POPIA Compliance
How Amashad Company Registration (Pty) Ltd processes, protects, and respects your personal information in accordance with the Protection of Personal Information Act, 4 of 2013 (POPIA).
Effective date: 17 March 2026
Our Commitment
POPIA is South Africa's primary data protection law, governing how organisations collect, store, use, and share personal information. As a responsible service provider, Amashad Company Registration (Pty) Ltd is fully committed to POPIA compliance. We believe privacy is a fundamental right and treat the protection of your personal information as a core business obligation, not merely a legal checkbox.
This page outlines our adherence to the eight conditions for lawful processing under POPIA, your rights as a data subject, and how to exercise them.
The Eight Conditions for Lawful Processing
Accountability
We take responsibility for ensuring that all personal information processed by us complies with POPIA. Our designated Information Officer oversees all data protection activities.
Processing Limitation
We only collect personal information that is necessary for the specific purpose of company registration. We do not collect excessive or irrelevant data.
Purpose Specification
Your personal information is collected for a clearly defined, specific, and lawful purpose — to facilitate your CIPC company registration — and will not be used for any other purpose without your consent.
Further Processing Limitation
Further processing of your personal information is only permitted if it is compatible with the original purpose for which it was collected, or with your explicit consent.
Information Quality
We take reasonable steps to ensure that the personal information we hold is complete, accurate, not misleading, and updated where necessary.
Openness
We are transparent about our data processing practices and maintain a clear, accessible Privacy Policy. You are informed of the purpose of collection at or before the time of collection.
Security Safeguards
We implement appropriate technical and organisational measures — including 256-bit SSL/TLS encryption, access controls, and regular security reviews — to prevent loss, damage, or unauthorised access to your information.
Data Subject Participation
You have the right to request access to, correction of, or deletion of your personal information at any time, subject to applicable legal retention requirements.
Personal Information We Process
In the course of providing company registration services, we process the following categories of personal information solely for the purpose of fulfilling your application:
- Identity information: Full name, South African ID number or passport number, and a copy of your identity document
- Contact information: Email address, mobile/contact number, and physical address
- Company information: Proposed company names and CIPC registration details upon completion
- Payment reference data: Transaction reference numbers (no card details are stored — PayFast handles all payment processing)
- Technical data: IP address and browser/device information collected via standard web analytics
Legal Bases for Processing
We only process your personal information when we have a lawful basis to do so under POPIA:
Contract performance: Processing is necessary to fulfil the company registration service you have requested from us.
Legal obligation: CIPC requires certain personal information (including identity documents) to register a company in South Africa.
Legitimate interest: To maintain business records, improve our services, and prevent fraud, where this does not override your rights.
Consent: Where we process information for any secondary purpose such as marketing, we will obtain your explicit opt-in consent first.
Your Rights as a Data Subject
Under POPIA, you have the following rights regarding your personal information. To exercise any of these rights, contact our Information Officer at info@amashad.co.za.
Right to Access
Request a copy of all personal information we hold about you.
Right to Rectification
Request correction of inaccurate or incomplete personal information.
Right to Erasure
Request deletion of your personal information, subject to legal retention obligations (minimum 5 years for corporate/tax compliance).
Right to Object
Object to the processing of your information for direct marketing or other incompatible purposes.
Right to Complain
Lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za if you believe your rights have been violated.
Data Retention
We retain your personal information for a minimum of 5 years after your last interaction with us, as required by the Companies Act and SARS regulations. After this retention period, your information is securely deleted or anonymised. You may request early deletion of non-regulated data at any time.
Third-Party Sharing
We do not sell or rent your personal information. We share it only where strictly necessary:
CIPC: Required to process your company registration application with the Companies and Intellectual Property Commission.
PayFast: Secure payment processing. PayFast is PCI-DSS compliant and does not share your financial data with us.
Cloud infrastructure providers: For platform hosting and encrypted data storage, bound by data processing agreements.
Legal & regulatory authorities: Only where required by South African law, court order, or regulatory obligation.
Information Officer Contact
Information Officer
Amashad Company Registration (Pty) Ltd
Johannesburg, Gauteng, South Africa
Email: info@amashad.co.za
You may also lodge a complaint directly with the Information Regulator: inforegulator.org.za