Legal
Privacy policy
This policy explains how Clements & Cox (Pty) Ltd (“Clements & Cox”, “we”, “us”) collects and uses personal information when you visit clementsandcox.co.za, contact us, or do business with us. We process personal information in line with the Protection of Personal Information Act 4 of 2013 (POPIA). Clements & Cox (Pty) Ltd is a South African company and is a separate entity from Clements & Cox in the United Kingdom (clementsandcox.com).
1. Who is responsible for your information
| hello@clementsandcox.com | |
| Physical address | 24 Tesla Crescent, Sunninghill, Sandton, 2157, Gauteng |
2. What we collect
- When you contact us by email or phone: your name, organisation, role, email address, phone number and whatever you choose to tell us in your message.
- When you phone us: the number you call from, the date, time and length of the call and, if you leave one, your voicemail message (delivered to our team by email).
- When you become a client: the contact and billing details needed to deliver and invoice our services, and the information you share with us during an engagement.
- When you browse this website: our web server automatically records technical information — IP address, browser type, the page requested, the referring page and the date and time — to keep the site secure and working.
- Only if you accept analytics: anonymised usage statistics (pages viewed, approximate location at country/city level, device type) via Google Analytics. See our cookie policy.
We do not ask for, and ask you not to send us, special personal information (such as health, religious or biometric information) or information about children through this website.
3. Why we use it and our lawful basis (POPIA s11)
| Purpose | Lawful basis |
|---|---|
| Responding to your enquiry or call | Your consent, and steps you asked us to take before a contract |
| Delivering, invoicing and supporting services | Performance of our contract with you |
| Accounting, tax and other record-keeping | Compliance with legal obligations |
| Keeping the website and our systems secure | Our legitimate interest in protecting our systems and visitors |
| Website analytics | Your consent (cookie banner) — withdraw any time |
| Sending you news about our services | Your consent, or as an existing client with an opt-out in every message (POPIA s69) |
We never sell personal information and we do not use it for automated decision-making or profiling.
4. Who we share it with
We share personal information only with service providers (“operators”) who process it on our instructions and under written agreements that require them to keep it confidential and secure (POPIA s20–21):
- our website and server hosting provider;
- Microsoft (Microsoft 365 email and productivity services);
- our telephone and voice-over-IP providers;
- Google (Google Analytics) — only if you have accepted analytics cookies;
- our professional advisers (accountants, auditors, lawyers) where needed;
- our affiliate Clements & Cox in the United Kingdom, where it helps deliver a service to you.
We may also disclose information where the law requires it.
5. Information sent outside South Africa (POPIA s72)
Some of these providers store or process information outside South Africa — including in the United Kingdom, the European Union and the United States. We only transfer personal information to countries or recipients subject to laws, binding corporate rules or written agreements that provide protection substantially similar to POPIA, or where you have consented or the transfer is necessary to perform a contract with you.
6. How long we keep it
- Enquiries that do not lead to work: up to 24 months, then deleted.
- Voicemails and call records: up to 12 months.
- Client and financial records: as long as the law requires (generally 5 to 7 years under the Companies Act and tax legislation).
- Web server logs: up to 90 days, unless needed to investigate a security incident.
- Analytics data: 14 months, then deleted automatically.
7. How we protect it (POPIA s19)
We use appropriate, reasonable technical and organisational measures, including encrypted connections (HTTPS/TLS) for this website, multi-factor authentication and role-based access on our business systems, regular updates and backups, and confidentiality obligations on our staff and operators. If we have reasonable grounds to believe your information has been accessed by an unauthorised person, we will notify you and the Information Regulator as POPIA s22 requires.
8. Your rights
Under POPIA you may:
- ask whether we hold personal information about you and request a copy (s23);
- ask us to correct, update or delete it (s24);
- object to our processing it, including for direct marketing (s11(3));
- withdraw your consent at any time — this does not affect processing that already took place;
- lodge a complaint with the Information Regulator (South Africa) — inforegulator.org.za, POPIAComplaints@inforegulator.org.za.
To exercise any of these rights, email hello@clementsandcox.com or write to the Information Officer above. We may need to verify your identity first. Requests for records are handled under our PAIA manual.
9. Changes to this policy
We will update this page when our practices change and show the new date at the top.