Privacy Policy

Effective from: 1 July 2026

Version: 2.0

1. About this Privacy Policy

This Privacy Policy explains how Taxspace handles personal information. We have written it in plain language so that it is useful to advisers, their clients, and anyone visiting our website.

It covers three groups of people:

• Site visitors. Anyone who visits taxspace.app or my.taxspace.app.
• Adviser users. Financial advisers, financial planners, and the paraplanners and administrators who use the Taxspace platform.
• Clients of advisers. Individuals whose information is uploaded to Taxspace by their financial adviser or planner as part of a planning scenario.

The way Taxspace handles information differs for each of these groups, and we explain each one separately below.

2. Who we are

Taxspace is operated by:

Taxspace (Pty) Ltd

Registration number: 2021/560888/07

Registered address: 57 Main Road, Paarl, Western Cape, South Africa, 7646

General contact: contact@taxspace.app

Information Officer: information-officer@taxspace.app

In this Privacy Policy, “Taxspace,” “we,” “us,” and “our” refer to Taxspace (Pty) Ltd. “You” and “your” refer to the person whose information is being processed, in the context of the relevant section.

3. Our role under POPIA

The Protection of Personal Information Act 4 of 2013 (POPIA) is the South African law that governs how personal information is handled. Under POPIA, Taxspace plays two different roles depending on whose information is being processed.

Taxspace is the Responsible Party for:

• Site visitor information.
• Adviser user information, including account details, billing details, and support communications.
• Marketing communications we send.

Taxspace is the Operator for:

• Information about a Client that has been uploaded to Taxspace by their financial adviser or planner.

When Taxspace acts as an Operator, the adviser or planner is the Responsible Party, and we process Client information on their instructions. The separate Operator Agreement governs that relationship.

4. Our Information Officer

The Information Officer for Taxspace is:

Francois Adriaan Du Toit

57 Main Road, Paarl, Western Cape, South Africa, 7646

Email: information-officer@taxspace.app

You can contact the Information Officer at any time about anything in this Privacy Policy or about any data protection question.

5. Information we collect from site visitors

When you visit our websites, including taxspace.app and my.taxspace.app, we may collect:

• Your IP address.
• The date and time of your visit.
• The pages you accessed.
• The type of browser and operating system you are using.
• Information sent by the cookies we use (see clause 11 below).

We use this information to keep the site secure, to fix technical problems, and to improve the way the site works. Site visitor logs are retained for 30 days and then deleted. Our legal basis for this processing is our legitimate interest in operating and protecting our service.

If you fill in a contact form or subscribe to our newsletter, we will also collect the information you provide in the form. We use that information to respond to you or to send you the newsletter. You can unsubscribe from the newsletter at any time using the link at the bottom of any newsletter email.

6. Information we collect from adviser users

When you sign up for a Taxspace account, we collect:

• Your name, email address, phone number, and other contact details you provide.
• Your firm’s name and details where you provide them.
• Your login credentials. Your password is stored using industry-standard hashing and salting through Firebase Authentication, which means we cannot see it.
• Billing information, which is collected and processed by our payment provider and our accounting provider on our behalf.
• Information about how you use the platform, including features used, reports generated, and dates of activity.
• Any messages or information you send us through support channels.

We use this information to:

• Provide and improve the Taxspace platform.
• Set up your account and authenticate you when you log in.
• Take payment of your subscription fee and issue invoices.
• Communicate with you about your account, including service updates and important notices.
• Provide support when you need it.
• Send you marketing communications about Taxspace, where you have agreed to receive them.
• Comply with our legal obligations.

Our legal bases for processing your information are, depending on the context, performance of our contract with you, your consent (for marketing), and our legitimate interests in running and improving the service.

7. Information we process about Clients of advisers

When an adviser uses Taxspace to support their advice to a Client, they may upload information about that Client. This typically includes:

• Identifying information such as name and identity number where it appears on uploaded documents.
• Financial information such as income, tax assessment data, lump sum amounts, property values, loan amounts, and investment values.
• Family or planning information such as details of dependants, where relevant to a scenario.

When we process this information, we do so as an Operator on the adviser’s behalf. The adviser is the Responsible Party. This means:

• The adviser decides what information to upload and what to do with it.
• The adviser is responsible for having a lawful basis under POPIA to process the information, and for telling their Client how their information is handled.
• Taxspace processes the information only on the adviser’s instructions, in line with the Operator Agreement.

If you are the Client of an adviser and you have a question about how your information is being used in Taxspace, please speak to your adviser first, as they are the Responsible Party. You can also contact our Information Officer, and we will support your adviser in responding to you.

8. How we use anonymised and aggregated data

We may create anonymised and aggregated data from the information held in Taxspace and use it for purposes that benefit the platform and the financial advice profession, including analysing trends, producing industry insights, improving the platform, and researching and developing new features, including features that use artificial intelligence or machine learning.

Anonymised data is data that has been processed so that it cannot be used to identify any individual. Once data is properly anonymised, it is no longer personal information under POPIA.

We do not, and will not:

• Sell or rent personal information in identifiable form.
• Use a Client’s personal information in identifiable form to train any artificial intelligence or machine learning model.
• Publish any insight, report, or benchmark in a form that identifies any individual adviser or Client.

The full position on anonymised data, and the safeguards we apply, is set out in the Operator Agreement.

9. Who we share information with

We use a small number of trusted service providers to help us run Taxspace. These providers help with things like hosting, database and file storage, email delivery, payment processing, error tracking, customer support, workflow automation, and accounting.

A current list of our service providers, what they do, and where they are based, is available on request by emailing our Information Officer at information-officer@taxspace.app.

We may also share information:

• With our professional advisers (such as lawyers and accountants), where reasonably needed.
• Where required to do so by law, by a regulator, or by a court.
• As part of a sale, merger, or restructure of our business, in which case the recipient will be bound by terms no less protective than this Privacy Policy.

We do not sell personal information to anyone.

10. International transfers

Some of our service providers are based outside South Africa, including in the European Union. Certain hosting and email delivery services process personal information in the European Union, while our primary database storage is in South Africa.

Where we transfer personal information outside South Africa, we do so on one or more of the bases set out in Section 72 of POPIA, including that the recipient is subject to laws (such as the General Data Protection Regulation in the European Union) or binding agreements that give adequate protection, or that the transfer is necessary for the performance of a contract with you.

A current list of our service providers and the countries in which they process information is available on request by emailing our Information Officer at information-officer@taxspace.app.

11. Cookies

A cookie is a small text file that is stored on your device when you visit a website.

Taxspace uses cookies only where they are strictly necessary for the platform to work. The cookies we use are:

• Firebase Authentication cookies: used to keep you signed in to the Taxspace platform and to keep your session secure.
• Crisp support cookies: used by our live chat support tool to maintain a support session when you contact us through the chat widget.

We do not use analytics cookies, advertising cookies, or tracking cookies of any kind.

Because the cookies we use are strictly necessary for the operation of the platform, your consent is not required under the Electronic Communications and Transactions Act, and we do not show a cookie consent banner. If you block these cookies in your browser, you will not be able to sign in to Taxspace or use the support chat.

12. How long we keep information

We keep personal information only for as long as we need it. The main retention periods are:

• Site visitor logs: 30 days, then deleted.
• Application and error logs: 30 days, then deleted.
• Adviser account information: retained for as long as your account is active.
• Client information uploaded by an adviser: retained while the adviser’s account is active. If the adviser cancels their subscription, the information is retained for a further 90 days, during which the adviser may reactivate the account or request an export of the data. After the 90 days, the information is permanently deleted.
• Billing and tax records: retained for the periods required by South African tax and commercial law.
• Marketing data: retained until you unsubscribe.

Where the law requires us to keep information for longer than these periods, we will do so, and we will continue to apply this Privacy Policy to that information for as long as it is held.

13. How we keep information safe

We take security seriously. The measures we have in place include:

• Encryption of personal information in transit and at rest.
• Secure password storage using industry-standard hashing and salting through Firebase Authentication.
• Role-based access controls so that only the right people have access to the right information.
• Hosting on Google Cloud, which holds ISO 27001, SOC 2, and SOC 3 certifications, and provides built-in storage redundancy.
• Logging of access and key user actions on the platform, with logs retained for 30 days.
• Automated daily scanning of application dependencies for known security vulnerabilities.
• Monitoring of our hosting infrastructure for failures and security events.
• Ongoing attention to security notifications from our service providers, and action where needed.

If a security compromise affects your personal information, we will notify you in line with our obligations under POPIA.

14. Your rights under POPIA

Under POPIA, you have a number of rights in relation to your personal information. These include:

• The right to be told what personal information we hold about you and how we use it (Sections 23 and 24).
• The right to correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained (Section 24).
• The right to object to the processing of your personal information on reasonable grounds (Section 11(3)).
• The right to object to direct marketing and to withdraw consent to direct marketing at any time (Section 69).
• The right to withdraw consent that you have given, at any time (Section 11(2)(b)).
• The right to submit a complaint to the Information Regulator if you believe your rights have been infringed.

To exercise any of these rights, please contact our Information Officer at information-officer@taxspace.app.

If you are a Client of an adviser and your rights relate to the information your adviser has uploaded to Taxspace, please speak to your adviser first, as they are the Responsible Party.

15. Complaints to the Information Regulator

If you are not satisfied with the way we have handled your information, you have the right to lodge a complaint with the Information Regulator of South Africa.

Information Regulator (South Africa)

Website: inforegulator.org.za

Complaints email: complaints.IR@inforegulator.org.za

General enquiries email: enquiries@inforegulator.org.za

We would always prefer to resolve a concern with you directly, so please contact our Information Officer first if you can.

16. Children

Taxspace is a professional planning tool and is not designed for use by children. We do not knowingly collect personal information directly from children.

Some planning scenarios uploaded by advisers may include information about minor children, such as dependants in a tax or planning calculation. Where this happens, the adviser is the Responsible Party for that information and is responsible for making sure the upload is lawful under POPIA.

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, in the law, or in the platform. When we do, we will:

• Update the “Effective from” date and the version number at the top.
• Notify users of material changes through the platform or by email.
• Give reasonable notice before material changes take effect.

We encourage you to review this Privacy Policy from time to time.

18. How to contact us

If you have any question about this Privacy Policy or about how we handle your personal information, please contact:

Taxspace (Pty) Ltd

Information Officer: Francois Adriaan Du Toit

57 Main Road, Paarl, Western Cape, South Africa, 7646

Information Officer email: information-officer@taxspace.app

General contact: contact@taxspace.app