Privacy Notice

Black Heath Advisory Inc. (registration number 2013/084518/21) is the responsible party for the personal information described in this notice.

16 Invicta Road, Thandanani Office Park, Midrand, 1685, Gauteng, South Africa.
Telephone: 010 502 0108.
Email: info@blackheathadvisory.co.za

We are registered with the South African Institute of Chartered Accountants (SAICA) and with the South African Revenue Service (SARS).

Information Officer: Mr N. Musekwa. You can reach the Information Officer at info@blackheathadvisory.co.za or on 010 502 0108.

This notice explains how we handle personal information when you visit blackheathadvisory.co.za, contact us through the website, or use the assistant on our Contact page.

Personal information we process during a professional engagement, for example audit, tax or advisory work, is governed by our engagement letter and by our professional obligations. It is not the subject of this notice.

When you complete the Contact form, we collect what you enter: your name, email address and message, which are required, and your organisation, telephone number, service interest and preferred contact method, which are optional. We also record the consent selections you make.

When you use the website assistant, we process the text of the questions you type. The assistant is intended for general questions about our services. Please do not enter personal, confidential or financial information into it.

Technical information. Our security provider processes your IP address and basic browser signals in order to tell genuine visitors apart from automated abuse.

What we do not do. This website sets no cookies, uses no analytics or tracking software, and carries no advertising or social media trackers. We do not build a profile of you and we do not track you across other websites.

We use what you submit to respond to your enquiry, to provide the information or proposal you have asked for, to arrange a scoping call where you request one, and to keep a record of the enquiry and our response. We send marketing communications only where you have separately opted in.

Our lawful basis is your consent, given when you submit the form, together with our legitimate interest in responding to enquiries addressed to us. Where the law requires us to retain records, our basis is compliance with that obligation.

Yes. You are not obliged to complete the Contact form or to use the assistant. If you choose not to provide the required fields we will not be able to respond, because we would have no way of identifying you or replying. There is no other consequence.

We use a small number of service providers, called operators under the Protection of Personal Information Act 4 of 2013, who process personal information on our instruction and are contractually prohibited from using it for their own purposes. We do not sell personal information and we do not share it for advertising.

Cloudflare, Resend, Anthropic and Google may process data outside South Africa. We rely on their contractual undertakings to maintain a level of protection substantially similar to that required by POPIA, as contemplated in section 72(1)(a).

We do not use your information for automated decision-making that has legal consequences for you.

We may also disclose information where the law requires it, or to our professional advisers where necessary.

Your enquiry is processed outside South Africa before it is stored here. When you submit the Contact form, the enquiry is handled by a Microsoft workflow service located in Europe, and is then stored in SharePoint, which holds our data in South Africa under a South Africa data residency commitment.

Other supporting services also process personal information outside South Africa. This applies to delivery of the notification email, the website assistant, the security check, and the typefaces used on this site.

All of these are cross-border transfers for the purposes of section 72 of POPIA. We make them on two bases. First, you consent to them when you submit the Contact form, having been told in this notice that they take place. Second, the transfer is necessary in order to do the very thing you have asked us to do, which is to receive your enquiry and respond to it. Each provider named above is engaged under its own data protection terms.

If you would prefer that your information is not handled in this way, please contact us by telephone or by post instead of using this website.

We keep enquiry records for 12 months from our last contact with you, unless your enquiry becomes a professional engagement. In that case the records form part of the client file and are kept for the longer periods required by South African law, principally the Companies Act 71 of 2008 and the Tax Administration Act 28 of 2011.

Records of your consent, and of any withdrawal of consent, are kept for 3 years after the enquiry record itself, so that we can demonstrate that we honoured your choices.

The website assistant does not store your conversation. Information used to block automated abuse of the site is transient and expires automatically within two minutes.

When a retention period ends we delete the information, or anonymise it so that it can no longer identify you.

This website is served over an encrypted connection, and enquiries are transmitted over encrypted channels. Access to enquiry records is limited to personnel who need it in order to respond. The site is protected by an automated abuse check and by rate limiting.

No system is completely secure. If a security compromise affects your personal information, we will notify you and the Information Regulator as required by section 22 of POPIA.

Under POPIA you have the right to:

• ask what personal information we hold about you, and be given a copy of it (section 23);
• ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (section 24);
• object to our processing of your information on reasonable grounds (section 11(3));
• withdraw your consent at any time, which does not affect processing already carried out; and
• complain to the Information Regulator (section 74).

To exercise any of these rights, contact us at info@blackheathadvisory.co.za. We may ask you to verify your identity before we act on a request. A request for access may attract a prescribed fee.

We will only send you marketing communications if you have specifically opted in. Every marketing message includes an unsubscribe option, and you may opt out at any time at no cost by replying or by emailing us. This is in line with section 69 of POPIA.

If you are not satisfied with how we have handled your personal information, please contact us first so that we can try to resolve it. You also have the right to complain directly to the Information Regulator.

The Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Email: enquiries@inforegulator.org.za
Telephone: 010 023 5200
Toll free: 0800 017 160
inforegulator.org.za

We may update this notice from time to time. The version published on this page is the current one, and the date at the top shows when it last changed.

Black Heath Advisory Inc.
16 Invicta Road, Thandanani Office Park, Midrand, 1685, Gauteng
Telephone: 010 502 0108
Email: info@blackheathadvisory.co.za