1. Who We Are
This Privacy Policy is issued by Harrier Financial Services (Pty) Ltd (“HFS”, “we”, “us”, “our”), a private company registered in the Republic of South Africa under registration number 2025/017281/07, with its principal place of business in Johannesburg, Gauteng.
For the purposes of POPIA, HFS is the Responsible Party in respect of personal information collected through our website www.harrierfs.co.za, our client engagements, and all other interactions we have with you.
We take data protection seriously. This policy describes, in plain language and in line with POPIA, how we handle personal information and the protections you can expect from us.
2. Key Definitions
Terms used in this policy carry the meanings assigned to them in POPIA. The most important are:
| Term | Meaning |
| Personal Information | Information relating to an identifiable living natural person and, where applicable, an identifiable, existing juristic person (e.g. a company). Includes names, contact details, ID numbers, financial information, and electronic identifiers. |
| Special Personal Information | Categories warranting heightened protection under Section 26 of POPIA, including information relating to religion, race, health, biometrics, and criminal behaviour. |
| Processing | Any operation performed on personal information, including collection, recording, storage, use, dissemination, or destruction. |
| Data Subject | The person to whom the personal information relates — i.e. you. |
| Responsible Party | The party that determines the purpose and means of processing personal information — in this case, HFS. |
| Operator | A third party that processes personal information on behalf of a Responsible Party — for example, our hosting or email providers. |
| Information Regulator | The independent body that enforces POPIA in South Africa. |
3. Information We Collect
The categories of personal information we may collect depend on how you interact with us. We only collect what is adequate, relevant and not excessive for the purposes set out in this policy (Section 10, POPIA).
3.1 Information you provide voluntarily
- Identity data: name, surname, job title, company name
- Contact data: email address, mobile number, physical address
- Business data: industry, annual turnover band, primary business challenges, organisational structure
- Engagement data: correspondence content, enquiry details, messages sent via our contact form or WhatsApp
- Financial data (for contracted clients only): financial statements, management accounts, tax returns, and other commercially sensitive information strictly necessary for service delivery
3.2 Information collected automatically
- Technical data: IP address, browser type and version, device type, operating system, screen resolution
- Usage data: pages visited, time spent on pages, clicks, scroll depth, referral source, navigation patterns
- Location data: approximate location inferred from IP address (country and region level only)
3.3 Information from third parties
We may receive information about you from publicly available sources such as company registration databases (CIPC), LinkedIn, or professional references provided to us during a client engagement.
Special Personal Information: We do not intentionally collect Special Personal Information (as defined in Section 26 of POPIA). Should such information become necessary for a specific engagement, we will obtain your separate, explicit consent before processing.
4. How We Collect Your Information
We collect your personal information through the following channels:
- Directly from you when you complete a contact form, book a discovery call, subscribe to our newsletter, download a resource, initiate a WhatsApp conversation, or engage us for professional services
- Automatically through your use of our website via cookies, tags, and analytics technologies (see Section 9)
- From third-party service providers who assist us in operating our website, communications, and analytics infrastructure
- From publicly available business information such as company registries, professional networks, and regulatory filings
5. Why We Process Your Information
We process personal information only for legitimate business purposes and will not use it in ways incompatible with those purposes (Section 15, POPIA). Specifically, we process information to:
- Respond to enquiries and communications initiated by you
- Assess whether our services are a suitable fit for your needs
- Provide financial advisory, tax, and management consulting services under signed engagement letters
- Issue quotations, invoices, and fulfil our contractual obligations
- Maintain accurate records of client engagements for regulatory, tax, and professional indemnity purposes
- Send you professional updates, newsletters, and insights (only where you have opted in)
- Improve our website, services, and user experience through analytics
- Protect our rights, prevent fraud, and comply with South African law
- Conduct marketing activities in a manner consistent with POPIA’s direct marketing provisions (Section 69)
6. Lawful Basis for Processing
Under Section 11 of POPIA, personal information may only be processed if at least one of the following conditions is met:
| Basis | When We Rely on It |
| Consent | You have given your voluntary, specific, and informed consent — e.g. when submitting a contact form with the POPIA checkbox ticked, or when subscribing to our newsletter. |
| Contract performance | Processing is necessary to conclude or perform a contract to which you are a party — e.g. delivering agreed consulting services. |
| Legal obligation | Processing is required by law — e.g. retaining financial records for SARS, retaining records required under the Financial Intelligence Centre Act (FICA), or complying with SAICA professional standards. |
| Legitimate interest | Processing serves the legitimate interests of HFS, a third party, or the data subject, in a manner that does not override your rights — e.g. maintaining website security or analysing aggregated usage patterns. |
You may withdraw consent at any time by contacting our Information Officer (see Section 17). Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
7. Sharing Your Information
We do not sell your personal information. We share personal information only with the following categories of recipients, and only to the minimum extent necessary:
7.1 Operators acting on our behalf
We use the following categories of third-party service providers (“Operators” under POPIA) who process personal information strictly on our instructions and under written contract:
| Service Category | Purpose | Example Providers |
| Website hosting | Serving the website, caching, security | Cloudflare, Inc. (United States) |
| Web analytics | Understanding website usage | Google LLC (Google Analytics 4, Google Tag Manager) |
| Behavioural analytics | Heatmaps, session replay | Microsoft Corporation (Clarity) |
| Form processing | Receiving contact form submissions | Formspree, Inc. (United States) |
| Scheduling | Calendar booking and reminders | Calendly LLC (United States) |
| Email and messaging | Business communications | Google Workspace, WhatsApp (Meta Platforms) |
| Cloud storage | Secure storage of client documents | Google Workspace, Microsoft 365 (as required per engagement) |
7.2 Professional advisers
We may share information with our auditors, legal advisers, and professional indemnity insurers where necessary and under strict confidentiality.
7.3 Regulators and authorities
We may disclose personal information where required by law, including to the South African Revenue Service (SARS), the Financial Intelligence Centre (FIC), the Information Regulator, or a court of competent jurisdiction.
7.4 Business transfers
In the event of a restructuring, merger, or sale of HFS, personal information may be transferred to the successor entity, provided that the successor is bound by obligations at least equivalent to those in this policy.
8. Cross-Border Data Transfers
Some of the Operators listed in Section 7 are based outside South Africa. Where personal information is transferred across borders, we comply with Section 72 of POPIA by ensuring that:
- The recipient is in a jurisdiction with data protection laws substantially similar to POPIA (such as the European Economic Area under the GDPR), or
- The recipient is bound by binding corporate rules or standard contractual clauses providing equivalent protection, or
- The transfer is necessary for the performance of a contract with you, or at your request, or
- You have consented to the transfer.
You may request further details of the safeguards applicable to any specific transfer by contacting the Information Officer.
9. Cookies and Tracking Technologies
Our website uses cookies and similar technologies to operate reliably and to help us understand how visitors use the site. A cookie is a small text file stored on your device.
9.1 Categories of cookies we use
| Category | Purpose | Duration |
| Strictly necessary | Enable core site functionality, remember your consent choice | Session / up to 12 months |
| Analytics | Measure how visitors use the site (Google Analytics 4, Microsoft Clarity) — only loaded after you accept | Up to 24 months |
| Functional | Remember preferences such as dismissed widgets (e.g. WhatsApp button) | Session |
9.2 Consent Mode
We use Google Consent Mode v2 to ensure that analytics and marketing cookies are only deployed after you have explicitly accepted them via our consent banner. By default, all non-essential cookies are denied until you choose otherwise.
9.3 Managing cookies
You can clear, block, or manage cookies through your browser settings at any time. Blocking all cookies may impair some site functionality. You can also change your consent preference at any time by clearing your browser storage for this site.
10. Data Retention
We retain personal information only for as long as is necessary to fulfil the purposes for which it was collected (Section 14, POPIA), subject to our legal, regulatory, and professional record-keeping obligations.
| Category | Retention Period |
| Enquiries that did not result in an engagement | 24 months from last contact |
| Client engagement records | 5 years after engagement closure (or longer if required by SARS, FICA, or SAICA) |
| Financial records | Minimum 5 years (SARS), 5 years (FICA), 7 years (Companies Act) |
| Newsletter subscribers | Until you unsubscribe, plus 6 months |
| Website analytics data | 14 months (Google Analytics default) |
| Consent records | As long as the underlying processing continues, plus 3 years |
When personal information is no longer required, we will securely destroy or de-identify it.
11. Your Rights Under POPIA
As a data subject, you have the following rights under POPIA:
- Right to be notified — to know when your personal information is being collected and how it will be used (Section 18).
- Right of access — to confirm whether we hold your personal information and to request a copy (Section 23).
- Right to correction or deletion — to request correction of inaccurate, misleading, or outdated information, or deletion of information that is no longer necessary for the purpose collected (Section 24).
- Right to object — to object to processing based on legitimate interest or direct marketing (Section 11(3)).
- Right to withdraw consent — where processing is based on consent, you may withdraw it at any time.
- Right to data portability — in certain circumstances, to receive personal information in a structured, commonly used format.
- Right to lodge a complaint — with the Information Regulator (see Section 16).
- Right not to be subject to automated decision-making — including profiling, where such decisions have legal or similarly significant effects on you (Section 71).
12. How to Exercise Your Rights
To exercise any of the rights set out in Section 11, please contact our Information Officer using the details in Section 17. You may need to complete the prescribed Information Regulator form POPIA Form 2 (“Request for Access to Personal Information”), available from inforegulator.org.za.
We will respond to verified requests within a reasonable time and, in any event, within 30 days unless an extension is justified. We may request proof of identity before acting on your request to protect your information from unauthorised disclosure.
There is no charge for exercising your rights, save that Regulations made under POPIA prescribe a fee for access to personal information in certain circumstances, which will be communicated to you in advance.
13. Security Measures
HFS takes appropriate, reasonable technical and organisational measures to secure the integrity and confidentiality of personal information and to prevent loss, damage, unauthorised destruction, and unlawful access (Section 19, POPIA). These measures include:
- HTTPS/TLS encryption for all data in transit on our website
- Access controls limiting staff access to personal information on a need-to-know basis
- Strong password policies and, where feasible, two-factor authentication for internal systems
- Regular backups and secure storage of client documentation
- Operator agreements requiring our third-party service providers to maintain equivalent security standards
- Staff training on POPIA and information security principles
In the event of a data breach that poses a real risk of harm, we will notify both the Information Regulator and affected data subjects as soon as reasonably possible, as required by Section 22 of POPIA.
14. Children’s Privacy
Our services are directed at businesses and their representatives (who are adults). We do not knowingly collect personal information from children under 18 years of age without the consent of a competent person, as required by Section 35 of POPIA. If you believe we have inadvertently collected a child’s personal information, please contact the Information Officer so that we can delete it.
15. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, the law, or the services we offer. When we make material changes, we will update the “Last updated” date at the top of this policy and, where appropriate, provide a more prominent notice. We encourage you to review this policy periodically.
16. Complaints
If you believe HFS has not handled your personal information in accordance with POPIA or this policy, we ask that you first raise your concern with our Information Officer (Section 17). We will investigate and respond promptly.
You also have the right to complain directly to the Information Regulator of South Africa:
17. Contact the Information Officer
For any question, concern, or request relating to this Privacy Policy or your personal information, please contact our designated Information Officer:
This Privacy Policy is governed by and interpreted in accordance with the laws of the Republic of South Africa, including the Protection of Personal Information Act, No. 4 of 2013, and the regulations made thereunder.