Privacy Policy

1. Who we are

This Privacy Policy is issued by Nireston Heritage Capital (Pty) Ltd (referred to as "we", "us", "our" or Nireston & Heritage Capital), registered in South Africa under registration number 2009/084731/07, VAT number 4620183957, with registered address at 56 Kloof Street, Gardens, Cape Town, 8001, South Africa.

We are the responsible party (as defined in POPIA) for personal information processed through our website at niresto.pro and in the course of our advisory engagements concerning wealth and succession planning, governance and compliance, and supplier and counterparty risk.

2. Our Information Officer

In accordance with POPIA, we have designated an Information Officer responsible for compliance with this Policy and applicable data protection legislation. Requests concerning your personal information, or any exercise of the rights described below, should be directed to our Information Officer using the contact details set out in section 9.

3. Information we collect

We collect personal information in the following circumstances:

• Contact form and consultation requests — name, email address, telephone number, company name and the content of any message or enquiry you submit to us.
• Client and engagement data — identity, financial, corporate, succession and governance information provided to us in connection with an advisory mandate, necessarily processed for the performance of our services.
• Technical and usage data — IP address, browser type, device information, pages visited and referring pages, collected automatically through cookies and similar technologies as described in our Cookie Policy.
• Correspondence — records of telephone calls, emails and meetings arising from our advisory relationship.

4. Purpose and lawful basis for processing

We process personal information for the following purposes, on the lawful grounds indicated:

• To respond to enquiries and provide requested information — necessary for pre-contractual steps taken at your request.
• To perform advisory engagements, including wealth and succession planning, governance and compliance advisory, and supplier and counterparty risk assessments — necessary for the performance of a contract or mandate.
• To comply with legal, regulatory and professional obligations, including anti-money laundering, tax and CIPC filing requirements — necessary for compliance with a legal obligation.
• To operate, secure and improve our website — pursued on the basis of our legitimate interests, balanced against your rights.
• To send occasional updates about our services, where you have consented to marketing communications — based on your consent, which may be withdrawn at any time.

5. Hosting and third-party processing

Our website and associated infrastructure are hosted with reputable service providers who process data on our instruction and under written processing terms consistent with POPIA. We also rely on operators of essential business tools, including email delivery, appointment scheduling and analytics services, each of whom is contractually bound to apply appropriate technical and organisational security measures and to process personal information only for the purposes we specify.

Where any service provider is located outside South Africa, we take reasonable steps to ensure an adequate level of protection is maintained, consistent with the cross-border transfer requirements of POPIA.

6. Retention

We retain personal information only for as long as necessary to fulfil the purposes described above, and thereafter for such further period as required by law, including financial, tax and corporate record-keeping obligations under South African legislation. Enquiry data submitted through our contact form that does not proceed to an engagement is retained for a limited period before secure deletion.

7. Security safeguards

We maintain appropriate technical and organisational measures to safeguard the confidentiality, integrity and availability of personal information in our possession, including access controls, encryption of data in transit, and restriction of access to personnel who require it for the performance of their duties. No method of transmission or storage is entirely secure, and we cannot guarantee absolute security.

8. Your rights under POPIA

Subject to applicable law, you have the right to:

• Be notified that personal information about you is being collected.
• Access the personal information we hold about you.
• Request correction, updating or deletion of inaccurate, irrelevant, excessive or unlawfully obtained personal information.
• Object to the processing of your personal information, including for direct marketing purposes.
• Withdraw consent, where processing is based on consent, without affecting the lawfulness of processing carried out prior to withdrawal.
• Submit a complaint to the Information Regulator of South Africa if you believe your personal information has been processed unlawfully.

To exercise any of these rights, please contact our Information Officer using the details in section 9. We will respond to legitimate requests within the timeframes prescribed by POPIA.

9. Contact us

Questions or requests regarding this Privacy Policy or our processing of personal information may be directed to:

10. Complaints to the Regulator

If you are not satisfied with our response to a privacy concern, you may lodge a complaint with the Information Regulator of South Africa, the statutory body responsible for the enforcement of POPIA.

11. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The date of the most recent revision appears at the top of this page. We encourage you to review this Policy periodically.