Privacy Policy

Last updated: 27 October 2026

This policy explains what personal information BlackLeaf collects, why, who sees it, where it goes, how long we keep it and what you can do about it. It is written to meet the Protection of Personal Information Act 4 of 2013 (POPIA).

1. Who we are

1.1 This policy applies to BlackLeaf Group Holdings (Pty) Ltd (registration 2025/879490/07) and its subsidiaries, which we call BlackLeaf, we or us. The subsidiaries are BlackLeaf Wealth (Pty) Ltd (2024/680466/07), BlackLeaf Advisory Group (Pty) Ltd (2025/569905/07), BlackLeaf Fiduciary Management (Pty) Ltd (2025/569829/07), BlackLeaf Capital (Pty) Ltd (2025/368238/07), BlackLeaf Properties (Pty) Ltd (2025/882331/07) and BlackLeaf Business Marketplace (Pty) Ltd (2025/571978/07). Properties becomes BlackLeaf Legal and Business Marketplace becomes BlackLeaf Accounting in November 2026.

1.2 Each BlackLeaf company is a responsible party under POPIA for the personal information it decides how to use. The BlackLeaf company that serves you, and that you deal with, is the responsible party for your information. Where two BlackLeaf companies use the same information for their own purposes, each is responsible for its own use.

1.3 Address: The Loft, 439 Diagonal Street, Pringle Bay, 7196.

1.4 Information Officer: Talita Clarke. Email [email protected]. Telephone +27 82 843 5788.

1.5 Related documents. The Collection Notice appears on our forms and at checkout and gives the short version of this policy for that form. The Cookie Notice covers cookies. The PAIA Manual explains how to request records. The Terms of Use, Client Portal Terms of Use, Shop Terms and Refund Policy cover how you use our website, portal and shop. If any of them conflicts with this policy on how we handle personal information, this policy applies.

2. Who this policy covers

Clients, prospective clients, their directors, shareholders, trustees, beneficiaries, beneficial owners and staff, portal users, shop customers, partners, suppliers, and website visitors. “You” means any of them. If you give us information about another person, such as a co-director, a trustee or a beneficiary, please make sure they know and that you are allowed to share it.

3. What we collect

3.1 The table below lists what we collect, whether you must give it to us, and what happens if you do not. “Law” means a law that requires us to collect it.

What we collect	Required or voluntary	If you do not give it	Law
Identity and contact details: name, identity or passport number, date of birth, address, email and phone number. On the BCRP enquiry form, the person who accepts the confidentiality agreement also gives their identity, passport or registration number	Required to become a client or open a portal account. Voluntary for general enquiries.	We cannot onboard you or act for you. We can still reply to an enquiry.	Financial Intelligence Centre Act 38 of 2001 (FICA)
Entity details: registration documents, trust deeds, letters of authority, shareholder and director details, beneficial ownership declarations	Required for entity and trust clients	We cannot onboard the entity or act for it.	FICA; Companies Act 71 of 2008; Trust Property Control Act 57 of 1988
Financial and business information: financial statements, tax and bank details needed for a mandate, funding and transaction information, source of funds	Required for the mandate it relates to	We may not be able to complete that mandate.	FICA; tax laws
Verification and screening results: identity, address, sanctions and adverse-media checks	Required for onboarding	We cannot onboard you.	FICA
Credit-bureau reports: for a BlackLeaf Capital Readiness Protocol (BCRP) diagnostic, a credit bureau enquiry on each director, owner or trustee, made only with that person's separate written consent. For other services, only with your separate consent and only where a mandate needs one.	Required for a BCRP diagnostic. Voluntary for other services.	We cannot begin a BCRP diagnostic. For other services, we cannot take on a mandate that needs a credit report. Your other services are not affected.	None. You consent.
Payment information: the invoice and payment record. Online card payments, once switched on, are taken by our payment provider, PayFast. Otherwise you pay by EFT. We do not keep your full card number.	Required to buy	We cannot complete the purchase.	Tax and company laws (records)
Use of our systems: login records, device and IP address, messages and documents you upload or receive in the portal	Collected automatically when you use the portal	You cannot use the portal.	None; needed to run and secure the service
Enquiry forms and online acceptance: the details you type on an enquiry form, the one-time code we send to confirm your email address, and, when you accept an agreement or consent online, the date and time, your email address, your IP address and the version you accepted	Enquiry details are voluntary. The one-time code and acceptance record are needed before you can accept online.	We can reply to you another way, but you cannot accept an agreement or consent online.	None. We keep the acceptance record as evidence that you agreed (Electronic Communications and Transactions Act 25 of 2002)
Advertising measurement: if you accept advertising measurement on the cookie banner, the Meta (Facebook) pixel on our website sends Meta the page you view, including its address (which may include the name of an advertising campaign in the link you used), that you send an enquiry or other form, that you add an item to the shop basket or start checkout, your IP address, your browser and device type, and an identifier from Meta's cookie. We do not send Meta what you type into a form, and we have switched off Meta's automatic matching of customer details. From 12 November 2026, if you accepted advertising measurement on the cookie banner, Meta may also measure on your own device whether you sent an enquiry or form after seeing an advertisement. Meta may process information about this outside South Africa.	Voluntary. Only if you accept advertising measurement on the cookie banner.	We cannot measure which advertisements lead to enquiries or sales. We can still answer your enquiry.	None. You consent to it.
Communications: emails, messages and notes of calls and meetings	Collected when we correspond	We cannot reply.	None
Website use: server logs, the form and newsletter records described in the Cookie Notice, and website statistics from Google Analytics if you accept analytics on the cookie banner	Server logs are automatic. Forms, newsletter sign-up and analytics are voluntary.	The site works without forms, the newsletter and analytics.	None. You consent to analytics.

3.2 Special personal information. POPIA protects some information more strongly: religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information and criminal behaviour. We do not ask for it unless a mandate needs it. Two cases are worth knowing about. First, sanctions and adverse-media screening can show that a person is accused of, or has been involved in, an offence. We screen because the law requires it and we use the result only to decide whether we can act and to meet our legal duties. Second, if an identity check compares a photo or selfie with your identity document, that is biometric information. We use it only to verify who you are, on the basis of our legal duty or your consent, and keep it no longer than the check needs. If you give us any other special personal information, we handle it with extra care and only for the purpose you gave it.

3.3 Children. Our website is not directed at anyone under 18 and we do not ask children for information through it. Where our trust, fiduciary or family-office work involves a child (for example a minor beneficiary), we may hold the child’s name, identity number or date of birth and related details. These come from a parent, guardian, trustee or other legal representative. We process them only where POPIA allows: with the consent of a person legally able to consent for the child, or where we need them to meet a legal duty or to establish, exercise or defend a right. A parent or guardian may ask to see, correct or delete a child’s information at [email protected].

4. Where we get it

Directly from you. From people you authorise, such as your accountant, attorney, trustee or family office. From public registers such as CIPC. From our identity and credit verification provider. From other BlackLeaf companies. From the systems you use to deal with us, such as the portal and email. If we collect information about you from someone else, we tell you who and why when we first contact you or as soon as reasonably possible afterwards.

5. Why we use it and our legal basis

Purpose	Basis
Decide whether we can act for you, assess risk and conflicts	Steps before a contract; our legitimate interest
Verify identity and beneficial ownership, screen against sanctions lists, report where the law requires	Legal duty (including FICA)
Deliver mandates, engagement letters and shop orders	Performing our contract with you
Invoice, collect payment, keep financial records	Contract; legal duty (tax and company law)
Run the portal, keep it secure, prevent fraud and misuse	Contract; our legitimate interest
Share information inside BlackLeaf and with the providers in section 6	Contract; our legitimate interest; your consent where this policy says so
Introduce you to asset managers, funders or other partners	Your consent for the specific introduction
Send you news and offers	Your consent, or the rules for existing customers with an opt-out (POPIA s 69; see section 13)
Count visits and see which pages help, using Google Analytics, only if you accept the cookie banner	Your consent
Measure which advertisements lead to enquiries and shop activity, using the Meta pixel, only if you accept the cookie banner	Your consent
Reply to enquiries and complaints	Our legitimate interest; contract
Confirm your email address with a one-time code, and keep a record that you accepted an agreement or consent online	Our legitimate interest in preventing fraud and keeping evidence; contract
Meet our duties to regulators and courts	Legal duty

5.1 We use your information only for the purposes above or for a purpose closely linked to them. If we want to use it for something different, we ask you first unless the law allows otherwise.

5.2 Where we rely on your consent you can withdraw it at any time (section 11). Withdrawal does not affect what we did before. If we rely on another basis, such as a legal duty, withdrawing consent does not stop that use.

6. Who we share it with

6.1 Inside BlackLeaf. The BlackLeaf company that serves you, and other BlackLeaf divisions and shared functions (finance, compliance, company secretarial, technology and marketing) that need it to serve you or to run the group. Staff see only what their role needs.

6.2 Service providers (operators). These process information for us, under our instructions and not for their own purposes:

Category	What they do for us
Hosting and systems	Host the Central Console, client portals and website forms
Email, documents and client folders	Google Workspace, used for our email, documents and client folders
Accounting	Accounting software for invoicing and client accounts
Tax adviser	Our external tax adviser
Identity, business and trust verification, and credit reports where you consent	An identity and credit verification provider
Payments	PayFast for online payments, once switched on, and our bank for EFT
Website analytics	Google Analytics, only if you accept the cookie banner
Email marketing	A newsletter and email marketing provider, used only if you subscribe
Artificial intelligence tools	AI tools that staff use to help prepare work

We do not give providers more information than they need. We have a written agreement with each of them that requires them to protect your information, use it only for us, keep it confidential and tell us of any breach (POPIA s 21). If you want the name of a provider, ask at [email protected].

6.2A Meta (advertising measurement). If you accept advertising measurement on the cookie banner, Meta receives the information described in section 3 (Advertising measurement). Meta handles it under its own terms and privacy policy, which we do not control. If you do not want this, decline on the cookie banner or change your choice at any time with Cookie settings.

6.3 Professional partners. Independent attorneys, accountants and specialists. We share only what the work needs. For asset managers and funders we share only with your consent for the specific introduction.

6.4 Authorities. The Financial Intelligence Centre, SARS, CIPC, the Information Regulator, courts and other bodies where the law requires. We may not be allowed to tell you.

6.5 Business transfer. A buyer or successor of part of BlackLeaf, under the same protections.

6.6 We do not sell personal information.

7. Transfers outside South Africa

7.1 Some of the providers in section 6.2 process information outside South Africa. This applies to our accounting software, email marketing provider, AI tools and, if you accept the cookie banner, Google Analytics. It may also apply to Google Workspace and to others. Meta, if you accept advertising measurement, may also process information outside South Africa. Where a provider uses systems in several countries, the countries can change.

7.2 We send personal information outside South Africa only where POPIA s 72 allows it. That is where the recipient is bound by a law, binding corporate rules or a binding agreement that gives substantially similar protection to POPIA, including rules for passing the information on; or you consent; or the transfer is necessary to perform a contract between you and us, or to take steps you asked for before a contract; or the transfer is necessary for a contract made in your interest.

7.3 You can ask which countries are involved, and which of these grounds we rely on, at [email protected].

7.4 We do not send special personal information or children’s information to a third party in another country that does not give adequate protection, unless the Information Regulator has authorised it or POPIA otherwise allows it.

8. How long we keep it

8.1 We keep records only as long as needed for the purpose we collected them, and for the longest period any applicable law requires. For client records this is at least five years after the relationship ends (FICA), and longer where another law needs it (for example seven years for company records under the Companies Act). We may also keep a record longer where you consented, where a contract requires it, or while a dispute or claim is possible.

8.2 When the period ends we delete or de-identify the information so that it cannot be reconstructed. If we must stop short of deleting it, for example while an accuracy dispute is open, we restrict who can use it.

9. How we protect it

9.1 We use named user accounts, access limited by role, multi-factor authentication where available, encryption in transit, backups and logging. A client’s portal access ends 24 hours after offboarding.

9.2 We train our staff and limit who can see what. We review these measures from time to time and update them for new risks.

9.3 No system is perfectly secure. Please keep your login details private and tell us at once if you think someone else has access to your account.

10. If something goes wrong

If your personal information is accessed or acquired without authority, we will notify the Information Regulator and you as soon as reasonably possible, as POPIA s 22 requires. We will tell you what happened, what information was involved, what we have done and what you can do to protect yourself.

11. Your rights

11.1 Access. You may ask us to confirm whether we hold information about you and to give you a copy or description of it (POPIA s 23). We ask you to prove who you are first. Requests for records under the Promotion of Access to Information Act 2 of 2000 follow our PAIA Manual on this website.

11.2 Correction and deletion. You may ask us to correct information that is inaccurate, irrelevant, excessive, out of date, incomplete or misleading, or obtained unlawfully, and to delete information we are no longer allowed to keep (POPIA s 24). This is free of charge. You may use the Information Regulator’s Form 2 or simply write to us. We will help you complete the form. We respond within 30 days.

11.3 Objection. You may object, free of charge, to us processing your information on the basis of our legitimate interest or for direct marketing (POPIA s 11(3)). You may use the Information Regulator’s Form 1 or simply write to us, by email or by phone. We will help you with the form. We will stop unless the law lets us carry on.

11.4 Withdraw consent. Where we rely on your consent you may withdraw it at any time.

11.5 Refuse voluntary information. You may refuse to give information that is voluntary. Where the law requires it, for example for FICA, we cannot act for you without it.

11.6 Automated decisions. See section 12.

11.7 How to ask. Email [email protected] or write to the Information Officer at the address in section 1. We may need to confirm your identity first so that we do not give your information to someone else. We reply within 30 days.

11.8 Complaints. First tell us at [email protected] or [email protected]. You may also complain to the Information Regulator (South Africa): [email protected], [email protected], 010 023 5200 or 0800 017 160, Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191, www.inforegulator.org.za.

12. Automated decisions and AI

12.1 No decision with legal or substantial effect on you is made by an automated process alone (POPIA s 71). Staff use AI tools to help prepare work. A person reviews and decides.

12.2 If a decision about you ever does depend on automated processing, you may ask a person to review it, make your own representations, and receive enough information about the logic used to do so.

12.3 When staff use AI tools, they do so within our written agreements with the providers and with the access rules in section 9.

13. Marketing

13.1 We send news and offers by email, SMS, WhatsApp or other electronic message only to people who agreed, or to existing clients about our own similar services, and every message says who it is from and has a simple way to stop it, such as an unsubscribe link.

13.2 Your consent is a clear, active choice. Silence, an opt-out, or a pre-ticked box is not consent. We keep a record of when and how you agreed.

13.3 We ask for consent once, and only if you have not already refused.

13.4 You can opt out at any time by using the unsubscribe link or by emailing [email protected]. We do not market to people who are on the national pre-emptive block register under the Consumer Protection Act 68 of 2008, unless they have consented to us.

14. Cookies and website data

Our website sets no cookies unless you accept the cookie banner. The banner lets you choose Google Analytics (analytics), the Meta pixel (advertising measurement), both or neither: see the Cookie Notice. Each runs on your consent (POPIA s 11(1)(a)) and you can withdraw it at any time with Cookie settings. A Global Privacy Control signal from your browser counts as a decline. The client portal uses only the cookies it needs to keep you logged in and secure. Our server records basic technical information such as IP address and time of visit for security. Forms on this website send what you type to our Central Console, where staff read it to reply.

15. Changes

We will update this policy when our practices or the law change. The date at the top shows the current version. We will tell portal users by email or in the portal before a material change.

16. Contact

BlackLeaf Group Holdings (Pty) Ltd, The Loft, 439 Diagonal Street, Pringle Bay, 7196. [email protected]. +27 82 843 5788.