Privacy Policy

CTC Stander & Associates (“we”, “us”, or “our”) is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and disclose your personal information in compliance with the Protection of Personal Information Act, 4 of 2013 (“POPIA”) and other applicable South African legislation.

By accessing our website or engaging our legal services, you acknowledge that you have read and understood this Privacy Policy.

For the purposes of POPIA, the responsible party is:

We may collect and process the following categories of personal information, as defined in POPIA:

• Identity information: full name, identity number, date of birth, gender, and nationality.
• Contact information: email address, telephone number, physical and postal address.
• Financial information: tax reference numbers, banking details, income and asset information relevant to your legal matter.
• Legal matter information: case details, correspondence, court documents, and any other information pertinent to the legal services we provide.
• Website usage data: IP address, browser type, pages visited, and cookies (see section 10 below).

We process your personal information for the following lawful purposes:

• To provide legal advice, representation, and related professional services.
• To communicate with you regarding your matter, enquiries, or consultations.
• To comply with our legal and regulatory obligations, including those under the Financial Intelligence Centre Act (FICA), the Legal Practice Act, and the Tax Administration Act.
• To administer our client accounts and process payments.
• To improve our website, services, and client experience.
• To send you relevant legal updates or newsletters where you have opted in to receive them.

In terms of POPIA, we process your personal information based on one or more of the following grounds:

• Consent: where you have given us express or implied consent.
• Contractual necessity: where processing is necessary to perform our mandate or engagement agreement with you.
• Legal obligation: where we are required by law to process your information (e.g., FICA, Tax Administration Act).
• Legitimate interest: where processing is necessary for our legitimate interests, provided your rights do not override those interests.

We do not sell, rent, or trade your personal information. We may share your information with:

• Courts, tribunals, regulatory authorities, and other governmental bodies as required for your legal matter or by law.
• The South African Revenue Service (SARS), the Financial Intelligence Centre (FIC), and other statutory bodies where legally required.
• Third-party service providers who assist us in delivering our services (e.g., IT support, document management), subject to appropriate data processing agreements.
• Counsel, experts, and other professionals engaged on your behalf.

Where we transfer personal information to any third party, we take reasonable steps to ensure that such party treats your information in accordance with POPIA.

We retain your personal information only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. In general:

• Client files and related records are retained for a minimum of five years after the conclusion of your matter, in accordance with the Legal Practice Act and other regulatory requirements.
• Financial records are retained for the periods prescribed by the Tax Administration Act and the Companies Act.
• FICA records are retained for at least five years from the date the business relationship is terminated.

Once the retention period has expired, your personal information will be securely destroyed or de-identified.

We are committed to ensuring the security of your personal information. We have implemented appropriate technical and organisational measures to safeguard your information against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest.
• Access controls limiting access to personal information to authorised personnel only.
• Regular security assessments and audits.
• Secure physical storage of paper-based records.

In the event of a data breach that poses a risk to your rights, we will notify you and the Information Regulator as required under section 22 of POPIA.

As a data subject, you have the following rights under POPIA:

• Right of access: you may request confirmation of whether we hold personal information about you, and request a copy thereof.
• Right to correction: you may request that we correct or update inaccurate, misleading, or incomplete personal information.
• Right to deletion: you may request the deletion of your personal information where it is no longer necessary for the purpose for which it was collected, subject to any legal obligations requiring retention.
• Right to object: you may object to the processing of your personal information on reasonable grounds.
• Right to withdraw consent: where processing is based on consent, you may withdraw your consent at any time.
• Right to lodge a complaint: you may lodge a complaint with the Information Regulator if you believe your personal information has been unlawfully processed.

To exercise any of these rights, please contact us using the details provided in section 2 above.

Our website may use cookies and similar technologies to enhance your browsing experience. Cookies are small text files placed on your device that help us analyse website traffic and improve our services.

You may choose to disable cookies through your browser settings. Please note that disabling cookies may affect the functionality of certain parts of our website.

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of those websites. We encourage you to read the privacy policies of any third-party websites you visit.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable legislation. Any material changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.

If you are dissatisfied with our handling of your personal information, you have the right to lodge a complaint with the Information Regulator:

If you have any questions about this Privacy Policy or wish to exercise your rights under POPIA, please contact us: