Privacy Policy

ACK & Associates (Pty) Ltd, registration number 2014/123456/07, with its principal place of business in Cape Town, South Africa ("we", "us", "our"), respects your privacy and is committed to protecting your personal information in accordance with the Protection of Personal Information Act, 2013 (POPIA), Act 4 of 2013.

This Privacy Policy applies to all personal information collected through our website at ackaa.co.za and related services, including our online payment portal, proof of payment upload facility, and payment arrangement request system.

We collect personal information necessary for the resolution of medical accounts, including:

• Identity Information: Full name, South African ID number, date of birth, and matter reference numbers
• Contact Information: Physical address, email address, telephone numbers, and WhatsApp contact details
• Financial Information: Payment history, bank account details (where provided for EFT payments), and payment arrangement preferences
• Account Information: Medical service provider details, outstanding balances, invoice details, and account status
• Technical Information: IP address, browser type, device information, and website usage data via cookies and similar technologies

3. How We Collect Information

We collect personal information from the following sources:

• Directly from you: When you complete forms on our website, make payments, upload proof of payment, request payment arrangements, or contact us via email, telephone, or WhatsApp
• From healthcare providers: Medical service providers (our clients) provide us with account holder information for debt recovery purposes
• From credit bureaus: We may verify information with registered credit bureaus in accordance with the National Credit Act
• Automatically: Through cookies, web analytics, and server logs when you browse our website

4. Purpose of Processing

We process your personal information for the following lawful purposes:

• To verify your identity and locate your account
• To facilitate payment of outstanding medical accounts
• To process and confirm proof of payment submissions
• To negotiate and manage payment arrangements
• To communicate with you regarding your account status
• To comply with legal and regulatory obligations
• To maintain our records and perform internal administrative functions
• To prevent fraud and ensure the security of our systems
• To improve our website functionality and user experience

5. Lawful Basis for Processing

In terms of POPIA, we rely on the following lawful bases for processing your personal information:

• Contractual necessity: Processing is necessary for the performance of our mandate from healthcare providers to recover outstanding accounts
• Legal obligation: Processing is necessary to comply with applicable laws, including tax, financial services, and consumer protection legislation
• Consent: Where required, we obtain your explicit consent before processing sensitive personal information or sharing data with third parties beyond what is necessary for account resolution
• Legitimate interest: Processing is necessary for our legitimate business interests in recovering debts owed to our clients, provided this does not override your fundamental rights

We may share your personal information with the following categories of recipients, but only to the extent necessary for the purposes described above:

• Healthcare providers: The medical service providers on whose behalf we act, for account management and reconciliation purposes
• Payment processors: PayFast (Pty) Ltd and other secure payment gateways for processing online card and EFT payments
• Legal and regulatory authorities: Courts, regulators, and law enforcement agencies where required by law or to protect our legal rights
• Professional advisors: Auditors, attorneys, and other advisors bound by confidentiality obligations
• Service providers: IT service providers, cloud hosting services, and data storage providers who process data on our behalf under strict data protection agreements

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

7. Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include:

• SSL/TLS encryption for all data transmitted via our website
• Secure server infrastructure with firewalls and intrusion detection
• Access controls limiting data access to authorised personnel only
• Regular security assessments and vulnerability testing
• Staff training on data protection and POPIA compliance

While we take all reasonable precautions, no internet transmission is completely secure. You acknowledge that you provide personal information at your own risk.

8. Data Retention

We retain your personal information for as long as necessary to fulfil the purposes for which it was collected, including:

• For the duration of any outstanding account and any related payment arrangement
• After account settlement, for the period required by applicable tax and financial record-keeping laws (generally five years)
• For any period necessary to establish, exercise, or defend legal claims

Once the retention period expires, your personal information will be securely deleted or anonymised in accordance with our data destruction policy.

9. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to:

• Ensure the proper functioning of our website and payment systems
• Remember your preferences and session information
• Analyse website traffic and usage patterns to improve our services
• Detect and prevent fraudulent activity

You can manage cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of our website.

10. Your Rights Under POPIA

As a data subject, you have the following rights in terms of POPIA:

• Right to access: Request confirmation of whether we hold your personal information and request access to that information
• Right to correction: Request correction of inaccurate, misleading, or outdated personal information
• Right to deletion: Request deletion of personal information that is no longer necessary for the purpose for which it was collected, subject to legal retention requirements
• Right to object: Object to the processing of your personal information on reasonable grounds
• Right to lodge a complaint: Lodge a complaint with the Information Regulator if you believe your rights have been infringed

To exercise any of these rights, please contact us using the details provided below. We will respond to your request within the timeframes prescribed by POPIA.

11. Third-Party Websites

Our website may contain links to third-party websites, including payment gateways and healthcare provider portals. We are not responsible for the privacy practices or content of these external sites. We encourage you to read the privacy policies of any third-party sites you visit.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. The updated policy will be posted on this page with a revised "Last updated" date. We encourage you to review this policy periodically.