Legal

Privacy Policy

Last updated: October 2026

BlackLeaf Operations (Pty) Ltd, trading as BlackLeaf Wealth and BlackLeaf Operations ("BlackLeaf", "we", "us", or "our"), is committed to protecting your personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and all applicable South African privacy legislation.

1. Who We Are

BlackLeaf Operations (Pty) Ltd is a South African company providing wealth management, financial advisory, and business operations support services. We are a responsible party as defined under POPIA and are responsible for the personal information we collect and process.

2. Information We Collect

We may collect and process the following categories of personal information: (a) Identity information — full name, identity number, date of birth, and nationality; (b) Contact information — email address, telephone number, and postal or physical address; (c) Financial information — banking details, income, assets, liabilities, and tax information where required for our services; (d) Employment information — employer details, occupation, and professional history; (e) Usage data — information about how you use our platform, including login activity, pages visited, and features accessed; (f) Communications — records of correspondence, meeting notes, and interaction history.

3. How We Use Your Information

We process your personal information for the following purposes: (a) To provide and manage our wealth management and operational services; (b) To comply with our legal and regulatory obligations, including FICA requirements; (c) To communicate with you regarding your account, services, and any relevant updates; (d) To conduct client onboarding, KYC verification, and ongoing due diligence; (e) To generate invoices, manage retainers, and administer financial transactions; (f) To improve our platform and services through usage analytics; (g) To fulfil our contractual obligations to you.

4. Legal Basis for Processing

We process your personal information on the following lawful grounds under POPIA: (a) Contractual necessity — processing required to fulfil our service agreement with you; (b) Legal obligation — processing required to comply with applicable laws and regulations, including FICA, FAIS, and tax legislation; (c) Legitimate interests — processing necessary for our legitimate business interests, including fraud prevention, platform security, and service improvement; (d) Consent — where we have obtained your explicit consent for specific processing activities.

5. Sharing Your Information

We do not sell your personal information. We may share your information with: (a) Service providers and operators who assist us in delivering our services, subject to appropriate data processing agreements; (b) Regulatory authorities, including the Financial Intelligence Centre (FIC), SARS, and other bodies where required by law; (c) Professional advisors such as auditors, attorneys, and compliance consultants, under obligations of confidentiality; (d) Third-party platforms integrated with our services (such as Xero accounting software), where you have authorised such integration.

6. Data Retention

We retain your personal information for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Client records are retained for a minimum of five (5) years following the end of our relationship as required by FICA. Financial and tax records are retained for a minimum of five (5) years as required by SARS. After the applicable retention period, your information will be securely deleted or anonymised.

7. Your Rights Under POPIA

As a data subject under POPIA, you have the following rights: (a) The right to access your personal information held by us; (b) The right to request correction of inaccurate or incomplete information; (c) The right to request deletion of your information, subject to our legal retention obligations; (d) The right to object to the processing of your information on legitimate grounds; (e) The right to withdraw consent where processing is based on consent; (f) The right to lodge a complaint with the Information Regulator of South Africa. To exercise any of these rights, please contact our Information Officer at support@blackleafops.co.za.

8. Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, disclosure, alteration, or destruction. These measures include access controls, encryption, secure authentication, and regular security assessments. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

9. Cookies and Platform Usage

Our platform uses session cookies and local storage to maintain your authenticated session and user preferences. These are strictly necessary for the operation of the platform and do not track your activity across third-party websites. We do not use advertising or tracking cookies.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable legislation. We will notify you of material changes by posting the updated policy on our platform. Your continued use of our services after such notification constitutes acceptance of the updated policy.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal information, please contact our Information Officer at support@blackleafops.co.za. If you are not satisfied with our response, you may lodge a complaint with the Information Regulator of South Africa at inforeg@justice.gov.za.