LEGAL

Privacy & POPIA Policy

Effective Date: 1 March 2026 · Rack City Finance (Pty) Ltd t/a Gemma Tax Engine (CIPC Reg No: 2024/563250/07 · https://gemmatax.co.za)

1. Introduction

Rack City Finance (Pty) Ltd ("Gemma Tax Engine", "we", "us") is committed to protecting your personal information in accordance with South Africa's Protection of Personal Information Act, 2013 (POPIA) and equivalent data protection standards in the other jurisdictions we serve.

2. Information We Collect

We collect account details (name, email, phone), identity and business verification data, financial and transaction data obtained through open-banking connections you authorise, and technical data such as device and usage information.

3. How We Use Your Information

We use your information to operate the Service, calculate tax estimates, reconcile income and deductions, verify your identity, process payments, provide support, and improve the platform.

4. Legal Basis for Processing

We process personal information on the basis of your consent, the performance of our contract with you, and our legitimate interest in operating and securing the Service, consistent with the conditions for lawful processing set out in POPIA.

5. POPIA Section 19 Data Encryption & Cryptographic Security

User bank statement uploads and ledger transactions are processed strictly in accordance with Section 19 of the Protection of Personal Information Act (POPIA). All personal and financial data is minimized, encrypted in transit using TLS 1.3 and at rest using AES-256 encryption, and utilized solely for your automated tax ledger calculations. We do not store raw credit card numbers or banking passwords on our servers; all subscription payments are processed securely via Payfast (Pty) Ltd.

6. Bank API Token Retention

7. Sharing of Your Information

We share data with trusted service providers strictly to deliver the Service, including PayFast (payments), Banklink, Mono and Stitch (open banking), and verification providers such as CIPC, LexisNexis and credit bureaus where applicable. We do not sell your personal information.

8. Cross-Border Data Transfers

Because Gemma Tax Engine operates across South Africa, Kenya, Nigeria and Ghana, your information may be processed in a jurisdiction other than your own. Where this occurs, we take reasonable steps to ensure an equivalent level of protection.

9. Your Rights Under POPIA

You may request access to, correction of, or deletion of your personal information, and may object to certain processing. You also have the right to lodge a complaint with the Information Regulator of South Africa or the equivalent authority in your jurisdiction.

10. Data Retention

We retain tax-related records for as long as required by applicable revenue authority record-keeping rules (generally five years) and delete or anonymise other personal data once it is no longer needed for the purposes described in this Policy.

11. Cookies

We use essential cookies to keep you signed in and to understand basic usage of the Service. You can control cookies through your browser settings.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the Service or by email.

13. Contact & Information Officer

For privacy questions, POPIA Section 19/23 requests, or to exercise your data rights, contact our Information Officer: Kyle Darrian Peters (CEO, Rack City Finance (Pty) Ltd t/a Gemma Tax Engine · CIPC Registration Number: 2024/563250/07) · Company Address & Registered Domicilium: 56 St Ives Road, Bellair, Queensburgh, Durban, 4096 · Contact Number: 079 432 5720 · Support Email: support@gemmatax.co.za · Website: https://gemmatax.co.za. You also have the right to lodge a complaint with the Information Regulator of South Africa (inforeg@justice.gov.za)