Privacy notice

01Who is responsible for your information

Managing Advancing Wealth (Pty) Ltd is the responsible party under the Protection of Personal Information Act (POPIA) for everything described in this notice. The details below also carry several of the supplier disclosures that section 43(1) of the Electronic Communications and Transactions Act requires before you transact with us online.

02What this notice covers

This notice covers mawinc.co.za and everything you send us through it: an enquiry, a discovery call booking, and the company registration purchase flow.

If you go on to become a client, your engagement letter governs the work itself and sits alongside this notice. Where the engagement letter deals with a matter more specifically, it governs that matter. Neither document can take away a right POPIA gives you, and where they appear to, POPIA wins.

03What we collect, and when

3.1 When you are only reading the site

• If you use the light and dark switch, or tell us whether you are a medical practitioner or a business owner, that choice is stored in your own browser under a local storage key. It never leaves your device and we cannot read it there. The audience choice is also added to the page address (for example ?for=medical), so it appears in the server logs and visit counts below like any other address.
• Our host, Vercel, keeps ordinary server logs for security and diagnostics: your IP address, the time, the page requested and your browser user agent.
• Vercel Web Analytics counts visits for us. It sets no cookies and does not store your IP address: it recognises a visit by a temporary identifier that is discarded within 24 hours, and shows us only totals, such as the pages viewed, the site that referred you, and your country, device type, operating system and browser.
• Our pages load typefaces from Google Fonts. Your browser fetches those directly from fonts.googleapis.com and fonts.gstatic.com, which discloses your IP address to Google. We receive nothing from that request and cannot see who made it.

3.2 When you contact us or book a call

• Email or telephone. Your name, your contact details and whatever you choose to tell us.
• A discovery call. Bookings run through Google’s appointment scheduling. Google collects your name, your email address and the time you pick, and passes them to us.

3.3 When you buy a company registration

This is where we collect the most, because CIPC and SARS will not accept a filing without it.

• About you as the buyer: name, email address, mobile number.
• About each director, shareholder and beneficial owner: full name, South African identity number or passport number and nationality, date of birth, residential address, percentage shareholding, and the nature and start date of any beneficial interest.
• About the company: your proposed names, main business activity, sector or SIC code, registered and postal addresses, and financial year end.
• Documents you upload: a certified copy of an identity document and a proof of address for each person.
• Payment: your card details go straight to Paystack and never reach us. What we receive is a payment reference, the amount, the status and the email address you paid with.

3.4 Information about other people

The application asks you for information about directors, shareholders and beneficial owners who are not you, and you confirm that you are authorised to give it.

Telling those people what is happening with their information is our duty under section 18 of POPIA, not yours. We give each of them a copy of this notice at the first point at which we deal with them directly. Where we have no practicable means of reaching a person, section 18(4)(e) of POPIA allows us to rely on that, and we ask you to show them this notice in the meantime.

3.5 Special personal information, and children

The registration itself needs no special personal information as section 26 of POPIA describes it, and the application form has no field for any. Where the law requires us to screen a person against sanctions or prominent influential persons lists, that screening can touch information about alleged criminal conduct, which section 26 covers. We carry it out only so far as the law requires and we use the result for that purpose alone. A document you send us may incidentally show more than the filing needs, and we use only what the filing needs.

A minor can hold shares or be a beneficial owner, though not be a director. Section 34 of POPIA prohibits the processing of a child’s personal information except in the cases section 35 allows. Where a shareholder or beneficial owner is under 18 we rely on section 35(1)(b), because the beneficial ownership filing is an obligation the Companies Act imposes and we cannot lawfully leave it out. We also tell the child’s parent or guardian, as the competent person, what we are filing and why, and ask them to consent.

04Why we process it, and our lawful basis

Section 11(1) of POPIA lists the grounds on which personal information may be processed at all. Every purpose below names the one we rely on.

Section 71 of POPIA deals with decisions taken by machine alone. We take none: every application is read by a person. Where your bank or our payment provider declines a card automatically, that is their decision rather than ours, and you are free to pay another way.

05Who else sees it

5.1 Because the filing requires it

• CIPC, for company registration, beneficial ownership, annual returns and any change to directors, addresses or members.
• SARS, for income tax, VAT, PAYE, UIF and SDL registrations and for tax compliance status.

These two are the point of the service. Without the disclosure there is no filing.

5.2 Because the law compels it

A person who forms companies for clients as a business is an accountable institution under Item 12 of Schedule 1 to the Financial Intelligence Centre Act, 2001, following the amendment of that Schedule with effect from 19/12/2022. Where that Act applies to a filing we make for you, it imposes duties that cannot be contracted out of: identifying the people behind an entity, keeping those records, and reporting certain transactions to the Financial Intelligence Centre. Where a report is required, the Act prohibits us from telling you that one has been made or is to be made, except in the limited circumstances the Act itself allows, such as under a court order.

We may also have to give information to SARS, to a court, or to another authority acting under a valid statutory demand or order.

5.3 Service providers who process on our instruction

Under POPIA an operator processes personal information for us, on our instruction, and may not use it for purposes of its own.

5.4 In the ordinary course of running a professional practice

Section 04 gives defending a legal claim as one of our purposes. These are the recipients that purpose implies, and a notice that claims the purpose without naming them is incomplete.

• Our professional indemnity insurer and our attorneys, only where a claim is made or threatened against us, and only so much as the claim requires.
• The South African Institute of Chartered Accountants, where our practice is selected for a professional review. A reviewer may see client files and is bound by the same duty of confidentiality we are.
• A successor practice, if we merge with or sell the practice to another firm. We would tell you before that happened.

06Information that leaves South Africa

Several of the providers in 5.3 process information outside the Republic. Section 72 of POPIA allows that where the recipient is bound by a law, binding corporate rules or a binding agreement that provides protection substantially similar to POPIA, or where you consent, or where the transfer is necessary to perform a contract with you.

We rely on the contractual route. Each of these providers is bound to us by data processing terms that require it to protect your information to a standard substantially similar to POPIA’s, and that place the same restrictions on any onward transfer it makes to a further processor. We hold those terms on file and will confirm which apply to a particular provider on request. If you want to know the country in which a particular piece of your information physically sits, ask us and we will tell you.

07How long we keep it

Section 14 of POPIA says we may not keep your information for longer than is necessary, except where a law requires or authorises us to, or where we reasonably need it for lawful purposes related to our own functions. Several statutes apply, and they set the periods below.

Where a SARS audit or investigation of which we have been notified, an objection, an appeal, other litigation, or an investigation by the Financial Intelligence Centre or another authority is running, we keep the records relevant to that matter until it is finally resolved. Section 32 of the Tax Administration Act requires that of us and section 14 of POPIA permits it. It means a deletion request cannot reach those particular records until the matter is over. We will tell you when that is the case, say which duty applies and what will bring it to an end, and act on your request once it does.

Records that we hold but that belong to you rather than to us, such as your own source documents and your company’s statutory registers, we return to you rather than destroy.

08Your rights, and how to use them

POPIA gives you the following. Exercising any of them is free, except that a search and reproduction fee can apply where you ask for copies of records.

• Ask what we hold about you. Confirming whether we hold personal information about you is free, under section 23(1)(a) of POPIA. If you want the records themselves, we follow the Promotion of Access to Information Act procedure, which means we may ask you to use the prescribed form. Because you are asking for your own information you are a personal requester, so no request fee is payable. A fee for searching, preparing and reproducing the records can apply, and we will give you a written estimate before we do the work, never after.
• Have it corrected, or deleted. Section 24 of POPIA lets you require us to correct information that is inaccurate, out of date, incomplete, misleading, excessive or unlawfully obtained, and to delete a record we are no longer entitled to keep. Where a retention duty in section 07 still applies we cannot delete the record, and we will tell you which duty applies and what will bring it to an end rather than simply refusing.
• Object to processing that we base on legitimate interest, under section 11(3) of POPIA.
• Withdraw consent you have given. Consent is not the ground we rely on for the filing itself, so withdrawing it does not stop a registration you have contracted with us to complete. It does stop anything we do on consent alone, and it never undoes processing already lawfully done.
• Not be subject to a decision taken by a machine alone, under section 71 of POPIA. We take none.
• Complain to the Information Regulator, under section 74 of POPIA, as section 12 below sets out.

09Marketing

Section 69 of POPIA prohibits direct marketing by electronic means unless you have consented, or you are a client and the subject is our own similar work. You can tell us to stop at the moment you give us your details, and again in every message we send. Every message carries a working unsubscribe and says who sent it, and buying a company registration does not sign you up to anything.

10Keeping it safe, and telling you when we have not

Section 19 of POPIA requires appropriate technical and organisational measures. In practice, on this site, that means the application form is served only over HTTPS, the application and confirmation pages carry a content security policy that permits scripts only from this site so no third party script can run on them, the documents you upload are stored in a private bucket that is not publicly addressable, the link to the application form stops working two hours after your payment is verified, and access on our side is restricted to active MAW staff, enforced in the database rather than by policy alone.

No system is perfect. Section 22 requires us to notify the Information Regulator, and you, where there are reasonable grounds to believe your personal information has been accessed or acquired by someone unauthorised. We notify as soon as reasonably possible after discovering the compromise, allowing only for the time needed to establish its scope and restore our systems. We may delay telling you, but never the Regulator, if the Regulator or a public body investigating an offence determines that telling you would impede a criminal investigation. When we notify you we will say what happened, what it means for you, and what to do about it.

11Access to the records we hold

Separately from POPIA, the Promotion of Access to Information Act, 2000, gives you a right of access to records held by a private body. That right is not the same as the one in section 08: this one is available where the record is required for the exercise or protection of a right, whereas your right to your own personal information under POPIA has no such threshold.

A request is made to the Information Officer on the prescribed form. We must decide it within 30 days of receiving it, and the Act allows us to extend that once by up to a further 30 days where the request covers a large volume of records or we need to consult before deciding. If we extend, we will tell you inside the first 30 days, give you our reasons, and tell you that you may take the extension further. Write to info@mawinc.co.za and we will send you the form and tell you what, if anything, it will cost.

12Complaining

Tell us first if you can, because most things are quicker to fix directly. You do not need our permission to complain, though, and you may go straight to the Regulator. Section 74 of POPIA lets any person complain about interference with the protection of personal information, on the Regulator’s prescribed form.

13Changes to this notice

This is version 1.1, effective 12/10/2026. Version 1.1 adds cookieless visit counting (Vercel Web Analytics) and the medical practitioner or business owner choice to section 3.1; version 1.0 was effective 23/08/2026. When we change it we will change the version and the date at the top of this page. We will not apply a change retrospectively to information you gave us under an earlier version without telling you first.

The consent wording on the application form carries its own version number, which is recorded against your order, so a consent you gave can always be traced back to the exact words you agreed to.