Privacy Policy

Privacy Policy

ANLO Financial Solutions (Pty) Ltd, Anlo Collective (Pty) Ltd and Anlo Horizon Inc Last updated: October 2026

1. Who we are

This policy applies to the following South African companies, which together trade under the Anlo name (“Anlo”, “we”, “us”, “our”):

Company Registration number What it does
ANLO Financial Solutions (Pty) Ltd 2013/094449/07 Accounting, bookkeeping, payroll, tax, financial statements, CIPC secretarial services and Xero training
Anlo Collective (Pty) Ltd 2014/164622/07 Accounting services
Anlo Horizon Inc 2014/097811/21 Audit, independent review and other assurance services (IRBA registration number 903761)

 Contact details for all three companies:

  • Physical address: Unit 1, Building 37, Waterford Office Park, Cnr Waterford Drive & Witkoppen Road, Fourways, 2191
  • Postal address: PO Box 193, Douglasdale, 2165
  • Telephone: 011 658 1324
  • Email: contact@anlofin.com

Responsible party: Each company is the responsible party, as defined in the Protection of Personal Information Act 4 of 2013 (POPIA), for the personal information it processes for its own clients and services. Your engagement letter shows which company you have contracted with. Where more than one company is involved in your affairs, each is responsible for its own processing.

Information Officers:

Company Information Officer
ANLO Financial Solutions (Pty) Ltd Esmerelda Doman, esmerelda@anlofin.com
Anlo Collective (Pty) Ltd Annja Louca, annja@anlofin.com
Anlo Horizon Inc Esmerelda Doman, esmerelda@anlofin.com

This policy explains how we collect, use, share and protect personal information about:

  • our clients and prospective clients, including directors, shareholders, members, trustees, beneficiaries and beneficial owners of client entities
  • people whose information our clients give us so we can do our work, such as employees on a payroll, spouses and dependants relevant to a tax return, and customers, suppliers and other parties who appear in accounting records we prepare, audit or review
  • visitors to our website and people who contact us or book an appointment with us

Under POPIA, personal information can relate to an existing company, close corporation or trust as well as to an individual. This policy applies to both.

2. Our role

For most of our work, we decide how and why personal information is processed in order to meet our professional and legal duties. This includes preparing tax returns, financial statements and CIPC filings, verifying clients, and, at Anlo Horizon, carrying out audits and independent reviews. In this work, we act as a responsible party.

When we run a payroll or keep books on your instructions, we may act as your operator. In that case, the confidentiality and security terms in our engagement letter apply.

Audits and independent reviews (Anlo Horizon only): To give an independent opinion or conclusion, Anlo Horizon needs to examine your records. These records may include personal information about your employees, customers, suppliers and other people. Anlo Horizon processes this information only for the purpose of the engagement and in line with the Auditing Profession Act 26 of 2005, the IRBA Code of Professional Conduct and the relevant auditing and review standards. ANLO Financial Solutions and Anlo Collective do not perform assurance work.

If you give us personal information about other people, such as your employees or family members, please make sure they know you are sharing it with us. You can do this by referring them to this policy.

3. The personal information we collect

Depending on the services we provide, we may collect:

  • Identity and contact details: name, ID or passport number, date of birth, address, email address, telephone number, job title and signature.
  • Client verification (FICA/KYC): copies of ID documents, proof of address, company and trust documents, beneficial ownership details, source of funds or wealth, and the results of identity checks.
  • Tax and registration information: income tax, VAT, PAYE, UIF and SDL reference numbers, SARS eFiling details, CIPC details, and tax numbers in other countries for cross-border clients.
  • Financial information: bank statements, IRP5s, IT3 certificates, income, investments, retirement annuities, medical aid details, property, loans, invoices and accounting records.
  • Employment and payroll information: employee names, ID numbers, salaries, tax and UIF details, leave, and bank details for salary payments.
  • Audit and review evidence (Anlo Horizon): general ledgers, contracts, minutes, registers, confirmations from banks and other third parties, payroll records, and other documents examined during an engagement.
  • Family information: details of a spouse or dependants where relevant to your tax position, for example for medical tax credits.
  • Communications: emails, WhatsApp messages, meeting notes, and meeting transcripts or recordings. We will tell you when a meeting is being transcribed or recorded.
  • Payment information: billing and payment details.
  • Website information: IP address, browser and device type, pages visited and cookie data.

Special personal information: We do not routinely ask for this. However, we may receive health information (for example, medical expenses or disability for tax purposes, or employee records reviewed during an audit) or information about criminal behaviour (for example, through verification checks or irregularities identified during an audit). We only process this where POPIA allows, for example with your consent, or where it is needed to meet a legal obligation or to establish or defend a legal claim.

Children: We only process information about children where it is relevant to a client’s tax affairs, such as dependants for medical tax credits. Where a child’s information is involved, we rely on consent from a parent or guardian or on another basis permitted by POPIA.

4. Where we get your information

  • directly from you
  • from your business, your employer or your other advisers
  • from SARS, CIPC and other public records
  • from banks, attorneys, debtors and other third parties who confirm information during an audit or review, with your authority
  • from identity verification service providers
  • from bank feeds and software you connect to your accounting records
  • from people who refer you to us

5. Why we use your information

Purpose Basis under POPIA (section 11)

Providing accounting services (accounting, bookkeeping, payroll, tax returns, financial statements, CIPC filings and advice)

 Needed to perform our contract with you. Required by law for statutory submissions. Our clients’ and our legitimate interests, for third parties such as employees and family members.

Carrying out audits and independent reviews (Anlo Horizon)

 

Needed to perform our contract with you. Required by law under the Companies Act and the Auditing Profession Act. Our legitimate interests and those of the users of the financial statements.

Verifying your identity, checking independence and meeting anti-money laundering requirements

 Required by law and by our professional bodies

Quotations, onboarding, engagement letters, invoicing and collecting fees

 Needed to conclude and perform our contract. Our legitimate interests.

Booking appointments and responding to enquiries

 Needed to take steps at your request. Our legitimate interests.

Meeting professional, regulatory, insurance and quality review requirements (including IRBA and SAICA inspections), and handling complaints and legal claims

 Required by law. Our legitimate interests.

Sending newsletters, deadline reminders and information about our services

 

 Existing clients: allowed for similar services, and you can opt out at any time. Anyone else: with your consent only.

Operating and improving our website

 Your consent for non-essential cookies. Our legitimate interests for security and functionality.

 

Laws that require us to collect information include the Tax Administration Act 28 of 2011, the Income Tax Act 58 of 1962, the Value-Added Tax Act 89 of 1991, the Companies Act 71 of 2008, the Auditing Profession Act 26 of 2005, the Financial Intelligence Centre Act 38 of 2001 (FICA), and payroll legislation such as the Unemployment Insurance Act and the Basic Conditions of Employment Act.

Voluntary or mandatory: Information we need to meet a legal obligation or to provide our services is mandatory. If you do not provide it, we may not be able to accept you as a client, file your returns, complete an audit or review, or continue acting for you. In an audit or review, missing information may also affect the opinion or conclusion Anlo Horizon can give. Information for marketing, or any extra information you choose to give us, is voluntary.

We do not make decisions about you based solely on automated processing.

6. Who we share your information with

We only share personal information where it is necessary, and we never sell it. We may share it with:

  • SARS, CIPC, the Department of Employment and Labour, and the Compensation Fund, and with HMRC in the UK where relevant to your affairs
  • The Independent Regulatory Board for Auditors (IRBA), for Anlo Horizon. This includes inspections, and reportable irregularities, which registered auditors are legally required to report under section 45 of the Auditing Profession Act.
  • SAICA and other professional bodies, for quality reviews and professional regulation
  • Other Anlo companies covered by this policy, where they support the work being done for you or where you are a client of more than one company. Sharing between Anlo Horizon and the other companies is limited by auditor independence requirements.
  • Anlo Financial Solutions Edinburgh Ltd, our associated firm in the United Kingdom, where it supports our work or where you are a client of both firms
  • Our service providers (operators) who support our practice, such as our accounting, tax, payroll, audit software, document management, email, workflow, payment, booking, website and IT support providers. These providers are bound by written agreements to process information only on our instructions and to keep it secure.
  • Your bank, lender, attorney, financial adviser or other advisers, at your request or with your agreement
  • Our insurers, and our own legal and professional advisers
  • The Financial Intelligence Centre, the South African Police Service and other authorities, where the law requires it
  • A buyer or successor of our practice, if all or part of our business is sold or merged, under strict confidentiality

7. Transfers outside South Africa

Some of our cloud-based service providers store information on servers outside South Africa, for example in the United Kingdom, the European Union or the United States. In addition, our associated firm in the United Kingdom may access client information.

We only transfer personal information outside South Africa where section 72 of POPIA allows it. This means one of the following applies:

  • the recipient is subject to a law, binding corporate rules or a binding agreement that gives protection substantially similar to POPIA (the United Kingdom, for example, has comprehensive data protection law)
  • you have consented
  • the transfer is necessary to perform our contract with you

8. How long we keep your information

Type of information Retention period
Tax records and returns At least five years from the date the return was submitted, or longer if there is a SARS audit, objection or dispute
Company and accounting records At least seven years, in line with the Companies Act
Audit and independent review working papers (Anlo Horizon) At least five years from the date of the audit or review report, as required by professional standards, or longer if there is an inspection, investigation or dispute
Client verification (FICA) records At least five years after our business relationship ends
Engagement letters, fee and complaint records Seven years after our relationship ends
Enquiries from people who do not become clients Up to 12 months
Marketing contact details Until you unsubscribe

After these periods, we securely destroy or delete the information, or de-identify it.

9. How we protect your information

We use appropriate, reasonable technical and organisational measures to protect personal information against loss, damage, and unauthorised access or processing. These include:

  • access restricted to staff who need it, using strong passwords and multi-factor authentication where available
  • internet security software, email filtering and regular security updates
  • regular backups stored separately from our main systems
  • encryption in transit (TLS) and through our cloud providers
  • confidentiality obligations in staff and supplier contracts
  • regular staff training on information security

If we believe your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible, as required by section 22 of POPIA

10. Your rights

Under POPIA, you have the right to:

  • ask whether we hold personal information about you, and request access to it
  • ask us to correct, update or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained
  • object on reasonable grounds to us processing your information based on legitimate interests
  • object to direct marketing and unsubscribe at any time
  • withdraw your consent at any time, where we rely on consent (this does not affect processing that has already taken place)
  • complain to the Information Regulator

Some rights are limited where the law or professional standards require us to keep information. For example, we cannot delete audit working papers or tax records before the required retention period ends.

To exercise any of these rights, contact the Information Officer of the relevant company. We may need to verify your identity first. Requests for access to records are dealt with under the Promotion of Access to Information Act 2 of 2000 (PAIA), and our PAIA manuals are available on request.

Please keep us informed if your personal information changes so that our records stay accurate.

11. Complaints

If you are unhappy with how we have handled your personal information, please contact the relevant Information Officer first and we will try to resolve it.

You also have the right to lodge a complaint with the Information Regulator (South Africa): [inforegulator.org.za]

12. Cookies

Our website uses strictly necessary cookies. With your consent, it also uses analytics cookies, such as Google Analytics, to help us understand how the site is used. You can manage or block cookies through your browser settings. If you do, some parts of the website may not work properly.

13. Links to other websites

Our website may link to other websites. We are not responsible for how those websites handle personal information, so please read their privacy policies.

14. Changes to this policy

We review this policy at least once a year. The latest version is always available on our website, and we will tell clients about any significant changes.