Privacy policy

1. Responsible party and scope

CFGO (Pty) Ltd is the responsible party for personal information it determines the purposes and means of processing. This notice covers website visitors, prospective and current clients, contacts and other individuals whose information CFGO processes in its practice. Privacy enquiries: samantha@cfgo.co.za. Information Officer details will be published once verified and registration is completed.

2. Information collected

Depending on the relationship, we may process identity and contact information; company and trust records; ownership and beneficiary details; accounting, payroll, tax and financial information; correspondence; billing and payment records; and website device, usage and cookie data. Some records may include personal information of employees, beneficiaries and other third parties supplied by clients.

3. How information is obtained

We collect information directly from individuals, clients and their authorised representatives; from relevant public or statutory registers and authorities where lawful; from business service providers; and through website enquiries, cookies and analytics tools if enabled.

4. Purposes and lawful justification

We use information to answer enquiries; assess and deliver agreed professional services; meet tax, recordkeeping, anti-money-laundering and other legal obligations where applicable; administer client relationships and fees; secure systems; maintain quality controls; and send marketing where legally permitted. Processing relies on an applicable justification under POPIA, which may include consent, contractual necessity, legal obligation or legitimate interests, depending on the activity.

5. Website and Shopify

Our website is built using Shopify. Website operation may involve Shopify and approved hosting, security, analytics, communications and form providers. Their role, location and data handling depend on the enabled services and integrations. CFGO will verify the live site’s cookies, pixels, analytics and contact forms before publishing this notice.

6. Accounting systems, contractors and AI tools

CFGO currently uses Dropbox to store client information and may use accounting, payroll, workflow and AI-assisted tools to support its work. Authorised employees, contractors and service providers may access information only as required for their duties, subject to appropriate confidentiality, access and security measures. AI-assisted outputs are subject to human review. CFGO will assess vendor terms, retention, training-use settings and cross-border transfers before placing confidential client data into such tools.

7. Sharing and cross-border transfers

Information may be shared with authorised CFGO personnel, contracted operators, statutory authorities including SARS where required or authorised, and independent professionals where necessary and properly authorised. Some technology providers may process information outside South Africa. CFGO will assess and implement the safeguards required by POPIA, including section 72 where applicable. We do not sell personal information.

8. Security and incidents

CFGO aims to use proportionate administrative, technical and physical safeguards, including restricted access and secure handling procedures. No system is risk-free. If a security compromise involving personal information occurs, CFGO will investigate and notify affected persons and the Information Regulator where required by POPIA.

9. Retention

We retain records for the period required by applicable law, professional obligations, legitimate business needs and potential disputes, and then securely delete or de-identify them where appropriate. Specific periods depend on the record category; requests for deletion may be limited by legal retention duties.

10. Your rights

Subject to POPIA and other applicable law, you may request access to personal information, correction or deletion of inaccurate or unlawfully retained information, object to certain processing and withdraw consent where processing relies on consent. Contact samantha@cfgo.co.za. We may require reasonable identity verification before responding.

11. Marketing and cookies

We will send direct electronic marketing only where a lawful basis and any required consent or existing-customer exception applies. Marketing messages will include a practical opt-out mechanism. Non-essential cookies and trackers will be reviewed and consent or controls implemented where required. The developer must not enable marketing pixels by default without a lawful configuration.

12. Complaints and updates

Privacy questions may be directed to samantha@cfgo.co.za. Individuals may also lodge complaints with the South African Information Regulator through its official channels. We may update this notice as systems, services or law change; the published page should display its effective date.