Privacy Policy

• Company Registration Data: Business registration details, corporate structure, beneficial ownership information.
• Director and Officer Information: Names, addresses, identification numbers, appointment and resignation details.
• Financial Records: Complete accounting data, bank reconciliations, debtor and creditor records, transaction histories.
• Tax Information: VAT numbers, PAYE details, provisional tax data, income tax records, SARS correspondence.
• Regulatory Information: UIF registrations, COIDA registrations and returns, Letters of Good Standing, Injury on Duty claims.
• Employment Data: Employee records for payroll, UIF, and COIDA purposes.
• B-BBEE Information: Broad-Based Black Economic Empowerment verification data.
• Banking Information: Account details, transaction records, and reconciliation data.

• Names, email addresses, and phone numbers.
• Business and residential addresses.
• Emergency contact details.

When providing marketing, digital communication, and client engagement services, we may process:

• Customer email addresses and mobile numbers for newsletter and automation campaigns.
• Names, demographic information, and contact preferences.
• Purchase history, preferences, and behavioural data.
• Website analytics, engagement data, and lead capture information.
• WhatsApp/Meta Business contact lists and communication histories.
• Social media engagement data and audience insights.
• Event attendance records and feedback.

When providing creative, digital, and communication services, we may process:

• Photography and Videography: Employee and stakeholder images, product photography, corporate video content, event coverage materials.
• Event Documentation: Attendee information, event photography and videography, coverage releases.
• Creative Assets: Logos, branding materials, website designs, social media content, marketing collateral.
• Digital Communication Data: WhatsApp/Meta Business contact information, email newsletter subscriber data, auto-responder sequences.
• Web and Digital Assets: Website user data, landing page analytics, microsite visitor information.
• Signage Content: Digital signage content, traditional signage designs, display management data.

• IP addresses and device information.
• Website usage data and cookies.
• Communication logs and timestamps.

• Business Registration & Compliance: New company registrations, beneficial ownership submissions, annual returns for companies and close corporations, director/address/name changes, company reinstatements, and document retrieval.
• Regulatory Compliance: UIF registration and declarations, COIDA registration and Return of Earnings, Letters of Good Standing, Injury on Duty claims processing, COIDA audits and deferred payment arrangements.
• Accounting Services: Bookkeeping (tiered by transaction volume), bank/debtor/creditor reconciliations, management reports, invoicing, and annual financial statements preparation.
• Tax Services: VAT registration and submissions, PAYE registration and monthly returns, provisional tax submissions, annual income tax returns, SARS correspondence and dispute resolution, tax clearance certificates.
• Business Development: B-BBEE affidavits and business plan preparation.
• Media Production: Product photography and videography, corporate video production, social media content creation, event coverage (photography and video).
• Signage & Visual Communication: Traditional signage (posters, banners, billboards), digital signage (screens, displays, content loops), signage content creation and management.
• Messaging & Client Communication: WhatsApp/Meta for Business strategy and automation, email newsletters, auto-responders, sales funnels, lead capture, broadcast lists setup and contact segmentation.
• Digital & Web Services: Website design, landing pages, and microsites development.
• Branding & Design: Business profiles and company introductions, copywriting (web, social, sales), branding (logos, style guidelines, corporate stationery, apparel, vehicle branding), portfolio and proposal templates, social media content packs.

Personal information collected during service delivery, including employee images for recognition content, stakeholder contact details, and operational data, is processed with explicit consent or legitimate business interest as the lawful basis under both POPIA and GDPR frameworks.

• Communicating with clients about services and updates.
• Improving our service quality and operations.
• Complying with legal and regulatory obligations.
• Preventing fraud and ensuring security.

• Regulatory Authorities: As required for compliance filings and legal obligations (CIPC, SARS, Department of Employment and Labour).
• Financial Institutions: For banking and payment processing.
• Essential Service Providers: Including cloud storage providers, website hosting services, email marketing platforms, WhatsApp/Meta Business APIs, digital signage platforms, stock media libraries, and technical support services (operating under equivalent data protection standards).
• Marketing and Communication Platforms: When managing advertising campaigns, email newsletters, social media content distribution, and automated messaging systems (with appropriate data protection agreements).
• Event Venues and Suppliers: For event coverage and production services (under strict confidentiality agreements).

Data sharing with third parties is strictly limited to essential service providers operating under equivalent data protection standards. All third-party processors are bound by data protection agreements ensuring POPIA and GDPR compliance.

• Sell personal information to third parties.
• Share information for purposes unrelated to our services.
• Use client data for our own marketing without explicit consent.

We implement comprehensive security measures to protect personal information against unauthorised access, alteration, disclosure, or destruction:

• Encryption of sensitive data in transit and at rest.
• Secure cloud storage with role-based access controls.
• Password protection on all laptops, PCs, and mobile devices.
• Multi-factor authentication (MFA) enabled on all mobile devices and system access.
• Secure file transfer protocols for all data transmissions.
• Encrypted storage systems with regular backups.
• Secure network connections and enterprise-grade firewalls.
• Regular security audits and vulnerability assessments.
• Employee training on data protection and POPIA/GDPR compliance.
• Physical security measures for office premises and equipment.

• Role-based access limiting data exposure to authorised personnel only.
• Regular review and updating of access permissions.
• Secure disposal of data when no longer needed.

• Company Registration Records: Retained for the life of the company plus 7 years after deregistration.
• Accounting Records: Retained for 5 years as required by South African tax law and the Companies Act.
• Tax Records: VAT, PAYE, and income tax records retained for 5 years from assessment date.
• UIF/COIDA Records: Retained for 4 years as required by the Department of Employment and Labour.
• Director and Officer Records: Retained for 7 years after cessation of appointment.
• Compliance Documents: Retained per specific regulatory requirements (typically 5-10 years from filing date).
• Marketing and Communication Data: Email lists, WhatsApp contacts, and automation data retained while the client relationship continues plus 2 years, or until consent is withdrawn.
• Media Production Materials: Photography, videography, and creative content retained per specific consent terms and usage rights (typically 3-7 years).
• Website and Digital Assets: Design files, content, and analytics retained for 3 years after project completion.
• Signage Content: Digital and traditional signage materials retained for 5 years for potential updates or reproductions.
• Branding Materials: Logos, style guides, and brand assets retained for 7 years to maintain brand consistency.
• Contact Information: Retained while the relationship is active plus 1 year for potential future services.
• GDPR/International Clients: EU data subject rights apply regardless of South African retention periods.

Personal information is retained only for the duration necessary to fulfil service obligations and legal requirements. Secure deletion protocols are applied upon expiration of retention periods, including:

• Secure overwriting of digital files.
• Physical destruction of paper records.
• Certificate of destruction for sensitive materials.
• Regular purging of backup systems.

• Access: Request confirmation of processing and copies of your personal information.
• Correction: Request correction or deletion of inaccurate information.
• Deletion: Request deletion of your information (subject to legal retention requirements).
• Objection: Object to processing for direct marketing or other purposes.
• Restriction: Request limitation of processing in certain circumstances.
• Complaints: Lodge complaints with the Information Regulator of South Africa.

• Access: Request copies of your personal data.
• Rectification: Request correction of inaccurate data.
• Erasure: Request deletion ("right to be forgotten").
• Portability: Request transfer of your data in a structured format.
• Restriction: Request limitation of processing.
• Objection: Object to processing based on legitimate interests.
• Automated Decision-Making: Right not to be subject to solely automated decisions.
• Withdraw Consent: Withdraw consent at any time where processing is based on consent.

• POPIA requests: we will respond within 30 days (extendable by 30 days if complex).
• GDPR requests: we will respond within 1 month (extendable by 2 months if complex).

To exercise these rights, contact our Data Protection Officer at <bradley@inreach.co.za>.

We process and store personal information in South Africa wherever possible. Some of the service providers we rely on to deliver our services store or process data outside South Africa, primarily in the United States and the European Union. This includes our cloud storage, email, accounting, email marketing and social media management tools.

Where personal information is processed outside South Africa, we rely on the grounds permitted under section 72 of POPIA, including:

• Binding agreements: the recipient is bound by a data processing agreement, typically incorporating Standard Contractual Clauses, that upholds data-protection principles comparable to POPIA.
• Consent: you have consented to the transfer of your personal information.
• Contract performance: the transfer is necessary to perform our agreement with you.

For EU data subjects, we rely on the equivalent GDPR transfer mechanisms, including Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.

We maintain an internal record of our service providers and the regions in which they process personal information, which we keep current and make available to the Information Regulator on request. We only use providers that apply appropriate security and confidentiality standards.

In the event of a data breach that poses risks to your privacy and rights, we will:

• Contain the breach immediately.
• Assess the scope and impact within 24 hours.
• POPIA: Notify the Information Regulator as soon as reasonably possible.
• GDPR: Notify relevant supervisory authorities within 72 hours.
• Data Subjects: Notify affected individuals without undue delay when there is high risk to rights and freedoms.
• Document the breach, response actions, and remedial measures.
• Implement additional safeguards to prevent future incidents.

• Nature of the breach and data involved.
• Likely consequences and our response.
• Measures taken to address the breach.
• Contact information for further inquiries.

We process personal information based on the following lawful grounds under POPIA:

• Consent: Where you have given specific consent for processing (particularly for employee images and marketing content).
• Contract Performance: To fulfil our service agreements including accounting, tax, and compliance services.
• Legal Obligation: To comply with South African accounting, tax, UIF, COIDA, Companies Act, and other regulatory requirements.
• Legitimate Interests: For business operations, security, fraud prevention, and service improvement (balanced against your rights and freedoms).
• Vital Interests: To protect life or physical safety where necessary (particularly relevant for Injury on Duty claims).

We process personal data based on:

• Consent (Article 6(1)(a)): For marketing communications and optional services.
• Contract (Article 6(1)(b)): To perform our contractual obligations.
• Legal Obligation (Article 6(1)(c)): For regulatory compliance and record-keeping.
• Legitimate Interests (Article 6(1)(f)): For business operations, security, and service improvement.

For any special category data (e.g., financial hardship information), we rely on:

• Explicit consent where required.
• Legal obligations for regulatory compliance.
• Substantial public interest where applicable.

Data Protection Officer: Bradley Charles Abrahams

Email: <bradley@inreach.co.za>

Phone: +27 61 527 5762

Physical Address: 9 Gulden Crescent, Strand, Cape Town, South Africa, 7140

South Africa (POPIA):

• Information Regulator of South Africa.
• Website: <www.justice.gov.za/inforeg>.
• Email: <inforeg@justice.gov.za>.
• Phone: +27 12 406 4818.

European Union (GDPR): You have the right to lodge a complaint with the supervisory authority in your EU member state. Contact details are available at <https://edpb.europa.eu/about-edpb/about-edpb/members_en>.

For privacy-related inquiries, complaints, or to exercise your rights, please contact our Data Protection Officer first.

This Privacy Policy is primarily governed by:

• South African Law: Protection of Personal Information Act (POPIA) No. 4 of 2013.
• Jurisdiction: South African courts for local data subjects.

For EU data subjects, this policy also complies with:

• EU General Data Protection Regulation (GDPR).
• EU-South Africa adequacy arrangements where applicable.

Where conflicts arise between POPIA and GDPR requirements, we apply the most protective standard for the individual's rights.

We maintain appropriate records of data processing activities in accordance with business size and scope of operations, including:

• Categories of personal information processed.
• Purposes of processing and legal basis.
• Categories of data subjects and recipients.
• Data retention periods and deletion schedules.
• Technical and organisational security measures.
• Records of consent and consent withdrawal.
• Data breach logs and response actions.

All data processing records are documented and available for regulatory inspection upon request by the Information Regulator of South Africa or relevant EU supervisory authorities.

Privacy considerations are evaluated when implementing new services or technologies that may impact personal information handling, including:

• New data collection methods.
• Technology implementations.
• Changes to processing purposes.
• High-risk processing activities.

Our privacy impact assessment process includes:

• Risk identification and assessment.
• Stakeholder consultation where appropriate.
• Mitigation measure implementation.
• Regular review and monitoring.

InReach Studios (Pty) Ltd is committed to evaluating privacy risks when implementing new services or technologies. We ensure that all processing activities are assessed for compliance with POPIA and GDPR, and that appropriate safeguards are in place to protect personal information throughout the lifecycle of each service.

This Privacy Policy is effective as of 25 September 2025, was last updated on 10 July 2026 by Bradley Abrahams, and supersedes all previous versions.