Privacy Policy

1. Introduction

Your trust is the foundation of our practice. This policy explains, in plain language, how Mahapa Financial Advisory Services CC ("Mahapa Financial", "we", "us") collects, uses, shares and protects personal information, and what rights you have under the Protection of Personal Information Act, 2013 ("POPIA").

It applies to anyone whose personal information we process — clients, prospective clients, employees, suppliers, and visitors to our website at mahapafinancial.co.za.

2. Who we are

Mahapa Financial is a private financial advisory practice based in Polokwane, Limpopo. We are licensed by the Financial Sector Conduct Authority (FSCA) under FSP 6604. For the purposes of POPIA, we are the Responsible Party for the personal information described in this policy.

3. Information we collect

We collect only what we need to provide good advice and to meet our legal obligations. Depending on our relationship with you, that may include:

• Identity information — name, ID or passport number, date of birth, marital status, dependants
• Contact information — email, phone, postal and physical addresses
• Financial information — income, expenses, assets, liabilities, banking details, tax records
• Investment information — risk profile, investment goals, holdings, beneficiaries
• Insurance information — health information necessary for underwriting (with consent), existing policies
• Employment information — employer, occupation, salary structure
• Compliance information — FICA documents, source of funds, tax residency
• Website data — IP address, browser, pages visited, cookies (see section 12)

We collect this information directly from you, from your authorised representatives, from product providers (with your consent), and from public registers where the law allows.

4. How we use your information

• To provide financial advisory and intermediary services
• To verify identity and conduct due diligence under FICA
• To administer policies, investments and transactions
• To communicate with you about your portfolio, market updates and our services
• To meet regulatory and legal obligations (FAIS, FICA, POPIA, SARS)
• To detect, investigate and prevent fraud and other unlawful activity
• To improve our website and the services we offer

5. Our lawful basis for processing

Under POPIA, we only process personal information where one or more of the following applies:

• Consent — you have given us your informed, voluntary consent
• Contract — processing is necessary to perform a contract we have with you
• Legal obligation — processing is required by law (e.g. FICA, tax)
• Legitimate interest — processing is necessary for our legitimate interests, balanced against your rights
• Protecting your interest — processing protects your legitimate interest

6. Who we share your information with

We do not sell or rent your personal information. We may share it, only where lawful and necessary, with:

• Product providers and underwriters (e.g. Old Mutual, ITransact, Auto & General) when transacting on your behalf with your consent
• Regulators and authorities — FSCA, FIC, SARS, the Information Regulator
• Professional advisers — auditors, compliance officers, attorneys
• Operators acting on our behalf — IT, hosting, email, CRM and analytics providers, all bound by appropriate confidentiality and security obligations
• A successor in the event of a merger, acquisition or restructure

7. International transfers

Some of the cloud-based service providers we use store information outside South Africa. Where we transfer personal information across borders, we do so only in accordance with section 72 of POPIA — meaning the recipient is subject to laws, binding corporate rules or binding agreements that provide an adequate level of protection, or you have consented.

8. How long we keep your information

We keep personal information for as long as necessary to fulfil the purposes set out in this policy and to meet our legal and regulatory obligations. Where applicable, retention periods are set by FAIS, FICA, the Companies Act and the Tax Administration Act — typically five years from the end of our relationship with you, and longer for certain records.

9. Security

We implement appropriate technical and organisational measures to protect personal information against loss, unauthorised access, alteration or disclosure, including access controls, encryption in transit, secure backups, staff training, and regular review of security practices. No system is perfectly secure, but we work continuously to keep yours safe.

If a security compromise occurs that creates a real risk of harm to you, we will notify you and the Information Regulator as required by section 22 of POPIA.

10. Your rights

You have the right, under POPIA, to:

• Access your personal information that we hold
• Correct information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained
• Delete information that is no longer required (subject to our legal retention obligations)
• Object to processing on reasonable grounds, including for direct marketing
• Withdraw consent you have previously given, where we rely on consent
• Lodge a complaint with the Information Regulator

To exercise any of these rights, contact our Information Officer at [email protected]. Formal access requests are handled through our PAIA Manual.

11. Children

We do not knowingly collect personal information of children under 18 except in the context of providing services to a parent or guardian (e.g. life cover beneficiaries, education plans). Where this happens, we rely on the consent of the parent or legal guardian.

12. Cookies

Our website uses cookies and similar technologies to keep the site functional and to understand how it's used. For details — including how to opt out — see our Cookie Policy.

13. Changes to this policy

We may update this policy as our practice or the law changes. The "Last updated" date at the top tells you when. Significant changes will be communicated by email to clients or via a notice on our website.

14. Contact us

If we cannot resolve a privacy concern to your satisfaction, you may complain to the Information Regulator at inforegulator.org.za or [email protected].