This notice is issued in terms of Section 18 of the Protection of Personal Information Act 4 of 2013 ("POPIA"). It informs you, the data subject, of how KTH Tech (Pty) Ltd processes your personal information when you use the ClaimX platform.
1. Responsible Party
The responsible party for the processing of your personal information is:
Name: KTH Tech (Pty) Ltd
Website: claimx.co.za
Email: enterprise@kth-tech.com
2. Information Officer
The designated Information Officer for KTH Tech (Pty) Ltd can be contacted at:
Email: enterprise@kth-tech.com
Subject line: "POPIA Request — [Your Name]"
3. Purpose of Processing
We process your personal information for the following specific purposes:
To provide the ClaimX tax preparation service, including document processing, calculation of tax liability, and identification of eligible deductions
To create and manage your user account
To process payments for the service
To communicate with you about your account, the service, and any changes to our terms
To comply with legal and regulatory obligations, including record-keeping requirements under the Tax Administration Act 28 of 2011
To improve the security and functionality of the platform
4. Categories of Data Subjects
We process personal information of the following categories of data subjects:
Individual South African taxpayers who register for and use ClaimX
Authorised representatives acting on behalf of taxpayers
Visitors to the claimx.co.za website
5. Categories of Personal Information
We may process the following categories of personal information:
Identifiers: Full name, South African ID number, tax reference number, date of birth
Financial information: Income details (IRP5/IT3(a) certificates), bank account details (for SARS banking validation), investment statements, medical aid tax certificates
Technical data: IP address, browser type, device information, session data
Special personal information: We do not intentionally process special personal information as defined in Section 26 of POPIA (e.g., religious beliefs, health, biometric data). If such information is incidentally included in uploaded documents, it is processed solely in the context of tax preparation.
6. Recipients of Personal Information
Your personal information may be shared with the following recipients, only to the extent necessary:
Payment processors: Paystack Payments Limited — for processing once-off payments
Law enforcement or regulatory bodies: Where required by law or court order
We do not sell or rent your personal information to any third party.
7. Cross-Border Transfers
The tax documents and financial information you enter into ClaimX are processed within your own browser and are not transmitted to or stored on our servers. Where limited processing by service providers is necessary — in particular payment processing by Paystack — that processing may occur on infrastructure located outside the Republic of South Africa. Any such transfer is carried out only in accordance with section 72 of POPIA, meaning the recipient is subject to laws, binding rules, or agreements that provide an adequate level of protection substantially similar to POPIA. We do not otherwise sell, rent, or transfer your personal information across borders.
8. Security Measures
We implement appropriate technical and organisational measures to protect your personal information, including:
256-bit AES encryption for data at rest
TLS 1.3 encryption for data in transit
Client-side processing — your sensitive financial data is processed on your device where possible, minimising server-side exposure
Role-based access controls limiting who can access personal information
Regular security assessments and penetration testing
Secure coding practices and code review processes
Incident response procedures in line with Section 22 of POPIA
9. Retention Period
We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected:
Tax records and documents: 5 years from the date of assessment, as required by Section 29 of the Tax Administration Act
Account information: Duration of your account plus 1 year after closure
Payment records: 5 years as required by the Companies Act 71 of 2008
Technical logs: 12 months
10. Your Rights as a Data Subject
Under POPIA, you have the following rights:
Right of access (Section 23): Request confirmation of whether we hold your personal information and request a copy
Right to correction (Section 24): Request correction or deletion of inaccurate, irrelevant, excessive, out-of-date, incomplete, or misleading personal information
Right to deletion (Section 24): Request destruction of your personal information, subject to legal retention requirements
Right to object (Section 11(3)): Object to the processing of your personal information on reasonable grounds
Right to withdraw consent: Withdraw your previously given consent at any time (this does not affect the lawfulness of processing before withdrawal)
Right not to be subject to automated decision-making (Section 71): Object to decisions made solely by automated processing that significantly affect you
11. How to Submit a Request
To exercise any of your rights, submit a written request to:
Email: enterprise@kth-tech.com
Subject line: "POPIA Data Subject Request — [Your Name]"
Please include:
Your full name and email address associated with your ClaimX account
A clear description of the right you wish to exercise
Proof of identity (copy of SA ID document or passport)
We will acknowledge your request within 5 business days and respond substantively within 30 days, as required by POPIA. If we are unable to comply with your request, we will provide written reasons.
12. Complaint to the Information Regulator
If you are not satisfied with our response or believe we have violated your rights under POPIA, you have the right to lodge a complaint with the Information Regulator:
Website: inforegulator.org.za
Email: complaints.IR@justice.gov.za
Tel: 012 406 4818
Address: 33 Hoofd Street, Forum III, 3rd Floor, Braamfontein, Johannesburg, 2001
13. Changes to This Notice
We may update this POPIA Notice from time to time to reflect changes in our processing activities or legal requirements. We will notify you of material changes via email or a notice on the platform.