Loading document
This policy explains what personal information PayAnchor collects through TCMS, the Tax Compliance Management System, why, who sees it, where it is kept and for how long, and what your rights are. It covers the TCMS marketing site, the TCMS dashboard and the emails we send. Cookies and browser storage are covered separately in the Cookie Policy.
PayAnchor (Pty) Ltd (registration number 2021/718034/07, 22 Century Boulevard, Riversands, Johannesburg, South Africa) is the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA).
Our Information Officer can be reached at finance@payanchor.co.za, or by replying to any email we send you.
About you and the people in your Team. First name, last name, email address and phone number; role in the Team (Owner or Member); the sign-in links we send and when they were used; and the comments posted.
About each Profile. For an individual: tax reference number, residency status, South African ID number or passport number, and date of birth. For a business: registered name, display name, registration number, VAT number and financial year end. For both: the tax services selected, the band chosen, and the return types and tax years we handle.
Documents and schedules. The documents you upload or that staff request (IRP5s, medical scheme certificates, retirement fund certificates, bank statements, invoices, signed returns and similar), travel logbook entries, and the schedules you capture: rental income, business income, medical expenditure, home office and capital gains.
Billing. The DebiCheck mandate status, date and reference, charges, collection outcomes, referral codes and discounts, and disputes you raise. We do not store your bank account number in TCMS; the mandate is held by your bank and ours.
From SARS. Assessments, verification letters and other correspondence relating to a Profile, which we receive as your registered tax practitioner.
Usage. Server logs, error reports and, on the marketing site only and only with your consent, analytics. See the Cookie Policy.
Some of what you give us is special personal information under POPIA: medical expenditure and medical scheme certificates contain health information, and documents may show religious affiliation, race or other special categories. We process it only because it is necessary to prepare and submit your returns and to comply with tax law (POPIA sections 27(1)(b) and 32(1)(c)), and we do not use it for any other purpose.
Documents and schedules may contain information about other people: dependants on a medical scheme, employees on a payroll, a spouse on a joint bond, a driver in a logbook. You confirm you are entitled to share it with us for these purposes, and we process it only as described here.
We do not sell your personal information, and we do not use it for automated decision-making that has a legal effect on you.
Giving us this information is voluntary, but we cannot open or keep a Team, or submit a return, without it. If a document request goes unanswered we may not be able to submit a return on time, and the status of the return will show that.
Inside PayAnchor. Only the staff assigned to your file and the staff who manage billing and compliance. Every change to a return's status, every document request and every document access is recorded against the staff member who made it.
Inside your Team. Everyone in your Team can see every Profile in it, including its documents and schedules. You control who is in your Team.
Service providers, who process information only on our instructions and under terms that require them to protect it:
SARS and other authorities. We send SARS the returns, schedules and supporting documents needed to file and to answer verification requests for a Profile. We disclose information to any other public authority only where the law requires or permits it.
Our hosting, email and error-monitoring providers may store or process information outside South Africa. By using TCMS you agree to this transfer, and it is needed to provide the services you asked for (POPIA section 72(1)(b) and (c)). Our terms with these providers require them to protect your information to a standard substantially similar to POPIA and not to pass it on except as that standard allows.
Identity numbers, passport numbers and dates of birth are encrypted at rest. Documents are kept in private storage that is not publicly reachable, and every time a staff member opens one, that is recorded. Access to the dashboard is by single-use sign-in link; there are no passwords to be stolen. Teams are isolated from one another so that no Team can see another Team's data.
When a retention period ends we delete the information or de-identify it so that it can no longer be linked to you.
You may ask whether we hold your personal information and ask to see it, ask us to correct or delete what is wrong or no longer needed, object to how we use it, and opt out of the weekly digest. Most of your Team's information is visible and editable in your dashboard; for anything else, write to the Information Officer.
Some information we must keep by law even if you ask us to delete it, including the records in clause 8. We will tell you if that applies.
If you are unhappy with how we handle your information you may complain to the Information Regulator of South Africa: POPIAComplaints@inforegulator.org.za, Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191.
TCMS is for taxpayers and the people who manage their affairs. We do not knowingly add anyone under 18 to a Team. A Profile may relate to a minor only where a parent or guardian in the Team manages it.
We will give you at least 30 days' notice by email of any material change to this policy, and the date at the top will change. Continued use of TCMS after the change takes effect is acceptance of it.