TAFEMA (Pty) Ltd
Information Officer: [Name]
Email: info@tafema.co.za
Address: [Registered address, South Africa]
| Category | Examples | Purpose |
|---|---|---|
| Identity | Full name, date of birth, ID number, gender | Account creation, FICA compliance |
| Contact | Email address, mobile number | Authentication, notifications |
| Financial | Income, assets, liabilities, insurance, retirement savings | Financial planning calculations |
| Dependant | Number of dependants, education costs | Cash flow and insurance modelling |
| Usage | Session data, feature usage, AI query logs (anonymised) | Platform improvement, rate limiting |
| Documents | Uploaded FICA documents, reports | Document vault storage |
We process your personal information on the basis of your consent (given at registration and confirmed by use of the platform) and legitimate interest (operating a compliant financial planning platform). You may withdraw consent at any time by requesting account deletion.
| Operator | Country | Purpose | Safeguard |
|---|---|---|---|
| Supabase Inc. | Ireland (EU) | Database hosting, authentication | GDPR adequacy; DPA in place |
| Anthropic PBC | United States | AI assistant processing (anonymised inputs only) | Data Processing Agreement; no PII names transmitted |
| Netlify Inc. | United States | Web hosting, serverless functions | Standard Contractual Clauses |
Cross-border transfers (POPIA Section 72): Personal information is transferred to Supabase (Ireland) and Anthropic (USA). AI queries contain only anonymised financial parameters — no names, ID numbers, or contact details are transmitted. Binding data processing agreements are in place with all operators.
| Data category | Retention period |
|---|---|
| Account and financial profile | Duration of account + 5 years (FICA requirement) |
| AI usage logs | 13 months (rate limiting and cost attribution) |
| FAIS advice audit trail | 5 years (FAIS record-keeping requirement) |
| Uploaded documents | Until deleted by user or account closure + 30 days |
You have the right to: access your personal information; correct inaccurate information; delete your information (subject to legal retention requirements); object to processing; and lodge a complaint with the Information Regulator.
To exercise any right, contact: info@tafema.co.za
Information Regulator (South Africa): www.justice.gov.za/inforeg | inforeg@justice.gov.za
We use browser localStorage for session authentication (strictly necessary — no consent required) and user preferences. We do not use tracking cookies. Google Fonts is loaded from Google's CDN — this creates a DNS request to Google servers. No analytics or advertising storage is used.
Financial data is encrypted in transit (TLS 1.3) and at rest in Supabase. Row-Level Security policies ensure that no user can access another user's data. AI queries are transmitted over encrypted connections with anonymised inputs only.