Privacy and your data

Who is responsible for your information

The responsible party is Sevan Technologies (Pty) Ltd, a company registered in the Republic of South Africa, trading as Provio.

Our Information Officer is registered with the Information Regulator (South Africa) and can be reached at removeme@provio.co.za. Our PAIA manual, prepared under the Promotion of Access to Information Act 2 of 2000, is available free of charge on request from the same address.

We process personal information as a responsible party for your account, and our hosting, storage, email and payment providers act as operators on our behalf under written agreements requiring confidentiality and appropriate security.

Your data is yours

Everything you capture in Provio — income, deductions, receipts, invoices and payments made to SARS — belongs to you. We use it for one purpose only: to produce your estimates, your summaries and your download packs.

We do not use your financial records to train anything, to build profiles of you, or for advertising.

Who can see it

Every account is isolated. Access rules are enforced at the database layer, so records captured under your account can only be read by your account — not by another customer, and not by someone who simply knows a link.

Our team does not browse, read or work with your captured records as part of running the platform. Where we ever need to act on your data — for example if you ask us to delete your account — it happens because you asked us to, and only to the extent needed to do what you asked.

Never sold. Shared with one exception: your own consultant

Provio does not sell, rent or trade your personal or financial information, and we do not share it with advertisers or data brokers.

The only exception is one you create yourself. If you link a tax consultant to your profile using their practitioner code, that consultant can view the figures you have captured so they can advise you. That view is read-only — a consultant cannot add, change or delete anything in your account, and cannot make submissions on your behalf from Provio.

If you have not linked a consultant, nobody has that view. You can remove a linked consultant from your settings at any time.

Receipts and uploaded files

Files you upload are kept in private storage. They are not published, not indexed and not reachable by a public URL. When you open a receipt, it is served through a short-lived authorised link generated for your session — and for a consultant you have linked, in read-only form.

Images are compressed on upload to keep them legible while reducing what needs to be stored.

How we protect it — stated honestly

Traffic between your device and Provio is encrypted in transit, and your records are encrypted at rest. Access requires an authenticated sign-in, per-account access rules are applied on every database read and write, and file storage is private by default.

What we will not do is promise you the impossible. No online service can guarantee that it will never be breached, and we make no such guarantee. What we commit to is keeping the safeguards above in place, holding only the information the platform actually needs, and telling you promptly if something happens that affects your data.

Keeping and deleting your records

SARS expects supporting documents to be kept for five years after submission, so Provio keeps your records available for as long as you keep your account — that is the point of the platform.

You can ask us to delete your account and everything in it. Once deleted, your records and uploaded files are removed and cannot be recovered, so download your evidence pack first if you need it.

What we record when you accept this notice

When you create an account you confirm that you have read this privacy notice and the terms of service. We store which numbered version of each document you accepted and when, so that both you and we can always establish exactly what was agreed.

If either document is updated, you will be asked to read and accept the new version, and that acceptance is recorded in the same way.

Questions or deletion requests

Write to removeme@provio.co.za to ask a question about your data, to request a copy of it, or to have your account and records deleted.

Cookies and tracking

Provio uses cookies and similar device storage. Strictly necessary ones keep you signed in, keep your session secure, remember the tax year you are viewing and let payments complete — the platform cannot work without them, and they are used on the basis of our legitimate interest in delivering the service you asked for.

Optional cookies are switched off until you actively allow them. Preference cookies remember non-essential choices; analytics cookies give us anonymous, aggregated usage statistics so we can improve the platform. We do not use advertising or cross-site tracking cookies, and we do not sell tracking data.

The cookie notice appears on your first visit and lets you accept all or reject all optional cookies with equal ease. You can change your choice at any time using the “Cookie preferences” link in the footer, and you can also clear cookies in your browser. Rejecting optional cookies never limits your access to the service.

What we collect, why, and on what lawful basis

Account information (name, email address, and the fact of a Google sign-in where you use one) — to create and secure your account and to contact you about the service. Basis: performance of our contract with you.

Financial records you capture (income, deductions, receipts, SARS payments, set-aside balances and tax profile details such as date of birth and medical scheme membership) — to produce your estimates and download packs. Basis: performance of our contract, on your instruction.

Billing information (plan, subscription status, payment references) — to take payment and meet tax and accounting record-keeping obligations. Card numbers are handled by Payfast and never reach us. Basis: contract and legal obligation.

Technical information (IP address, browser details, error logs) — to keep the platform secure and working. Basis: legitimate interest.

Providing this information is voluntary, but without it we cannot give you an account or produce estimates. We collect it directly from you unless you ask us to obtain something on your behalf.

Your rights under POPIA

You have the right to be told what personal information we hold about you and to receive a copy of it; to have information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained corrected or deleted; to object to processing on reasonable grounds; to withdraw a consent you previously gave; and not to be subject to a decision based solely on automated processing that has legal consequences for you.

Provio does not make automated decisions about you. Its estimates are calculations you request; they are not decisions taken about you, and SARS — not Provio — determines what you actually owe.

To exercise any of these rights, email removeme@provio.co.za. We respond within a reasonable time and, where the law prescribes a form or a fee for an access request, we will tell you before proceeding.

If you are unhappy with how we handled your information you may lodge a complaint with the Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, or by email to complaints.IR@inforegulator.org.za.

Where your information is processed, and for how long

Provio runs on cloud infrastructure that may store or process data outside South Africa. Where information crosses a border, section 72 of POPIA is met: we only use providers bound by contractual terms that give your information a level of protection substantially similar to POPIA, or where the transfer is necessary to perform our contract with you.

SARS may require supporting documents to be kept for five years after a return is submitted, so we keep your records for as long as you keep your account, and for as long afterwards as any tax, accounting or legal record-keeping duty requires. Billing records are kept for the period South African tax law requires.

When you ask us to delete your account, your records and uploaded files are removed and cannot be recovered — download your evidence pack first. Legal acceptance records and billing records are retained where we are obliged to keep them.

Emails, marketing and security incidents

Service emails — verification codes, receipts, renewal and deadline notices — are part of the service and are sent to your account address.

We only send marketing or product-update emails where section 69 of POPIA allows it: to customers about our own similar services, or where you have opted in. Every such email has a one-click unsubscribe, and opting out never affects your account.

If a security compromise affects your personal information, section 22 of POPIA requires us to notify both the Information Regulator and you as soon as reasonably possible after establishing what happened. We will do so, in plain language, with what we know and what you should do.

Provio is not intended for children under 18, and we do not knowingly collect the personal information of children.