Skip to content

Legal and compliance

Privacy notice

What personal information we collect through this website, why we need it, who we share it with, and your rights under POPIA.

Last updated 29 October 2026

This notice explains how Finplanning (Pty) Ltd handles personal information that we collect through this website, and what changes if you become a client. It follows the Protection of Personal Information Act 4 of 2013 (POPIA).

Who we are

We are the “responsible party” for your personal information. That’s POPIA’s term for the organisation that decides why and how your information is used.

  • Finplanning (Pty) Ltd, registration number 2009/007189/07, an authorised financial services provider (FSP 7885)
  • Block A, First Floor, Victoria House, Victoria Country Club Estate Office Park, 22 Montrose Park Boulevard, Montrose, Pietermaritzburg, 3201
  • Phone: 033 342 2382
  • Email: administration@finplanning.com
  • Information Officer: Steven Ikin, our Managing Director
  • Deputy Information Officer: Talitha Louw, talitha@finplanning.com, 033 342 2382

What we collect on this website, and why

When you send an enquiry

Our enquiry form asks for:

  • your name;
  • your mobile number, your email address, or both;
  • what’s happening in your life, which is the topic of your enquiry;
  • how you’d like us to contact you: WhatsApp, a phone call or email;
  • a message, if you want to add one; and
  • a tick box you must tick so that we may contact you about your enquiry.

We also record which version of the consent wording you saw, and when you agreed to it.

We use this information to reply to your enquiry and, if you ask us to, to help you with financial planning. Please don’t put ID numbers, account numbers or health details in the message box.

Giving us information is voluntary. But to reply to an enquiry, we need your name, a way to contact you, the topic and your permission to contact you. The message is optional.

How you found us

When you first arrive on our website, your browser keeps a short note of how you got here:

  • any campaign tags in the link you followed (called UTM tags);
  • the Google click ID (gclid), if you clicked on one of our Google ads;
  • the first page you opened; and
  • the website that sent you, such as a search engine.

This note stays in your browser (in “session storage”) until you close the tab. We receive it only if you send an enquiry or ask us to email your results. It shows us which pages and ads lead to enquiries.

We don’t upload Google click IDs to Google Ads, and we don’t use Google Ads enhanced conversions.

Spam protection

Our enquiry form uses Cloudflare Turnstile to check that a person, not a bot, is sending it. Turnstile looks at technical signals, such as your IP address and the type of browser you use.

To stop repeated attempts, our system also keeps a scrambled (hashed) version of your IP address each time the form is sent. We delete these records after 30 days.

When you use our calculators

Our calculators work in your browser. The numbers you type aren’t sent to us or anyone else, unless you choose Email me my results. If you do, we receive:

  • your name and email address;
  • your consent choices;
  • the “how you found us” note; and
  • a summary of the numbers you entered and your results.

A planner then emails your results and may follow up about them.

The “Before you go” checklist saves your ticks in your own browser, not on our systems. If you ask us to email the checklist, we receive the checklist showing which items you’ve ticked.

When you browse

Our website host (Render) receives technical information when your browser loads a page, such as your IP address and browser type. This is needed to deliver the website and keep it secure.

We don’t use Google Analytics, Google Ads tracking or any other analytics or advertising cookies. See our cookies page for what the website does store.

Pages with our videos show our own placeholder picture. Only if you press play does the video load from YouTube, which is owned by Google.

When you contact us directly

If you email, phone or WhatsApp us, we keep your contact details and what you tell us, so that we can help you.

If you become a client

To give you advice, the FAIS Act requires us to collect more information about you. This includes your financial situation, needs, goals and attitude to risk. We must also verify your identity under the Financial Intelligence Centre Act (FICA).

Depending on the product, we may need special personal information, such as health details for a life cover application. We process it only as POPIA allows. We share what’s needed with the product suppliers you choose.

Our client mandate explains how we handle client information, including special personal information, children’s information (for example beneficiaries) and tax numbers. Your planner goes through it with you before giving advice.

POPIA allows us to use personal information only for specific reasons (section 11). We rely on:

  • your consent: to contact you about your enquiry;
  • steps you ask us to take before an agreement: such as answering your enquiry and preparing advice;
  • our legal duties: such as keeping records under the FAIS Act and FICA; and
  • our legitimate interests: keeping the website secure, stopping spam, and understanding which pages and campaigns lead to enquiries.

You can withdraw your consent at any time. This doesn’t affect anything we did lawfully before you withdrew it.

Marketing

We don’t send a newsletter or other marketing at the moment. If we start, we will send it only to people who have opted in, and every message will say that it comes from Finplanning and how to stop receiving it.

  • Ticking the box that lets us contact you about your enquiry isn’t consent to marketing.
  • We don’t phone, SMS or WhatsApp you with marketing unless you’ve agreed to it.

This follows section 69 of POPIA, which requires consent before direct marketing by electronic communication. The Information Regulator’s regulations also make it clear that not opting out doesn’t count as consent.

Who we share your information with

We don’t sell your personal information. We share it only with service providers that help us run the website and our business. POPIA calls them “operators”. We also share it when you ask us to, or when the law requires it.

Service provider What they do for us What they receive
Render Hosts this website Technical data, such as your IP address and browser type
Supabase Hosts the Finplanning Portal, our staff-only system where enquiries are stored Everything you send in an enquiry or a results request
Cloudflare (Turnstile) Checks that forms are sent by people, not bots Technical signals, such as your IP address and browser type
Resend Sends our team an email alert about each new enquiry Your name, the topic and how you’d like us to contact you
Microsoft 365 Hosts our email Emails you send us, and our enquiry alerts
Google (YouTube) Shows our videos, only when you press play Your IP address and what you watch
WhatsApp (Meta) Carries WhatsApp messages between you and us Your number and your messages

POPIA requires these operators to use your information only on our instructions and to keep it secure (sections 20 and 21). Google and WhatsApp also use information under their own privacy policies. See how Google uses information from sites that use its services.

This list of service providers is complete.

We also share information:

  • with product suppliers, such as insurers, investment platforms and medical schemes, when you become a client and ask us to arrange a product for you;
  • with our compliance officer, auditors and professional advisers, who must keep it confidential; and
  • with regulators, ombuds, courts or law enforcement, when the law requires it.

Information stored or used outside South Africa

Some of our service providers store or process information outside South Africa, for example in the United States or Europe.

Section 72 of POPIA allows this only in certain cases. One is when the recipient must follow a law, binding company rules or an agreement that protects your information in a way substantially similar to POPIA. Others are when you consent, or when the transfer is needed to do what you’ve asked us to do.

The Finplanning Portal, where your enquiries are stored, runs on Supabase in Europe. The European Union’s General Data Protection Regulation (GDPR) protects that information in a way substantially similar to POPIA, as section 72(1)(a) requires.

How long we keep your information

We keep personal information only as long as we need it, or as long as the law requires.

  • Enquiries that don’t lead to a client relationship: one year.
  • Client records: at least five years after a product ends or after we provide the financial service, as the FAIS General Code of Conduct requires. FICA also requires us to keep identity and transaction records for at least five years after the business relationship or transaction ends.
  • Spam-protection records (hashed IP addresses): 30 days.
  • Information in your browser: see our cookies page.

When we no longer need information, we delete or destroy it, or remove anything that identifies you, as POPIA requires (section 14).

How we protect your information

POPIA requires us to take reasonable technical and organisational steps to protect your information (section 19). For example:

  • this website uses an encrypted connection (HTTPS);
  • the enquiry form sends your details straight to our staff-only system, and only our staff can log in to it; and
  • our service providers must keep your information secure.

We also protect your information in these ways:

  • each staff member logs in with their own password and multi-factor authentication;
  • only staff who need client information for their work can open it; and
  • our staff are trained on POPIA and how to handle personal information.

If a security breach affects your personal information, we will tell you and the Information Regulator, as POPIA requires (section 22).

Your rights

Under POPIA you have the right to:

  • find out what we hold: ask us, free of charge, to confirm whether we hold personal information about you, and ask for a copy of it (section 23). If there’s a fee for the copy, we tell you first. Our PAIA manual explains how.
  • correct or delete it: ask us to correct or delete information that is wrong, out of date, incomplete, excessive, misleading or unlawfully obtained (section 24). This is free.
  • object: object, on reasonable grounds, to us using your information for our legitimate interests, and object to direct marketing at any time (section 11(3)). This is free.
  • withdraw consent at any time.
  • not be subject to automated decisions: POPIA protects you from decisions that have legal consequences for you, or affect you substantially, if they are based only on automated processing (section 71). We don’t make automated decisions about you from website information.
  • complain to the Information Regulator (section 74).

To use these rights, contact our Information Officer or email administration@finplanning.com. You can write to us in any form. The Information Regulator also publishes forms you can use: Form 1 to object and Form 2 to ask for a correction or deletion. We may ask you to prove your identity before we act, and we will tell you in writing what we did.

Contact the Information Regulator:

Changes to this notice

We update this notice when our practices or the law change. The date at the top of the page shows the latest version. When we change the consent wording on our forms, we record which version each person agreed to.

Sources