TAFEMA (Pty) Ltd
Information Officer: [Name]
Email: info@tafema.co.za
Address: [Registered address, South Africa]
| Category | Examples | Purpose |
|---|---|---|
| Identity | Full name, date of birth, ID or passport number, gender | Account creation, FICA compliance |
| Contact | Email address, mobile number | Authentication, notifications |
| Financial | Income, assets, liabilities, insurance, retirement savings | Financial planning calculations |
| Household | Number of dependants, education costs, marital regime, date of marriage, accrual commencement values | Cash flow modelling; estate duty and capital gains treatment, which differ by matrimonial regime |
| Practice (advisors) | Practice name, FSP number, role, supervision status | Practice administration and FAIS supervision |
| Appointments | Meeting times and subjects, availability, calendar feed addresses you connect | Scheduling between an advisor and a client |
| Sign-in activity (advisors) | Date last seen, and a count of sign-ins more than four hours apart | Shown to the principal of your practice for oversight of the firm. Deliberately coarse — it is not a record of time spent in the platform |
We process your personal information on the basis of your consent (given at registration and confirmed by use of the platform) and legitimate interest (operating a compliant financial planning platform). You may withdraw consent at any time by requesting account deletion.
Your information is stored externally, in a secure access-controlled database operated by Supabase. The application itself is served by Netlify, which hosts the website and its serverless functions but holds no client data of its own.
| Operator | Role | What they hold |
|---|---|---|
| Supabase Inc. | Database and authentication | All account, client and financial information |
| Netlify Inc. | Web hosting and serverless functions | Serves the application; no database access |
Cross-border transfers (POPIA Section 72): Both operators are international service providers, so your information is stored and processed outside South Africa. Access is restricted by database-enforced Row-Level Security policies, and by the operators' own access controls.
No artificial intelligence processing. This platform does not send your personal information to any large language model or AI service, and no such processing takes place. An earlier version of this notice disclosed a transfer to an AI provider; that was inaccurate — the feature was never built. Should an AI feature be added, this notice will name the provider, the country, the categories of information involved and the lawful basis before it is switched on, and you will be asked to consent separately.
| Data category | Retention period |
|---|---|
| Account and financial profile | Duration of account + 5 years (FICA requirement) |
| Client records held by an advisor | Duration of the advisory relationship + 5 years (FAIS record-keeping) |
| Appointments and calendar entries | Duration of account |
| Sign-in activity (advisors) | Duration of practice membership |
| Portal invitations | Stored as a one-way hash and deleted once accepted, revoked or expired |
You have the right to: access your personal information; correct inaccurate information; delete your information (subject to legal retention requirements); object to processing; and lodge a complaint with the Information Regulator.
To exercise any right, contact: info@tafema.co.za
Information Regulator (South Africa): www.justice.gov.za/inforeg | inforeg@justice.gov.za
We use browser localStorage for session authentication (strictly necessary — no consent required) and user preferences. We do not use tracking cookies. Google Fonts is loaded from Google's CDN — this creates a DNS request to Google servers. No analytics or advertising storage is used.
Financial data is encrypted in transit and at rest in Supabase. Row-Level Security policies enforced by the database — not by the application — ensure that no user can read another user's data, and that an advisor can read and update only the records of clients they are responsible for.
Your advisor can update your record. The adviser who invited you to the portal may enter or correct figures in your financial record — this is how information captured in a meeting reaches your portal. Every such change is logged with the date and the sections affected, and you can see that log under Settings → Your Financial Advisor. Your own edits are not logged. You can change any figure yourself at any time; where your record and your adviser's differ, raise it with them.
Portal invitations are stored as a one-way hash, so an invitation link cannot be recovered from the database by anyone, including us. Losing the link means a new invitation must be issued.