Kairos CFO — Privacy Policy

1.Who we are

2.The two roles we play

It matters which role we are in, because it determines who you should approach about your information and who decides what happens to it.

3.Personal information in your accounting data

We do not choose what is in your ledger. The categories below are what accounting data typically contains, and what we will therefore process on your behalf.

• Contact records — names, trading names, contact persons, email addresses, telephone numbers, physical and postal addresses, VAT and tax reference numbers of your customers, suppliers and other counterparties.
• Transaction records — invoices, bills, credit notes, expense claims, payments, allocations, journal entries and the narrations and references attached to them, which frequently name individuals.
• Banking records — bank transaction lines, payee names, payment references and reconciliation status. We do not retrieve or store your online banking credentials.
• Employment-related ledger entries — payroll control accounts, salary and wage journals, director and employee loan accounts, expense reimbursements and related narrations.
• Documents you attach — invoices, statements, contracts and supporting documents, where you enable attachment retrieval or upload them.

4.Where you act for your own clients

This section applies if you are an accounting firm, bookkeeping practice or outsourced finance function using Kairos CFO for Entities belonging to your clients.

5.What we collect as responsible party

• Identity and contact details — name, job title, employer, business email address, business telephone number and address.
• Account and authentication data — username, hashed credentials, multi-factor authentication settings, role and permission assignments, and Entity access configuration.
• Billing and transaction data — billing entity, VAT number, invoices, subscription and payment history, Entity counts, and the payment reference and outcome returned by our payment provider. We do not collect or store full card numbers, card verification values or banking credentials.
• Connection metadata — which Accounting Systems you have connected, the scopes granted, connection status, retrieval timestamps and error records.
• Usage and technical data — IP address, device and browser type, operating system, features used, timestamps, session and audit logs, and error diagnostics.
• Correspondence — support requests, emails and other communications with us.
• Marketing preferences — subscriptions, consents and opt-outs.

6.Where we get it

• Directly from you — when you register, request a demonstration, correspond with us or make a payment.
• From the customer that authorised your access, where you are a User under a corporate subscription.
• From your connected Accounting System, where you have authorised the connection.
• From a marketplace operator or reseller, where you subscribed through one.
• Automatically — through cookies on our website and through platform logging.
• From public and third-party sources — company registries and business information providers, for the purpose of verifying a business counterparty or making a business-to-business approach.

7.Why we process it, and on what basis

We rely on the justifications in section 11 of POPIA indicated against each purpose.

• To provide, operate, secure and support Kairos CFO, and to perform our contract with you — necessary for the conclusion or performance of a contract (s11(1)(b)).
• To retrieve, store and analyse accounting data on your instruction and produce Derived Insights — performance of a contract, on your authority as responsible party (s11(1)(b) read with s20).
• To authenticate Users, manage Entity access and maintain audit trails — contract performance and legitimate interest (s11(1)(b) and (f)).
• To invoice, meter Entity counts, collect payment and manage credit — contract performance and legal obligation (s11(1)(b) and (c)).
• To detect, prevent and investigate fraud, abuse and security incidents — legitimate interest and legal obligation (s11(1)(f) and (c)).
• To correct defects, improve the Service and produce aggregated, de-identified analysis and benchmarks — legitimate interest (s11(1)(f)), on the terms and with the controls in clause 14 of Part A.
• To comply with law, including tax, company and record-keeping obligations, and to respond to regulators and lawful requests — legal obligation (s11(1)(c)).
• To establish, exercise or defend legal claims — legitimate interest (s11(1)(f)).
• To send service communications about changes, incidents, maintenance and billing — contract performance (s11(1)(b)).
• To send direct marketing about our services — consent, or the existing-customer basis permitted by section 69(3) of POPIA, with an opt-out in every message.

8.Connecting your accounting system

9.Artificial intelligence

10.Who we share it with

We do not sell personal information. We share it only as follows:

• Sub-operators — cloud hosting and infrastructure, our deployment and hosting partner, artificial intelligence model providers, email and communications providers, and error monitoring and analytics providers. Each is bound in writing to confidentiality, security and use limited to our instructions.
• Our payment provider — Payfast (Pty) Ltd, which processes card and electronic payments and is a responsible party in its own right in respect of payment data it collects. We do not receive your full card details.
• A marketplace operator or reseller, where you subscribed through one, and only in relation to your subscription, entitlement and support.
• Professional advisers — auditors, attorneys, accountants and insurers, under professional duties of confidence.
• Regulators, courts and law enforcement — where required by law or where necessary to establish, exercise or defend a legal claim. We assess each request and disclose only what is lawfully required.
• An acquirer — in connection with a merger, restructuring, financing or sale of our business, subject to confidentiality undertakings and to this Policy continuing to apply.

11.Where your information is processed

Where personal information is transferred across a border, we do so only where at least one of the conditions in section 72 of POPIA is met, namely that:

• the recipient is subject to a law, binding corporate rules or binding agreement providing an adequate level of protection substantially similar to POPIA and including comparable onward-transfer restrictions;
• the data subject consents;
• the transfer is necessary for the performance of a contract with the data subject, or for a contract concluded in the data subject's interest; or
• the transfer is for the data subject's benefit and consent is not reasonably practicable to obtain.

12.How we protect it

• Encryption of personal information in transit and at rest, including encryption of accounting system access tokens.
• Logical separation of each customer's data, and of each Entity within a customer's account, with controls preventing cross-tenant access.
• Role-based access control, least-privilege administrative access and multi-factor authentication for administrative accounts.
• Infrastructure-level administration that does not require routine access to the content of your accounting data, with any content access being time-bound, logged and reportable.
• Logging, monitoring and retention of audit trails.
• Confidentiality undertakings and security awareness training for personnel.
• Written security and confidentiality obligations imposed on every sub-operator.
• Encrypted backups, restoration testing and a documented incident response procedure.

13.How long we keep it

• Accounting data retrieved from a connected Entity — for the duration of the subscription and while the Entity remains connected, then for the 30-day export window, then deleted or de-identified within a further 60 days, subject to backup cycles.
• Account and billing records — for the duration of the subscription and thereafter as required by the Tax Administration Act 28 of 2011 (five years from the end of the relevant tax period) and the Companies Act 71 of 2008 (seven years where applicable).
• Security and audit logs — up to 12 months, unless a longer period is needed for an investigation.
• Support correspondence — three years from the date of the last exchange.
• Marketing and prospect data — until you opt out, or three years after our last meaningful interaction, whichever comes first.
• Records needed to establish, exercise or defend a legal claim — until the claim is resolved and any applicable prescription period has run.

14.Direct marketing, and cookies

15.If something goes wrong

16.Your rights

Subject to the requirements and exemptions in POPIA and the Promotion of Access to Information Act 2 of 2000, you have the right to:

• be told whether we hold personal information about you, and to request a record or description of it, together with the identity of any third party who has had access (s23);
• request correction, destruction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (s24);
• object, on reasonable grounds relating to your particular situation, to processing based on legitimate interest (s11(3));
• object at any time to processing for direct marketing purposes (s11(3) and s69);
• not have a decision with legal or substantially affecting consequences made about you solely by automated processing (s71);
• withdraw consent, where processing is based on consent, without affecting the lawfulness of processing before withdrawal; and
• complain to the Information Regulator, and to institute civil proceedings in a court.

17.Complaints, and changes to this Policy