Privacy Policy.

Last updated: June 2025 · Effective date: 1 July 2021

1. Who We Are and How to Contact Us

Thamani Assurance Inc (“Thamani”, “we”, “us”, “our”) is a professional services firm registered in the Republic of South Africa. We are a registered audit firm with the Independent Regulatory Board for Auditors (IRBA) and a member firm of the South African Institute of Chartered Accountants (SAICA).

Information Officer: Nathan Maduna, Managing Director
Email: info@thamani-assurance.com
Phone: +27 (10) 157-1902
Address: Johannesburg, Gauteng, Republic of South Africa

2. Legal Framework

This Privacy Policy is governed by the Protection of Personal Information Act 4 of 2013 (POPIA) and the Promotion of Access to Information Act 2 of 2000 (PAIA). By engaging with our website, services or personnel, you acknowledge that your personal information will be processed in accordance with this policy.

3. Personal Information We Collect

We collect personal information only where it is necessary for a lawful purpose. The categories of information we may collect include:

• Identity information: full name, ID number, passport number, employer details
• Contact information: email address, phone number, physical and postal address
• Professional information: qualifications, employer, professional registration details
• Financial information: where required for audit or tax engagements, financial records, banking details
• Website usage data: IP address, browser type, pages visited, referral source (via cookies)
• Correspondence: emails, form submissions, meeting notes and other communications

We do not collect special personal information (race, religion, health, sex life, trade union membership, criminal record) unless strictly necessary and with your explicit consent or as permitted by law.

4. Lawful Bases for Processing

We process your personal information on one or more of the following lawful grounds under section 11 of POPIA:

• Consent: you have given specific, informed consent to the processing
• Contract: processing is necessary to perform or enter into a contract with you or your organisation
• Legal obligation: processing is required to comply with IRBA, SAICA, SARS, or other regulatory obligations
• Legitimate interest: processing is necessary for our legitimate business interests, provided those interests are not outweighed by your rights
• Public interest: where we carry out audit functions in the public interest

5. How We Use Your Information

We use personal information for the following purposes:

• Delivering professional services (audit, advisory, tax, cyber assurance) under engagement agreements
• Communicating with you about your engagement, proposals and invoices
• Complying with IRBA, SAICA, SARS and other regulatory and professional body requirements
• Conducting conflict of interest, independence and background checks required by professional standards
• Managing and improving our website and digital services
• Marketing our services to you where you have consented or where we have a legitimate interest (you may opt out at any time)
• Maintaining our quality management system as required by ISQM 1 and ISQM 2

6. Sharing of Personal Information

We do not sell, rent or trade your personal information. We may share information with:

• Regulatory bodies: IRBA, SAICA, SARS, the Information Regulator, and other authorities where legally required
• Professional advisers: attorneys, insurers and other professional service providers engaged to support our operations, under confidentiality agreements
• Technology partners: cloud service providers, software vendors and IT support partners who process data on our behalf under data processing agreements
• Engagement Quality Reviewers: registered auditors performing EQCR functions as required by ISQM 2, under professional confidentiality obligations
• Successors in interest: in the event of a merger, acquisition or restructuring of the firm

Where we share information across borders, we take reasonable steps to ensure equivalent protection is applied in accordance with section 72 of POPIA.

7. Cookies and Website Data

Our website uses cookies and similar technologies to improve your browsing experience and to collect anonymised analytics data. Cookies are small text files placed on your device. You may disable cookies through your browser settings; however, some website functionality may be affected.

We use the following categories of cookies:

• Strictly necessary: required for the website to function (e.g. session management)
• Analytics: anonymised usage statistics to help us improve the website
• Preferences: to remember your settings and preferences

We do not use advertising or tracking cookies. We do not share cookie data with third-party advertisers.

8. Retention of Personal Information

We retain personal information only for as long as necessary to fulfil the purpose for which it was collected, or as required by law. Our retention periods are:

• Audit working papers and engagement files: minimum 5 years after the audit report date, as required by IRBA Rule 3.3
• Tax records: minimum 5 years from the relevant tax year, as required by the Tax Administration Act
• Client correspondence and contracts: 5 years after the engagement concludes
• Website enquiry data: 12 months from the date of enquiry, unless an engagement follows
• Quality management records: minimum 5 years as required by ISQM 1

After the applicable retention period, we securely destroy or anonymise personal information.

9. Security of Personal Information

We implement reasonable technical and organisational measures to protect personal information against unauthorised access, disclosure, alteration or destruction. These measures include:

• Encrypted data transmission (HTTPS/TLS) on our website and digital communications
• Access controls limiting data access to authorised personnel on a need-to-know basis
• Regular security assessments of our systems and third-party service providers
• Staff training on data protection and information security obligations
• Incident response procedures in the event of a security breach

In the event of a data breach that poses a risk to your rights, we will notify the Information Regulator and affected data subjects in accordance with section 22 of POPIA.

10. Your Rights Under POPIA

As a data subject under POPIA, you have the following rights:

• Right of access: to request confirmation of whether we hold your personal information and to receive a copy
• Right to correction: to request correction of inaccurate, incomplete or misleading information
• Right to deletion: to request deletion of your personal information where we no longer have a lawful basis to retain it
• Right to object: to object to the processing of your personal information for direct marketing purposes
• Right to complain: to lodge a complaint with the Information Regulator if you believe we have processed your information unlawfully

To exercise any of these rights, contact our Information Officer at info@thamani-assurance.com. We will respond within 30 days. We may ask you to verify your identity before processing a request.

Information Regulator (South Africa):
Website: inforegulator.org.za
Email: inforeg@justice.gov.za

11. Direct Marketing

We may occasionally send you information about our services, regulatory updates and insights where you have consented or where we have a legitimate interest as a professional services provider. You may opt out of marketing communications at any time by emailing info@thamani-assurance.com or by using the unsubscribe link in any communication we send.

12. Access to Information (PAIA)

You have the right to request access to records held by Thamani Assurance Inc in terms of the Promotion of Access to Information Act 2 of 2000. Our PAIA Manual is available on request. Submit PAIA requests to our Information Officer at info@thamani-assurance.com.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal obligations or operational requirements. We will publish the updated version on this page with a revised effective date. We encourage you to review this policy periodically.

14. Contact

All privacy-related queries, access requests, objections and complaints should be directed to:

Information Officer — Thamani Assurance Inc
info@thamani-assurance.com
+27 (10) 157-1902
Johannesburg, South Africa