Privacy Policy

1. Who we are

BisAcc Bookkeeping ("BisAcc", "we", "us" or "our") is a family-run bookkeeping practice based in Betty's Bay, Western Cape, South Africa. BisAcc Bookkeeping is a trading name of Roxanne De Coning, a sole proprietor. We provide cloud-based bookkeeping services to small and medium businesses.

For the personal information described in this policy, we are the "responsible party" under the Protection of Personal Information Act 4 of 2013 ("POPIA"). This means we decide why and how that information is processed, and we are accountable for protecting it.

For more on your rights under POPIA and how to use them, see our POPIA page.

2. Who this policy applies to

This policy applies to personal information about:

• people who visit our website or contact us;
• prospective and current clients, and the people who work for or represent them; and
• people whose information appears in our clients' records, such as employees, customers and suppliers.

When we process information about a client's employees, customers or suppliers as part of our bookkeeping services, we usually do so on the client's behalf. How that works is explained on our POPIA page.

3. Information we collect

When you contact us

If you get in touch by email, WhatsApp or through the contact form on our website, we receive the details you choose to give us. This is usually your name, business name, email address, phone number, the package you're interested in and your message.

When you become a client

To provide our services, we collect and process the information needed to keep your books. Depending on the services you use, this may include:

• Contact and business details: names of owners, directors and contact people; addresses; company registration, VAT and income tax reference numbers.
• Financial records: bank and credit card statements, invoices, receipts, ledgers, asset and stock records, and similar documents.
• Customer and supplier information: names, contact details, account balances and transaction histories.
• Payroll information about your employees (if we run payroll for you): names, ID or passport numbers, income tax numbers, contact details, bank account details, salaries, deductions and leave records.

We ask only for what we need to do the work you've engaged us for.

4. Our website

• No tracking or analytics: our website does not use cookies, analytics tools or advertising trackers.
• Fonts: our website uses Google Fonts. When a page loads, your browser connects to Google's servers to download the fonts, which means Google receives technical information such as your IP address and browser type. See Google's Privacy Policy for how Google handles this.
• Server logs: like most websites, our hosting provider may automatically record basic technical information, such as IP addresses, the pages requested and the date and time. This is used to keep the website running and secure.

5. How we use your information

We use personal information only for specific, lawful purposes:

We do not sell, rent or trade personal information. We don't make decisions about people based solely on automated processing.

6. Who we share it with

We share personal information only when it's needed for the purposes above, and only with:

• Our registered tax practitioner partner: VAT, PAYE and income tax submissions are handled by our independent tax partner. We share the relevant records with them when they are handling your tax submissions.
• The South African Revenue Service (SARS) and other authorities: through our tax partner as part of your submissions, or directly where the law requires it.
• Software and service providers that help us deliver our services, such as Intuit QuickBooks Online (or other accounting software you use, such as Xero, Sage or Pastel), email and cloud storage providers, and WhatsApp for messages you send us that way.
• People you ask us to share with, such as your accountant, auditor or bank.
• Others where the law requires it, for example under a court order.

Where a provider processes personal information for us (an "operator" under POPIA), we require them to keep it confidential and secure and to use it only for the purpose we provide it for.

7. Information stored outside South Africa

Some of the providers we rely on, including cloud accounting software, email services and messaging apps, may store information on servers outside South Africa. When this happens, we make sure the transfer is allowed under section 72 of POPIA. In practice, that means the provider is subject to data protection laws or binding agreements that give protection substantially similar to POPIA, or you have consented to the transfer.

8. How we protect it

Financial and payroll records are sensitive, and we treat them that way. We take appropriate, reasonable technical and organisational measures to protect personal information against loss, damage, and unauthorised access or use. These include:

• using reputable, secure cloud-based software rather than paper files or unsecured spreadsheets;
• protecting accounts with strong passwords and, where available, multi-factor authentication;
• limiting access to the people who need it to do the work; and
• keeping client information confidential.

Please don't send us your online banking passwords, PINs or one-time PINs (OTPs). We will never ask for them.

If we have reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and the people affected as soon as reasonably possible, as POPIA requires.

9. How long we keep it

We keep personal information only for as long as we need it for the purpose it was collected for, or for as long as the law requires.

• Client financial and tax records are kept for at least five years, in line with South African tax legislation, or longer where another law or our agreement with you requires it.
• Enquiries that don't lead to an engagement are deleted within 12 months, unless you ask us to keep in touch.

When information is no longer needed, we delete or destroy it securely, or de-identify it so it can no longer be linked to you.

10. Your rights

Under POPIA you have the right to:

• ask whether we hold personal information about you, and request access to it;
• ask us to correct, update or delete information that is inaccurate, out of date, incomplete or held without a lawful reason;
• object to us processing your information, on reasonable grounds;
• object to direct marketing at any time; and
• lodge a complaint with the Information Regulator.

Our POPIA page explains how to make a request.

11. Marketing

We don't send marketing messages unless you've agreed to receive them, or you're an existing client and the message is about similar services we offer. Every marketing message will give you an easy way to opt out.

12. Children

Our services are for businesses and are not directed at children. We don't knowingly collect personal information from children, except where it appears in a client's records (for example, payroll records) and is processed as part of our services.

13. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated at the top.

14. Contact us

If you have any questions about this policy or how we handle your personal information, please contact our Information Officer:

If you're not satisfied with our response, you can lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za.