1. Who we are

MVA Tax and Corporate Advisory (Pty) Ltd provides accounting, taxation,
SARS compliance, corporate advisory and related professional services
in South Africa.

For purposes of the Protection of Personal Information Act 4 of 2013
(“POPIA”), MVA may act as a responsible party in relation to personal
information processed in connection with our business and professional
services.

2. Personal information we may collect

Depending on the nature of the engagement, we may process information including:

• names, identity or registration numbers and contact details;
• residential, business and registered addresses;
• taxpayer and SARS-related information;
• financial, accounting, banking and transactional records;
• company, director, shareholder and beneficial ownership information;
• employment, remuneration and payroll information;
• information contained in invoices, contracts, financial statements and supporting records;
• correspondence and instructions provided to us;
• information required for statutory, regulatory or professional compliance; and
• technical information generated when you use our website or electronic services.

The information required will depend on the service being provided.
We aim to collect only information reasonably necessary for the relevant purpose.

3. Why we process personal information

We may process personal information in order to:

• provide accounting, tax, payroll and corporate services;
• prepare financial statements, tax returns, reconciliations and statutory submissions;
• deal with SARS, CIPC and other regulatory or government authorities;
• perform client onboarding, verification and administration;
• communicate with clients and respond to enquiries;
• issue invoices, process payments and maintain accounting records;
• comply with legal, regulatory, professional and record-retention obligations;
• protect our legitimate business and legal interests;
• maintain the security and proper operation of our systems; and
• provide and improve our professional services.

4. Basis for processing

We process personal information only where there is an appropriate basis
for doing so under applicable law. Depending on the circumstances, this
may include processing necessary for the performance of an agreement,
compliance with a legal obligation, protection of a legitimate interest,
or processing undertaken with the consent of the data subject.

Accordingly, not all processing performed by MVA is dependent upon consent.
Certain information must be processed for us to provide professional
services or comply with statutory and regulatory obligations.

5. Information received from other sources

In addition to information provided directly by you, we may receive
information from authorised representatives, employers, employees,
financial institutions, SARS, CIPC, government authorities, professional
advisers, previous accountants or service providers where this is
appropriate and lawful.

6. Disclosure of personal information

Where necessary for the purpose for which information was collected,
or where permitted or required by law, information may be disclosed to
appropriate third parties. These may include:

• SARS;
• CIPC;
• other government departments and regulatory authorities;
• banks and financial institutions where appropriate;
• professional advisers and authorised representatives;
• software, cloud, communication and technology service providers; and
• other parties where disclosure is authorised or legally required.

We do not sell personal information.

7. Security of information

MVA takes reasonable and appropriate technical and organisational
measures to protect personal information against loss, misuse,
unauthorised access, alteration, disclosure or destruction.

Access to client information is limited according to operational
requirements and the nature of the professional services being provided.

8. Retention of information

Personal information and professional records are retained for as long
as reasonably necessary for the purpose for which they were collected,
to provide our services, to maintain appropriate professional records,
and to comply with applicable legal, tax, regulatory and record-retention
requirements.

Information that is no longer required will be dealt with in accordance
with applicable legal requirements and our record-management procedures.

9. Your rights

Subject to POPIA and other applicable legislation, a data subject may
have the right to:

• request confirmation of whether we hold personal information about them;
• request access to their personal information;
• request correction of inaccurate or incomplete information;
• request deletion or destruction where permitted by law;
• object to certain processing in appropriate circumstances;
• withdraw consent where processing is based specifically on consent; and
• submit a complaint to the Information Regulator.

These rights may be subject to statutory record-retention requirements
and other lawful grounds permitting or requiring us to retain information.

10. Website information and cookies

Our website may collect limited technical information necessary for
security, functionality, performance and website administration.
Cookies or similar technologies may also be used where applicable.

Where third-party website or analytics services are introduced, this
notice may be updated to provide further information about those services.

11. Cross-border processing

Certain technology, cloud or professional service providers may process
or store information outside South Africa. Where personal information
is transferred internationally, MVA will take reasonable steps to ensure
that the transfer is handled in accordance with applicable data
protection requirements.

12. Information Officer

Requests relating to personal information, privacy or the exercise of
data-subject rights may be directed to the Information Officer using
the contact details above.

13. Complaints

If you have a concern regarding the processing of your personal
information, we encourage you to contact our Information Officer first
so that the matter can be addressed.

Data subjects also have the right to lodge a complaint with the
Information Regulator (South Africa).

14. Changes to this notice

This Privacy Policy and POPIA Notice may be amended from time to time
to reflect changes in our services, systems, business practices or
applicable legal requirements.

Last updated: August 2026