Privacy Notice

HLB CBS Group ("HLB CBS", "we", "our" or "us") is committed to protecting the privacy and confidentiality of personal information entrusted to us. This Privacy Notice explains how we collect, use, disclose, store and protect personal information in accordance with:

— the Protection of Personal Information Act 4 of 2013 (POPIA), as our primary legislative framework;

— the General Data Protection Regulation (EU) 2016/679 (GDPR), where applicable to data subjects in the European Economic Area; and

— other applicable data protection laws and professional standards.

This Privacy Notice applies to our clients, prospective clients, suppliers, employees, website visitors, and any other individuals whose personal information we process in connection with our professional services.

HLB CBS Group is the responsible party (under POPIA) and data controller (under the GDPR) for personal information processed in connection with our services.

Information Officer: Minette Van Der Merwe, Head of Quality and Risk.

Physical Address: Building 1, 15 Forest Road, Waverley, 2199.

Email: minettev@hlb-cbsgroup.com.

Depending on the nature of our engagement, we may collect: identification and contact details; employment and business information; financial and accounting records; tax information and payroll data; company records and corporate documents; identity verification information; communications and correspondence; information contained within client-provided documents; and website usage data.

Certain engagements — particularly payroll, HR advisory and forensic services — may require processing of special personal information under POPIA, subject to a lawful basis and appropriate additional safeguards.

Delivering audit, accounting, tax, advisory, technology and related services; performing statutory, regulatory and contractual obligations; client acceptance, onboarding and engagement management; managing our relationships with clients, suppliers and stakeholders; improving quality, efficiency and security; detecting, preventing and investigating fraud; protecting our systems, personnel and information assets; and complying with applicable laws, regulations and professional standards.

We use appropriate technologies to support high-quality service delivery, including cloud-based platforms, workflow automation, and AI-assisted tools.

AI Tools are used solely to assist our professional staff and do not make autonomous decisions with legal or similarly significant effect on data subjects. Professional judgement and responsibility remain with our engagement teams. All AI-generated outputs are subject to appropriate human review and quality control.

We apply data minimisation principles when using AI Tools, sharing only the personal information necessary for the specific task. All AI service providers are approved by HLB CBS Group and are subject to appropriate contractual, technical and organisational safeguards.

Performance of a contract — processing necessary to perform services requested by a client.

Legal or regulatory obligation — including IRBA, SAICA, SARS and other bodies.

Legitimate interests — including fraud prevention, information security and improving our services.

Consent — where required by applicable law.

Vital or public interests — in limited circumstances required by law.

We may disclose personal information to: members and affiliates of the HLB International network; regulatory authorities (including the Information Regulator of South Africa, IRBA and SARS); courts and government bodies where required by law; banks and financial institutions; professional advisers; cloud and technology providers; approved AI service providers; and other third parties strictly necessary for service delivery.

All third-party recipients are subject to appropriate confidentiality obligations and, where applicable, data processing agreements compliant with POPIA and/or the GDPR.

Personal information may be transferred outside South Africa to other HLB International members, cloud service providers or affiliated entities. Where such transfers occur, we ensure appropriate safeguards in accordance with Section 72 of POPIA and, where applicable, Chapter V of the GDPR — including binding corporate rules, standard contractual clauses, adequacy decisions, or explicit consent.

We maintain appropriate technical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. In the event of a personal information breach that poses a risk of harm, we will notify the Information Regulator and, where required, affected data subjects.

Audit and assurance files: minimum 5 years from date of audit report (IRBA).

Tax records: minimum 5 years from submission, or as required by SARS.

Accounting records: minimum 7 years (Companies Act, 2008).

General client correspondence: duration of engagement plus 5 years.

Prospective client records: up to 2 years from last contact.

Website and marketing data: as specified in our Cookie Notice.

Subject to applicable law, you have the right to: request access; correct inaccurate information; request deletion; object to certain processing; request restriction; request portability; withdraw consent; and lodge a complaint with the relevant supervisory authority.

Requests may be submitted to our Information Officer at privacy@hlb-cbsgroup.com.

Our website uses cookies and similar tracking technologies to improve security, functionality, analytics and user experience. Non-essential cookies are only placed with your consent. Further information is set out in our Cookie Notice.

We may update this Privacy Notice from time to time to reflect changes in our practices, legal requirements or regulatory guidance. Material changes will be communicated where practicable. The version number and effective date at the top of this document reflects the most recent revision.