Last updated: 6 September 2026 · Version 1.0
This policy explains how Kompliant, a South African sole proprietorship carried on by <Owner's full name> ("we", "us"), collects, uses, shares and protects personal information in terms of the Protection of Personal Information Act 4 of 2013 ("POPIA"). You may ask us anything about this policy through our contact form.
Kompliant (carried on by <Owner's full name>) is the responsible party for personal information we collect from our own customers and website visitors. Our Information Officer is <Owner's name as Information Officer>, contactable via our contact form. In line with section 55 of POPIA, we register our Information Officer with the Information Regulator and keep that registration current.
Where you upload employee or customer information for us to process to deliver the service, we act as an operator under POPIA and use that information only on your lawful instructions.
| Information | Why (lawful basis) |
|---|---|
| Account info (name, company, email, phone, address) | To provide the service and send reminders; contract + legitimate interest |
| WhatsApp contact (opt-in only) | Reminders; express consent (POPIA 2025 requirements) |
| Payroll / employee data you upload for the Return of Earnings | To compute COIDA figures; on your instructions as operator + contract |
| Payment details (card) | Billing; contract (processed by PCI-DSS-compliant providers) |
| Director ID / passport copies & personal details (for company registration only) | To prepare and submit your CIPC incorporation; contract (express instruction). We request a certified copy not older than 3 months, as CIPC requires it. We do not keep the document any longer than necessary — see Retention. |
| Usage, device and log data | Security, support and improving the product; legitimate interest |
Every external processor is bound by an operator/data-processing agreement and our sub-processor list is available on request.
We use HTTPS, encryption in transit and at rest, access controls, backups and logging. We review safeguards regularly. No system is perfect; if a breach occurs that is likely to cause harm to you, we will notify the Information Regulator and affected data subjects as required by POPIA.
We keep personal information only as long as needed for the purposes above or as required by law, after which it is securely deleted or anonymised. When you close your account, we delete active account data within 30 days unless we must retain records by law (for example tax records are kept at least 5 years).
Director ID / passport copies (company registrations): we retain these only for the duration of the registration and for no longer than 90 days after the incorporation is confirmed — whichever is sooner — then securely delete them. This is the minimum needed to correct any CIPC query after filing.
Under POPIA you may:
We respond to requests free of charge within 30 days (POPIA regulation 5). Use our contact form or your dashboard.
We have a PAIA Section 51 Manual at /paia. You can request records under the Promotion of Access to Information Act 2 of 2000; the manual explains the process and fees.
We use minimal cookies for login/security and optional analytics. Third-party advertising cookies are not used. You can delete cookies in your browser.
We store customer data in South Africa where possible. WhatsApp messages are processed by Meta's servers; by opting in you consent to transfer to authorised WhatsApp servers under POPIA conditions.
We update this policy as the law changes (including the POPIA 2025 amendments). We publish the new "last updated" date and notify you by email for material changes.
Contact our Information Officer first; we resolve complaints within 30 days. If we cannot, you may complain to the Information Regulator (inforegulator.org.za), whose office enforces POPIA and PAIA.