How your information is handled.

1. Scope and contact

This notice covers information connected with the Vatco website, enquiries and client workspace. “Vatco” is the name used on the website.

The website’s published contact address is 3 Monroe Close, Shere, Pretoria. For a privacy request, email info@vatco.co.za or call 069 795 6510 or 012 004 0093.

The website and account workspace have different functions. Account and service features described here apply when you use those features; a visit to a public service page does not create a client account.

2. Information connected with your request

• Enquiries: your name, email address, chosen service and, if provided, phone number, business name, requirements and preferred timing. The form also records the page that led to the enquiry, a request reference and submission time so the team can understand and follow up on it.
• Client accounts: your name, email address, sign-in credentials, account verification and recovery records, and session records. Optional two-factor authentication adds verification and recovery information.
• Service records: the business or person being assisted, service scope, assigned team member, progress, deadlines, document requirements and relevant notes. Records can include a company registration number, VAT number and billing address when supplied for the service.
• Documents: files you or authorised staff provide for a request, together with filenames, file type, size, upload history and review status. The required contents depend on the service. Identity, company or financial documents should be supplied only when requested for that work.
• Conversations: portal messages, service emails, sender and recipient details, attachments, dates and delivery information. Internal staff notes help the team manage a case and are separate from the messages shown in your account.
• Billing: customer details, quotes, invoices, credit notes, service charges and recorded payment amounts, dates and references. Recording a payment in the workspace does not itself process a bank card payment.
• Operational records: account permissions, changes to requests, notifications, delivery attempts and security records used to operate the service and investigate errors or misuse.

Information can come from you, a representative acting for you, or the team recording its work on your request. If another person’s information is needed, confirm your authority to provide it and share only what the service requires. Details obtained from an authority or other source should be explained as part of the relevant service.

3. What you need to provide

A website enquiry needs your name, email address and a service selection, including the option to ask for help choosing a service. Phone number, company name and additional requirements are optional at this stage. Without the required details, the form cannot submit the request or provide an email contact for a response.

You can submit an enquiry without creating an account. Creating an account requires the sign-in details shown on that form. Linking an enquiry to an account uses a receipt and the matching email address to establish access to that request.

Documents needed to carry out a service are a separate step. The team should explain the requirement, the reason and any applicable legal obligation before requesting them. Missing required evidence may prevent an application from progressing. Please do not place ID documents, passwords, tax login credentials or bank card details in the initial enquiry text.

4. How the information is used and shared

The workspace brings together enquiries, quotes, assigned work, document requests, responses, invoices and recorded payments. It also supports account verification, password recovery, service notifications, workload management and financial reporting. The originating page helps the team identify which service you were considering.

The relevant processing basis depends on the purpose: steps requested before a contract, performing a service agreement, an applicable legal duty, a legitimate interest or consent where required. These bases are recognised in section 11 of POPIA. Visiting this page does not give blanket consent to unrelated uses.

People who may need access include authorised Vatco staff, assigned accountants or service personnel, and technology providers operating the relevant systems. Where a service involves an application to an authority, the team must identify the recipient and information required for that application.

The platform includes connections for the following providers. A connection in the software does not mean that it is active for every request:

• Amazon Web Services S3: document and attachment storage when configured.
• Resend: account emails, service emails, incoming replies, attachments and delivery events when email services are connected.
• Pusher Channels and Beams: live workspace updates and optional browser notifications when enabled. The configured notification payload uses an account identifier, a generic update message and a link, rather than the full service conversation.
• Hosting and database providers: website delivery and storage of account and workspace records.

Vatco’s technology providers may process information outside South Africa when supplying hosting, database, document storage, email or notification services. The location depends on the provider and feature used. International transfers are subject to the applicable conditions in section 72 of POPIA. For questions about the providers and locations relevant to your request, email info@vatco.co.za.

5. Storage and access

Account and workspace records are kept in a database. Uploaded file contents use a separate file store when that service is configured. The workspace checks account permissions before allowing access to requests and files, and uses expiring links for authorised downloads.

Clients have access to records linked to their account. Staff access depends on role and assignment. The software also records operational changes and supports two-factor authentication. These are implementation safeguards; their effectiveness depends on the live configuration, staff practices and ongoing maintenance.

An email attachment or a file already downloaded may remain in the recipient’s mailbox or device after a workspace link expires. Keep your sign-in details private and report unexpected access or messages using the contact details below.

6. Cookies, browser storage and notifications

• Account session cookies support sign-in and access to your account. The current account configuration uses a seven-day session that can be refreshed during use. Signing out ends the active session; blocking essential cookies can prevent account features from working.
• Enquiry retry storage temporarily keeps a submission identifier, receipt token, expiry and a fingerprint of the form submission in the browser tab’s session storage. It helps avoid duplicate requests when retrying. This stored item does not contain the form’s readable answers, is removed after a successful submission and has a 24-hour validity limit.
• Optional browser notifications require browser permission. When enabled, the browser stores the notification connection and account identifiers and registers a notification subscription. You can turn notifications off in the workspace or change permission in your browser.

Service messages, document requests and account recovery emails relate to your enquiry or account. They should not be treated as permission for promotional email. Any marketing subscription or additional analytics tools need their own confirmed purpose, choices and disclosures before being introduced.

Links to maps, official authorities and other websites take you to services with their own privacy arrangements.

7. Keeping and deleting records

A record’s retention depends on its purpose and any lawful reason to keep it, including applicable legal or contractual requirements. Section 14 of POPIA governs this assessment.

Moving a file to workspace trash is not the same as permanently erasing its stored contents. Contact Vatco to ask which records remain and to request review of information that no longer needs to be kept.

8. Your privacy choices

Depending on the circumstances, you may ask to:

• Confirm whether personal information about you is held and request access.
• Correct inaccurate or outdated details.
• Delete information that is unlawful to hold or no longer authorised for retention.
• Object to processing on grounds available under POPIA.
• Withdraw consent where processing relies on it, without undoing earlier lawful processing.

These rights have legal conditions and exceptions. The Information Regulator explains privacy rights, and its POPIA forms page provides objection and correction or deletion forms.

Start with your name, contact email, relevant enquiry or account reference and a description of the request. Do not send an ID copy in the first email. Identity or authority may need to be verified before records can be disclosed or changed; the team should explain any further evidence needed.

9. Questions and complaints

Email info@vatco.co.za with “Privacy request” in the subject line. Include enough detail to locate the relevant enquiry or account without attaching unnecessary sensitive information.

You can also complain directly to South Africa’s Information Regulator. Its official complaints page explains the current process and links to its eServices portal. For general Regulator enquiries, use enquiries@inforegulator.org.za or 010 023 5200.