkeeping work, income tax returns, VAT-registered clients and bank revenue confirmation letters (for the bank’s requested period). Previous financial statements, VAT reports, SARS letters, design references and records for a general enquiry are optional. Registration and design enquiries need no uploads. Application documents and formal mandates are requested after engagement. By uploading a record that contains personal information about other people (for example, employees, customers or suppliers appearing on bank statements), you confirm that you are authorised to share it with us for the purpose of obtaining a quote.

Uploads are transmitted over an encrypted (HTTPS) connection and delivered, together with your answers, to our practice mailbox in Microsoft 365. Where our website host’s secure, private file storage is used to receive large uploads, documents are held there only until they have been delivered to us and are then deleted automatically — and in any event within 24 hours. If our email service is briefly unavailable, your request and documents are kept in that private storage only until they reach our mailbox. A single document too large to send by email is kept there for no more than 30 days so that we can download it through a private, expiring link, and is then deleted. From our mailbox they are handled in the same secure systems we use for client work. Uploaded documents are not published, indexed or shared with anyone outside MGB Accounting except as described in section 6.

6. Who we share it with

We share personal information only where necessary, with:

• Service providers (operators) who process information on our behalf and under our instructions: Microsoft (Microsoft 365 email and document storage), the company that hosts this website, Cloudflare (the security check on our forms, see section 11) and — only if you accept analytics cookies — Google (Google Analytics). Operators may not use your information for their own purposes.
• Regulators and authorities such as SARS and the CIPC, where you engage us to act for you or where the law requires disclosure.
• Professional advisers (for example our own legal or IT advisers), bound by confidentiality, when we need their assistance.

7. Storage outside South Africa

Our email, document storage and website hosting providers may store information on servers located outside South Africa. Where this happens, section 72 of POPIA is complied with: the providers are bound by contractual terms and data-protection frameworks that give your information a level of protection substantially similar to POPIA, and the transfer is necessary to provide the services you request.

8. How long we keep it

• Quote requests that do not lead to an engagement: we keep your details, answers and uploaded documents for 12 months from the date of your request so that we can follow up and re-quote if you come back to us. After that they are securely deleted.
• Clients: information and documents relating to work we perform for you are retained for the periods required by law — generally five years from the date of submission or the end of the relevant tax period under the Tax Administration Act, and longer where the Companies Act, FICA or our professional rules require it.
• Website logs: technical logs are kept by our hosting provider for a short period for security and troubleshooting purposes.

9. How we protect it

We take appropriate, reasonable technical and organisational measures to protect personal information, including encrypted connections to this website, multi-factor authentication on our Microsoft 365 environment, access limited to staff who need it, and up-to-date devices and software. No method of transmission or storage is completely secure; if we become aware of a security compromise affecting your personal information we will notify you and the Information Regulator as required by section 22 of POPIA.

10. Your rights

Under POPIA you have the right to:

• ask whether we hold personal information about you, and request access to it;
• ask us to correct or delete personal information that is inaccurate, out of date, incomplete or excessive;
• object, on reasonable grounds, to our processing of your personal information;
• withdraw consent you have given (this does not affect processing that took place before you withdrew it);
• not to have your personal information used for direct marketing without your consent; and
• lodge a complaint with the Information Regulator.

To exercise any of these rights, email our Information Officer at [email protected]. We may need to verify your identity before acting on a request. Requests for access to records are handled in terms of the Promotion of Access to Information Act (PAIA); our PAIA manual is available on request.

If you are not satisfied with how we have handled your personal information, you may complain to the Information Regulator (South Africa): Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191; tel 010 023 5200; [email protected] (complaints) or [email protected] (enquiries).

11. Cookies

Essential. We use browser storage that is strictly necessary for the site to work — for example, to remember your cookie choice, and to keep your quote-form answers in that browser tab while you move between the steps, so nothing is lost if you go back. The form answers stay on your device, are never sent anywhere until you submit, and are cleared when you submit the form or close the tab. These do not need your consent.

Security check. Our contact and quote forms are protected by Cloudflare Turnstile, which checks technical information about your browser and connection (such as your IP address) to tell genuine visitors apart from automated spam. It is used only for that purpose, not for advertising, and does not set tracking cookies.

Analytics — only with your consent. If you click “Accept analytics” on our cookie notice, we use Google Analytics to understand how visitors use the site (for example which pages are read and how people arrive), so that we can improve it. Google Analytics sets cookies named _ga and _ga_<id> that last up to two years, and we keep analytics data for no longer than 14 months. It is not used for advertising, and Google signals and ad personalisation are switched off. If you decline, no analytics cookies are set. You can change your choice at any time through “Cookie settings” at the foot of every page.

We do not use advertising or social-media tracking cookies.

12. Other matters

Children. This website and our services are directed at businesses and adults. We do not knowingly collect personal information from children under 18 through this website.

Links to other sites. Our site may link to third-party websites (for example SARS, CIPC or our social media pages). We are not responsible for their content or privacy practices.

Changes to this policy. We may update this policy from time to time. The date at the top shows when it was last revised; material changes will be highlighted on this page.