CryptoTax SA is the platform operator and data controller (responsible party) for personal information processed through the service. This policy applies to all users, workspace members, and any person whose data is submitted through the platform.

We collect account information (name, email address), workspace configuration, client profile details, uploaded transaction files, connected exchange metadata, generated reports, and technical records needed to operate and secure the platform.

We do not collect information that is not necessary to authenticate users, isolate tenants, process transaction data, or evidence key actions taken in the platform.

Personal information is processed to authenticate users, maintain organisation boundaries, import and normalise transaction data, generate tax outputs and exports, maintain audit and security logs, provide support, and comply with applicable law.

Where the platform uses processors or infrastructure providers, personal information is shared only to the extent required to deliver the service, and only under contractual and security obligations that meet POPIA requirements.

Processing is based on your consent (given at account registration), contractual necessity (delivering the service you requested), and legal obligation (retention of records required for SARS filing and compliance).

Platform infrastructure is hosted in the EU West (Ireland) region. By using the platform, you consent to the transfer and processing of your personal information to this location, subject to the safeguards described in this policy.

Access to personal information is restricted to users within the same workspace and to platform operators who need it to provide the service or investigate security and operational issues.

Personal information is retained for as long as it is needed for the purposes described in this policy. Crypto tax records may need to be retained to support SARS filing, reconciliation, and practitioner review obligations for a period consistent with SARS record-keeping requirements.

You may request deletion of your account and associated personal information, subject to retention obligations that require continued storage.

You have the right to request access to the personal information we hold about you, to ask for correction of inaccurate information, to request deletion of your personal information, and to withdraw consent where processing is based on consent (subject to the effect that withdrawal may have on your ability to use the service).

You may also object to processing and lodge a complaint with the Information Regulator if you believe your rights are not being respected.

We apply role-based access control, encryption in transit, tenant isolation, and audit logging to protect personal information. No system is invulnerable, and we cannot guarantee absolute security, but we take reasonable steps to protect data against unauthorised access, disclosure, and loss.

If a data breach occurs that affects your personal information, we will notify affected users and the Information Regulator as required by POPIA.

We may update this policy to reflect changes to the service or to legal requirements. Material changes will be announced through the platform or by email. The effective date at the top of this page shows which version is current.