Privacy notice
Last updated 30 September 2026
This notice explains what TagXBRL does with personal information, as required by the Protection of Personal Information Act, 2013 (POPIA). It covers the TagXBRL service only; htcogrp.co.za has its own notice.
The responsible party is HTCO Shared Services, registration 2025/343065/07, of Block D, Stoneridge Office Park, 8 Greenstone Place, Stoneridge Drive, Modderfontein, 1644, South Africa.
Two different roles, and why it matters
We hold two kinds of information and our obligations differ between them.
- Your account — your email address, firm name and password. Here we are the responsible party: we decide what is collected and why.
- The financial statements you upload — here we are an operator. The statements are your company's, or your client's. We process them on your instruction, for the single purpose of producing the iXBRL output, and we do not use them for anything else.
As an operator we will not read, use, share or retain an uploaded document for any purpose other than performing the conversion you asked for, and we process it only on your instruction.
What we hold
| Information | Why | Kept for |
|---|---|---|
| Email address, firm name, hashed password | To give you an account and let you sign in | While the account is open |
| The AFS PDF you upload | To produce the conversion | 30 days after a successful conversion |
| The iXBRL output and validation report | So you can download what you paid for | 12 months from the conversion |
| Conversion record — company, registration number, pages, fee, verdict | Your history, and our accounting records | 5 years |
| Credit balance and ledger | To run the account and reconcile payments | 5 years — an accounting record |
| Payment reference, amount and status | To match a payment to your account | 5 years |
A signed set of financial statements usually contains personal information — directors' names, signatures, sometimes their remuneration. That is why the source PDF has the shortest retention of anything here: once the output exists, we have no further use for it.
Card and banking details
We never receive your card details, and we do not store them. Payment is taken by Payfast on its own payment page. What comes back to us is a payment reference, an amount and a status — nothing more. This is deliberate: it keeps card data with the payment provider whose business it is to protect it.
Who else sees your information
- The CIPC — the generated iXBRL document is submitted to the CIPC's validation service. That is the purpose of the service.
- Payfast (a DPO company) — payment processing.
- Our hosting provider — the service runs on Render, whose infrastructure stores the data.
- Backblaze — encrypted off-site backups of the database, held in the European Union. Backups contain account and transaction records; they do not contain your uploaded documents.
We do not sell personal information, and we do not share it for marketing.
Processing outside South Africa
Our hosting is in the European Union, so your data is stored outside South Africa. POPIA permits this where the destination has comparable protection; the EU's data protection regime does. The CIPC validation service is in South Africa.
Artificial intelligence
The standard conversion is fully deterministic. It reads your document with ordinary software, and no part of it is sent to any AI service. Where an AI assisted option is offered it is priced separately, clearly marked, and never applied unless you choose it. Nothing you upload is used to train any model.
Cookies and advertising measurement
The service itself sets one cookie: the session cookie that keeps you signed in. It is used for nothing else.
When we advertise TagXBRL we may use Google's advertising measurement to learn which adverts bring people here and which of those people go on to register or pay for a filing. That measurement sets cookies only if you allow it on the notice shown when you arrive; until you do, and if you decline, it is switched off and no advertising cookie is set. Declining changes nothing about the service. Where it is on, Google receives the fact that a page was viewed, that an account was registered and that a filing was paid for — never the contents of any financial statements, and never your name or email address.
We also count visits ourselves, in aggregate and without cookies. Each page view records the page, the day, where the visitor came from (a search engine, an advert or another website), the country and whether a phone or a computer was used, under a code that changes every day and cannot be traced back to a person. No IP addresses are kept.
Security
- Everything is served over HTTPS.
- Passwords are stored hashed, never in a form we can read.
- Stored data is encrypted at rest by our hosting provider.
- You can only see your own conversions; access is checked on every download.
- The database is backed up daily, each copy is integrity-checked before it is kept, and a copy is held off-site in encrypted storage so that losing one provider cannot lose your records.
No service can promise it will never be breached. If a breach affects your personal information we will notify you and the Information Regulator as POPIA requires.
Your rights
Under POPIA you may:
- ask what personal information we hold about you;
- ask us to correct or delete it;
- object to our processing it;
- ask us to delete an uploaded document or a conversion before its retention period ends;
- complain to the Information Regulator.
Write to henno@htcogrp.com, marked for the attention of the Information Officer. We will respond within a reasonable time, and within 30 days where POPIA sets that period.
Where we act as operator, a request about a document you uploaded should come to you from the person it concerns — you are the responsible party for it. Tell us what you need done and we will carry it out.
The Information Regulator
Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg 2001 — inforegulator.org.za.
Changes to this notice
We may update this notice. The date at the top shows when it last changed.
Contact
HTCO Shared Services, Block D, Stoneridge Office Park, 8 Greenstone Place, Stoneridge Drive, Modderfontein, 1644, South Africa. Email henno@htcogrp.com.