KTH Tech (Pty) Ltd ("we", "us", "our") operates ClaimX (accessible at claimx.co.za), a tax preparation platform for South African taxpayers. This Privacy Policy explains how we collect, use, store, and protect your personal information in compliance with the Protection of Personal Information Act 4 of 2013 ("POPIA") and other applicable South African legislation.
2. Information We Collect
We may collect the following categories of personal information when you use ClaimX:
Identity information: Full name, ID number, date of birth, tax reference number
Financial information: IRP5/IT3(a) certificates, income details, bank statements, medical aid certificates, retirement annuity contributions, travel logbooks
Technical information: Browser type, device information, IP address, usage data
3. How We Use Your Information
Your personal information is processed solely for the following purposes:
Preparing and compiling your tax return (ITR12) for submission to SARS
Identifying eligible deductions and optimising your tax position
Providing you with a summary of your tax assessment
Communicating with you regarding your account and our services
Improving the ClaimX platform and user experience
Complying with legal and regulatory obligations
4. Lawful Basis for Processing
We process your personal information on the following lawful grounds under POPIA:
Consent: You provide explicit consent when you create an account and upload your documents
Contractual necessity: Processing is necessary to provide you with the tax preparation service
Legal obligation: We are required to retain certain records as prescribed by SARS and the Tax Administration Act
Legitimate interest: To improve our services and prevent fraud
5. Client-Side Processing
ClaimX is designed with privacy at its core. Where possible, tax calculations and document processing occur directly on your device (client-side). This means your sensitive financial data is not transmitted to or stored on our servers unless explicitly required for the service.
6. Data Retention
We retain your personal information for the following periods:
Tax records: 5 years from the date of submission, in accordance with SARS requirements under the Tax Administration Act 28 of 2011
Account information: For the duration of your account, plus 1 year after closure
Technical logs: 12 months from the date of collection
After the retention period expires, your data is securely deleted or anonymised.
7. Third-Party Sharing
We do not sell, rent, or trade your personal information. We may share your information only in the following limited circumstances:
Payment processors: Paystack processes your payment details — we do not store card numbers
Legal requirements: Where required by law, court order, or regulatory authority
With your consent: Where you have explicitly authorised us to share information
The information you enter for tax preparation is processed in your browser and is not transmitted to our servers. Where a service provider necessarily processes data outside South Africa — such as Paystack handling your payment — we only permit this in line with section 72 of POPIA, which requires the recipient to be bound by adequate, POPIA-comparable protections. We do not otherwise transfer your personal information across borders.
8. Your Rights Under POPIA
As a data subject, you have the right to:
Request access to your personal information
Request correction of inaccurate or incomplete information
Request deletion of your personal information (subject to legal retention requirements)
Object to the processing of your personal information
Withdraw your consent at any time
Lodge a complaint with the Information Regulator
To exercise any of these rights, contact us at enterprise@kth-tech.com. We will respond within 30 days.
9. Cookies
ClaimX uses only essential cookies required for the platform to function. We do not use tracking, analytics, or marketing cookies. For more information, please see our Cookie Policy.
10. Security
We implement industry-standard security measures to protect your personal information, including:
256-bit AES encryption for data at rest and in transit
Secure HTTPS connections (TLS 1.3)
Client-side processing to minimise data exposure
Regular security audits and vulnerability assessments
Access controls and authentication protocols
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice on the platform. Your continued use of ClaimX after changes are published constitutes acceptance of the updated policy.
12. Contact Us
For any privacy-related queries or to exercise your data subject rights:
Company: KTH Tech (Pty) Ltd
Email: enterprise@kth-tech.com
Website: claimx.co.za
You may also lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za.