Tax work depends on trust. This policy explains how SureCare collects, uses, shares and protects the personal information of visitors to this website and of our clients, in line with the Protection of Personal Information Act 4 of 2013 (“POPIA”). Our POPIA Notice sets out your rights and how to use them.
1. Who is responsible for your information
Sure Care Consulting (Pty) Ltd (“SureCare”, “we”, “us”), registration number 2016/005870/07, of 39 Polo Crescent, Leeuwenhof Estate, Silver Lakes, Pretoria, 0054, is the responsible party for personal information collected through this website and in the course of providing our tax services. Our Information Officer is Danie van den Berg, who can be reached at danie@surecare.co.za or 060 758 0000.
2. What we collect
Website visitors and enquiries
When you submit our contact form, or email or phone us, we collect:
- your name and email address;
- your phone number, if you choose to provide it;
- the province you are in, so that we know where our clients are based;
- the service you need help with;
- what you tell us in your message; and
- your agreement to this policy.
Please do not send identity numbers, tax documents, banking details or health information through the contact form. We will tell you how to share documents securely once we take on your matter.
Clients
To prepare returns and deal with the South African Revenue Service (“SARS”) for you, we need more detailed information, which may include:
- identity information, such as your full name, identity or passport number and date of birth;
- tax reference numbers, and your registration details with SARS;
- contact details and physical and postal addresses;
- income and financial information, such as IRP5/IT3(a) certificates, investment and interest certificates, rental income and expenses, business records, financial statements and asset disposals;
- banking details, where SARS requires them or you ask us to update them;
- information about your employer, retirement funds, medical scheme, insurers and other third parties that issue tax certificates;
- for companies and trusts: information about directors, members, trustees, beneficiaries and beneficial owners;
- information about your spouse, dependants or other people, where it is relevant to your tax affairs (see section 5); and
- our correspondence with you, and correspondence with SARS on your behalf.
Technical information
When you visit the website, we and our service providers also process:
- technical information, such as your IP address, browser and device details and request logs, to deliver and protect the website;
- information needed to check that form submissions come from a person (see section 7);
- the cookie choice stored in your browser; and
- if you consent, anonymous visitor statistics (see section 6).
3. How we use your information and why we may do so
- To respond to your enquiry and give you a quote: with your consent, and to take steps towards a contract at your request.
- To provide our tax services, including preparing and submitting returns, and corresponding and dealing with SARS for you: to perform our agreement with you.
- To meet our legal and professional obligations, including under the Tax Administration Act 28 of 2011, the rules of our recognised controlling body and anti-money laundering legislation: to comply with the law.
- To keep records of our work and correspondence, and to manage our practice: in our legitimate interest in running our business and protecting our legal rights.
- To protect the website and our forms from spam, fraud and automated abuse: in our legitimate interest, and yours, in a secure website.
- To understand how visitors use the website so that we can improve it: only with your consent.
These grounds are set out in section 11 of POPIA. We do not sell your personal information. Giving us your information is voluntary, but we cannot respond to an enquiry without your name, a way to contact you and a description of what you need. If you become a client, we cannot complete your tax affairs correctly without the information that SARS requires.
4. Special personal information
Some tax matters involve special personal information, as defined in POPIA. For example, claiming medical expenses or a disability-related deduction may require health information. We process special personal information only when it is needed for your tax affairs, and only with your consent or where it is necessary to establish, exercise or defend a right or obligation in law, as section 27 of POPIA allows. We keep it to the minimum required and restrict access to it.
5. Information about other people, including children
Your tax affairs may involve information about your spouse, children or other dependants, or the directors, trustees and beneficiaries of an entity. When you give us information about another person, you confirm that you are entitled to share it with us for this purpose and that, where appropriate, you have told them about this policy. Where information about a child is needed, for example a dependant on your medical scheme, we process it with the consent of the parent or guardian, as section 35 of POPIA requires.
6. Cookies and visitor statistics
Cookies are small files stored on your device. Similar technologies, such as browser storage, are treated in the same way in this policy. We group them as follows:
- Strictly necessary: required for security and for the website to work, and cannot be switched off. These include security technologies from Cloudflare that protect the website and our contact form against bots and abuse (see section 7), and browser storage that remembers your cookie choice.
- Analytics (optional): if you consent, we use Cloudflare Web Analytics to see how visitors use the website, such as pages viewed, referring websites, device type, country and page speed. It does not use cookies to identify you, does not build a profile of you and does not follow you across other websites.
- Marketing: we do not use advertising or marketing cookies. If we introduce them, we will update this policy and they will operate only with your consent.
| Name | Provider | Purpose | Type and duration |
|---|---|---|---|
| surecare-cookie-consent | SureCare | Remembers your cookie choice | Necessary · browser storage · 12 months |
| Turnstile | Cloudflare | Checks that the contact form is sent by a person | Necessary · runs on the contact page only |
| __cf_bm, cf_clearance | Cloudflare | Bot and abuse protection; set only when needed | Necessary · cookie · typically 30 minutes |
| Web Analytics | Cloudflare | Anonymous visitor statistics | Optional · cookieless · only with consent |
Optional technologies are off by default. You can accept, reject or choose categories when you first visit, and can change or withdraw your consent at any time using the Cookie settings link at the bottom of every page. Withdrawing consent does not affect anything done before you withdrew it. We keep your choice for 12 months and then ask you again. You can also block or remove cookies through your browser settings, but blocking strictly necessary technologies may stop parts of the website, such as the contact form, from working.
7. Website security and bot protection
When you use our contact form, Cloudflare Turnstile checks that it is being sent by a person and not an automated program. Most people never see this check. To do this, Cloudflare processes your IP address and technical information about your browser and device. We may also use your IP address to limit repeated submissions. We do this in our legitimate interest, and yours, in keeping the website free of spam and fraud. If the check cannot run, for example because a browser extension blocks it, you can email us at danie@surecare.co.za instead.
8. Who we share it with
We share personal information only as needed, with:
- SARS: when we submit returns, supporting documents, objections and other correspondence on your instruction;
- other authorities: such as the Master of the High Court or the Companies and Intellectual Property Commission, where your matter requires it and you have instructed us;
- your other advisers: such as your accountant, auditor, attorney or financial adviser, when you ask us to;
- our recognised controlling body: where required for professional oversight, quality reviews or the handling of complaints;
- service providers who act on our behalf, under confidentiality obligations: Cloudflare, Inc. (website hosting, security, processing form submissions, bot checks and, if you consent, visitor statistics), Resend (delivering form submissions to us by email), xneelo (hosting our email) and the IT and software providers that help us run our practice.
We may also disclose information where the law requires it, for example under the Tax Administration Act, the Financial Intelligence Centre Act 38 of 2001 or a court order, or where needed to protect our legal rights.
Cloudflare’s privacy policy and Resend’s privacy policy explain how those providers handle information.
9. Transfers outside South Africa
Cloudflare operates a global network, and Cloudflare and Resend may process information outside South Africa, including in the United States and the European Union. We make these transfers as permitted by section 72 of POPIA, subject to each provider’s data processing terms, and with your consent when you submit our form.
10. Direct marketing
We do not use enquiries to send marketing. We will send direct marketing only as section 69 of POPIA permits: with your consent, or to existing clients about our similar services, such as reminders about upcoming tax deadlines. Every marketing message will include a simple way to opt out, and you can object at any time by writing to danie@surecare.co.za.
11. Automated decisions
We do not make decisions about you based solely on automated processing. Your tax affairs are handled by a person.
12. How long we keep it
We keep enquiry information only for as long as needed to respond to you and for the related purposes above, and then delete or de-identify it. Client records are kept for as long as the law and our professional obligations require. The Tax Administration Act generally requires tax records to be kept for five years from the date a return is submitted, and longer where an audit, objection or appeal is in progress. After that, we securely destroy or de-identify them.
13. Security
We apply reasonable technical and organisational measures to protect personal information, including encrypted (HTTPS) connections, restricted access to our systems and mailboxes, bot protection and limits on repeated form submissions. We use our own registered tax practitioner access to SARS eFiling and will never ask for your eFiling password.
Protect yourself from fraud: we will never ask you to pay money into a new bank account by email alone. If you receive a message that appears to come from us asking you to change payment details, call us on 060 758 0000 before acting on it.
No online system is completely secure. If we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify you and the Information Regulator as section 22 of POPIA requires.
14. Your rights
You may ask whether we hold your personal information, request access to it, ask us to correct or delete it, object to its processing on reasonable grounds, object to direct marketing, and withdraw your consent. Some information must be kept by law even if you ask us to delete it, and we will explain this if it applies. Our POPIA Notice explains how to exercise your rights, and how to complain to the Information Regulator.
15. Changes to this policy
We may update this policy from time to time. The current version is always published on this page with its date.
16. Contact
Questions about this policy can be sent to our Information Officer, Danie van den Berg, at danie@surecare.co.za or 060 758 0000.