Privacy Policy

SGM NEW ENERGY (PTY) LTD, trading as eFiling Training SA ("we", "us", the "Company"), is committed to protecting your privacy. This Privacy Policy explains what personal information we collect through the eFiling Training SA website and training platform (the "Service"), why we collect it, how we use and protect it, and what rights you have, in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA") and, where applicable, the Electronic Communications and Transactions Act 25 of 2002.

1. Who We Are — Responsible Party

• Legal name: SGM NEW ENERGY (PTY) LTD
• Trading name: eFiling Training SA
• Registration number: 2015/187692/07
• Registered address: Cape Town, South Africa
• Information Officer contact: info@efilingtraining.co.za

We are the "responsible party" as defined in POPIA in respect of the personal information described in this Policy.

2. Who This Policy Covers

This Policy applies to visitors to our website, and to registered users of the Service — including individual taxpayers, students, instructors, and organisation/institution administrators. Where an institution enrols students on our platform, the institution is a joint responsible party for the personal information of the students it enrols, and is responsible for ensuring it has a lawful basis (including, where relevant, parental or guardian consent) to enrol those students.

3. Information We Collect

We only collect personal information that is adequate, relevant, and limited to what is necessary for the purposes described in this Policy (POPIA's processing limitation principle). Depending on how you use the Service, this may include:

• Account & contact information: name, username, email address, phone number, password (stored in encrypted/hashed form).
• Organisation/institution information: organisation name, registration and VAT numbers, website, contact person, organisation ID.
• Student & profile information: student number, date of birth, address, province, postal code, profile or trainer photo (where uploaded).
• Training-simulation identifiers: an ID number, tax reference number, and banking details (bank, account holder, account number, branch code) that you voluntarily enter so the simulator can realistically pre-populate a practice tax return. See clause 6 for important information about this category.
• Billing & payment records: invoice and subscription details, and proof-of-payment submissions (e.g. the subject, body, and attachment filename of a payment confirmation email you submit). We do not collect or store your card or bank login credentials — payments are made by EFT directly to our bank account.
• Training & usage data: scenario progress, coursework and exam submissions, marks, instructor feedback, time spent, and certificates issued.
• Support communications: the content of support tickets and correspondence you send us.
• Technical data: IP address, browser and device information, login timestamps, and session cookies necessary to keep you logged in securely.
• Location data: an approximate location (city/country) derived automatically from your IP address, and — only where your device grants permission when prompted by your browser — a precise GPS location, resolved to a general address. This is used solely for the academic-integrity purpose described in clause 4 and Terms of Use clause 7, is not tracked continuously, and is updated only when you log in or your location changes.

4. Why We Collect It & Our Lawful Basis

In accordance with POPIA's purpose specification principle, we only process personal information for the following purposes, each on the lawful basis indicated:

• To create and administer your account and deliver the Service — necessary for the performance of our agreement with you (our Terms of Use).
• To operate the training simulator, including pre-populating realistic practice scenarios — necessary for performance of the Service, based on information you choose to provide.
• To process billing, invoicing, and payment verification — necessary for performance of our agreement and to comply with our accounting and tax record-keeping obligations in law.
• To provide support and respond to queries — necessary for performance of our agreement, or our legitimate interest in resolving issues you raise.
• To maintain the security, integrity, and traceability of the Platform (e.g. session logs, licence watermarking) — our legitimate interest in preventing misuse, fraud, and breach of our Terms of Use.
• To detect account sharing and impersonation during assessments (e.g. a student's login being used from multiple, materially different locations) — approximate IP-based location is processed on the basis of our legitimate interest in academic integrity; precise GPS-based location is only ever processed with your specific consent, given by granting permission when your browser prompts you. You may decline the prompt; declining is treated in accordance with Terms of Use clause 7.
• To send you service-related communications (e.g. account, billing, or support notices) — necessary for performance of our agreement.
• To send you marketing communications — only with your consent, which you may withdraw at any time (see clause 10).
• To comply with our legal obligations, including responding to lawful requests from courts or regulators.

5. About ID Numbers, Tax Numbers & Banking Details You Enter for Training

Because the Platform simulates the real SARS eFiling experience, some training scenarios invite you to enter an ID number, tax reference number, or banking details so the practice return looks and behaves realistically. Please note:

• This information is used only to render your simulated return within the Platform. It is never transmitted to SARS, the South African Revenue Service, any bank, or any other third party, and it is never used to attempt an actual tax filing or payment.
• We do not verify these numbers against Home Affairs, SARS, or any bank, and we do not use them for any purpose beyond the training exercise you are completing.
• We recommend that where a scenario does not require your real details, you use realistic but fictional placeholder information. Where you choose to enter your own real details for a more authentic training experience, we treat that information with the same security safeguards described in clause 9.

6. Children's Personal Information

The Service is intended for use by students under the supervision of a registered educational institution or instructor. Where a student is a child as defined in POPIA, the enrolling institution is responsible for ensuring it has the consent of a competent person (such as a parent or guardian), or another lawful basis recognised under sections 34 and 35 of POPIA (such as processing necessary for education, carried out with appropriate safeguards), before enrolling that student on the Platform. We rely on the enrolling institution to have obtained the necessary consent.

7. How We Share Your Information

We do not sell your personal information. We only share it in the following circumstances:

• Within your institution: if you are a student, your enrolling instructor(s) and institution administrator(s) can see your progress, submissions, marks, and related training data for assessment purposes.
• Service providers: hosting, email delivery, and other providers who process personal information on our behalf, strictly to deliver the Service, under a written operator agreement as required by section 21 of POPIA.
• Legal requirements: where required by law, a court order, or a lawful request from a regulator such as SARS or the Information Regulator.
• Business changes: if our business, or part of it, is sold or restructured, personal information may be transferred as part of that transaction, subject to equivalent protection.

We never share your personal information with SARS or any third party for the purpose of an actual tax submission — the Platform is a training simulator only (see our Terms of Use, clause 2).

8. Cross-Border Transfers

Where any of our service providers process personal information outside South Africa, we take reasonable steps to ensure that party is subject to a law, binding agreement, or other arrangement that provides an adequate level of protection substantially similar to POPIA, in accordance with section 72 of POPIA.

9. Security Safeguards

In line with POPIA's security safeguards principle, we implement reasonable technical and organisational measures to protect personal information against loss, unauthorised access, or disclosure, including encrypted password storage, access controls limiting who can view student and organisation data, secure hosting, and session-level traceability (account and timestamp watermarking) to deter and detect misuse. No system can be guaranteed 100% secure, and we will notify affected data subjects and the Information Regulator of any security compromise where required by section 22 of POPIA.

10. Cookies

We currently use only essential session and authentication cookies required to keep you securely logged in and to protect against cross-site request forgery. We do not currently use third-party advertising or analytics cookies. If this changes, we will update this Policy and, where required, obtain your consent.

11. Direct Marketing

In accordance with section 69 of POPIA, we will only send you direct marketing communications (such as newsletters or product updates) by email or SMS if you have opted in, or where you are an existing customer and the communication relates to similar products or services, subject to your right to opt out at any time. You may opt out by using the unsubscribe link in any marketing email or by contacting us at info@efilingtraining.co.za.

12. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes described in this Policy, or as required by law — for example, financial and invoicing records are generally retained for five years to comply with tax and accounting record-keeping obligations. Training and assessment records may be retained for the duration of your relationship with your institution and a reasonable period thereafter for record and dispute-resolution purposes. When personal information is no longer needed, we securely delete or de-identify it.

13. Your Rights as a Data Subject

Under POPIA, you have the right to:

• Be notified that personal information about you is being collected;
• Access the personal information we hold about you;
• Request correction or updating of inaccurate, outdated, incomplete, or misleading information;
• Request the deletion or destruction of personal information we no longer have authority to hold;
• Object, on reasonable grounds, to the processing of your personal information;
• Object to and opt out of direct marketing at any time;
• Withdraw consent, where processing is based on consent, without affecting processing carried out before withdrawal;
• Lodge a complaint with the Information Regulator (see clause 15) if you believe your rights under POPIA have been infringed.

To exercise any of these rights, contact us using the details in clause 14. We may need to verify your identity before actioning a request, and some requests may be limited where we have a legal obligation or legitimate interest to retain information (for example, financial records required by law).

14. Contact Our Information Officer

For any question, request, or concern about this Policy or how we handle your personal information, contact our Information Officer at info@efilingtraining.co.za or via our Contact page.

15. Lodging a Complaint with the Information Regulator

If you are not satisfied with how we have handled your personal information or a request you have made, you have the right to lodge a complaint with South Africa's Information Regulator:

• Website: inforegulator.org.za
• Complaints email: complaints.IR@justice.gov.za

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the law or in how we handle personal information. Material changes will be notified to you (for example, by email or an in-app notice) before they take effect. Continued use of the Service after changes take effect constitutes acceptance of the updated Policy.