Privacy notice

This notice explains how Bono Actuaries and Consultants (Pty) Ltd collects, uses and protects personal information, and what rights you have in relation to it. It is written to meet the requirements of the Protection of Personal Information Act 4 of 2013 (POPIA).

1. Who we are

Bono Actuaries and Consultants (Pty) Ltd is the responsible party for the personal information described in this notice.

Registered name

Bono Actuaries and Consultants (Pty) Ltd

Registration number

2026/565182/07

Registered office

220 Witkoppen Road, Paulshof, Johannesburg, 2122

Information Officer

Nduvho Munyai · info@bonoactuaries.co.za · +27 76 322 1489

2. What information we collect

Information you give us

When you contact us by email, telephone or through this website, we collect your name, contact details, the organisation you represent and whatever you choose to tell us about your enquiry.

Information arising from an engagement

Where we are appointed to carry out actuarial work, we receive information from the client organisation. This is usually policy, claims and exposure data. It may include personal information relating to policyholders, members or employees of our client. In relation to that information we generally act as an operator on behalf of the client, who remains the responsible party, and we process it only on the client's documented instructions under the terms of the engagement.

Information collected automatically

Our hosting provider records standard technical information when you visit this website, including your IP address, browser type, the pages you view and the time of your visit. This is used to keep the site available and secure. We do not use advertising or tracking cookies, and this site does not profile visitors.

3. Why we process it, and on what basis

• To respond to your enquiry and to discuss possible work — on the basis that processing is necessary to take steps at your request before entering into a contract.
• To perform an engagement and deliver the agreed work — on the basis that processing is necessary to perform a contract.
• To meet professional and legal obligations, including the Actuarial Society of South Africa's Code of Professional Conduct, applicable Standards of Actuarial Practice, and record-keeping required by the Companies Act and tax legislation — on the basis that processing is necessary to comply with an obligation imposed by law.
• To maintain the security and integrity of our systems — on the basis of our legitimate interests, balanced against your rights.

We do not sell personal information, and we do not use it for direct marketing without your consent.

4. Who we share it with

We share personal information only where it is necessary, and only with:

• Service providers who host this website, provide our email service and store our records. These operators act on our instructions and are bound by confidentiality obligations.
• Associates engaged to assist on a specific piece of work. Where an associate will have access to client information, the client is told before the work begins.
• Regulators, auditors and professional bodies where we are required to disclose information by law or by the rules of our profession.

5. Transfers outside South Africa

This website is hosted outside South Africa, and our email and file storage providers may process information outside South Africa. Where personal information is transferred across a border, we rely on section 72 of POPIA: the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection and that includes principles for lawful processing substantially similar to those in POPIA.

Client engagement data is held in accordance with the engagement terms, and where a client requires that its data remain in South Africa, we will agree that arrangement in writing before the work starts.

6. How we protect it

We take appropriate, reasonable technical and organisational measures to prevent loss of, damage to, or unauthorised destruction of personal information, and unlawful access to or processing of it. These include encrypted transmission, access control and multi-factor authentication on our systems, encrypted storage, and confidentiality obligations on everyone who works on an engagement.

If we have reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and the affected data subjects as soon as reasonably possible, as required by section 22 of POPIA.

7. How long we keep it

Enquiries that do not lead to an engagement are deleted within twelve months. Engagement records, including working papers and the reports we issue, are retained for the period required by our professional obligations and by law, which is generally not less than five years from the end of the engagement, and longer where a matter may be subject to review or challenge. Statutory accounting and tax records are kept for the periods prescribed by the Companies Act and tax legislation.

8. Your rights

Under POPIA you have the right to:

• be told whether we hold personal information about you, and to request access to it (sections 23 and 24);
• request that we correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;
• object, on reasonable grounds, to our processing of your personal information;
• withdraw consent where we rely on it, without affecting processing carried out before the withdrawal; and
• complain to the Information Regulator.

To exercise any of these, contact our Information Officer using the details in section 1. We will respond within a reasonable period. Where you ask for access to a record, the procedures and fees under the Promotion of Access to Information Act 2 of 2000 apply, and our PAIA manual is available on request.

Where we act as an operator for a client, requests about that client's data should be directed to the client as responsible party. If you contact us instead, we will pass your request on and tell you that we have done so.

9. Complaints to the Regulator

If you believe we have handled your personal information unlawfully, you may lodge a complaint with the Information Regulator using Form 5 under the POPIA regulations.

Information Regulator (South Africa)

Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

Email

enquiries@inforegulator.org.za

Telephone

010 023 5200 · Toll-free 0800 017 160

10. Changes to this notice

We may update this notice from time to time. The date at the top shows when it was last revised. Where a change materially affects how we handle your information, we will take reasonable steps to bring it to your attention.