How we handle your information
This is the privacy notice for your Ibex Consulting portal. It is written to the Protection of Personal Information Act (POPIA).
Two promises, kept separately
This portal keeps two kinds of information apart, and we make you two promises, kept separately. The first is about the plain status of each matter: its name, the stage it is at, and when you will next hear from us. Ibex can read that status so we can run your work and keep you updated. The second is about your documents and figures. Those are encrypted, so that only you and your Ibex team can read them. We hold the two apart on purpose: the status that moves your work along in one place, and the substance of your tax affairs sealed in another.
What we collect and why
We collect your identity and contact details, such as your name and email address, to run your account and reach you. We hold the tax information and documents you choose to share with us, to do the work you engage us for. And we keep records of each matter's progress, to keep you informed and to show what happened. Nothing here is collected for advertising, and nothing is ever sold.
What we can and cannot see
We can see the status spine: the matter names, the stage each is at, the dates we have promised you, and the plain notes we write to move your work forward. We cannot see the contents of your documents or the figures inside them. Those are encrypted before they are stored, with keys that stay with you and your Ibex team, so the document bytes and the numbers in them are not readable from our servers.
How long we keep your information
We keep your information for the life of your relationship with Ibex, and it stays accessible to you throughout. We do not automatically delete it. Deletion happens only at your request, or in the rare event of a genuine dispute, and then only as an explicit step that someone takes on purpose. Nothing here is ever removed silently.
Where your information is stored
Your encrypted documents are stored in Cape Town. The plain status spine sits in a managed database that runs your matters. Our hosting, database, and email delivery providers operate partly outside South Africa, and where that is so their access is covered by contract, on terms that give your information protection substantially similar to POPIA, as section 72(1)(a) of the Act requires.
Your rights
Under POPIA you may ask what personal information we hold about you and request a copy, ask us to correct it, and complain to the Information Regulator of South Africa if you are not satisfied with how it has been handled. Our information officer will help you exercise any of these rights.
Contact
Ibex Consulting is the responsible party for your personal information under POPIA. Our information officer is Thomas Lobban, who you can reach at thomas@ibexconsulting.co.za with any question about this notice or about how your information is handled.
Version: 2026-07.1