Privacy Policy

1Introduction

Fransua van der Westhuizen, trading as Kanton-West ("Kanton-West", "we", "us", or "our"), respects your right to privacy and is committed to protecting your personal information in accordance with the Protection of Personal Information Act, 2013 ("POPIA") and, where applicable, the General Data Protection Regulation (EU) 2016/679 ("GDPR").

This Privacy Policy explains how we collect, use, store, share and protect personal information in the course of providing CFO advisory, finance hiring and private AI services under the Kanton-West brand.

2Responsible Party

• Responsible party: Fransua van der Westhuizen, trading as Kanton-West
• Information Officer: Fransua van der Westhuizen
• Information Officer registration: 2026-000484 (Information Regulator of South Africa)
• Email: Compliance@SATalent1st.com
• Location: Cape Town, South Africa
• Note: Kanton-West and SATalent1st (Pty) Ltd are separate businesses with the same Information Officer. Compliance correspondence for both is received at the email address above.

3Definitions

"Personal Information" means information relating to an identifiable, living natural person and, where applicable, an identifiable, existing juristic person, as defined in POPIA.

"Special Personal Information" means personal information concerning a person's health, criminal behaviour, biometric data and similar categories to which POPIA affords additional protection.

"Processing" means any operation performed on personal information, including collection, storage, use, sharing and deletion.

"Responsible Party" (the "Controller" under GDPR) means the party that determines the purpose of and means for processing personal information, being Kanton-West.

"Operator" (the "Processor" under GDPR) means a party that processes personal information on behalf of the Responsible Party.

"Data Subject" means the person to whom the personal information relates.

4Purpose of Processing

We collect and process personal information strictly for the following purposes:

• Providing CFO advisory services, including funding and banking, cross-border operations, tax, and the finance function
• Finance hiring: the permanent placement of finance staff, sourced through SATalent1st
• Scoping and delivering private AI services
• Responding to enquiries submitted through our website
• Candidate assessment and reference verification, where a finance hiring engagement requires it
• Compliance with applicable legal and regulatory obligations

5Information We Collect

We may collect the following categories of personal information:

5.1 Basic Information

• Full name
• Contact details (email, telephone, and physical address where provided)
• The company or organisation you represent

5.2 Enquiry Information

• The service you are interested in
• The details of your enquiry (the brief)
• For a finance hiring enquiry: the position sought, a description of your company culture, and the industry sector

5.3 Recruitment Information (finance hiring)

• Where we source a candidate on your behalf, we may process the candidate's employment history, qualifications, curriculum vitae (CV), professional references and availability

5.4 Special Personal Information (only where necessary)

Special personal information is processed only where required by law or by the nature of a finance placement, for example criminal or credit background clearances for a role involving financial control, and only with your explicit consent.

6Lawful Basis for Processing

We process personal information on one or more of the following lawful bases:

• Your voluntary, informed and specific consent
• Our legitimate interest in providing advisory, finance hiring and private AI services
• The performance of a contract to which you are a party, or in order to take steps at your request prior to entering into a contract
• Compliance with a legal or regulatory obligation

Where processing is based on consent, you may withdraw that consent at any time by contacting Compliance@SATalent1st.com. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

7Sharing of Information

Your personal information may be shared with the following categories of recipients, and only to the extent necessary for the service:

• Prospective employers or clients, in the course of a finance hiring engagement
• Candidates, where you are an employer and we present a shortlist to you
• SATalent1st's recruitment operation and the Hired1st platform (finance hiring)
• Professional advisers and service providers who assist us in delivering our services, under confidentiality
• Regulatory authorities, where required by law

We do not sell, rent or trade personal information. What you send us is used only to answer you and to provide the service you asked for, and never for marketing. The service that counts visits to this website, described in section 18, does not receive any of it.

8Website Enquiries and Form Processing

Enquiries submitted through our website are received and delivered by Netlify Forms, operated by Netlify, Inc., for the sole purpose of delivering your message to us. Netlify processes and stores form submissions on infrastructure outside South Africa, and that transfer is covered by section 10 below. The website itself does not store your enquiry. We use the details you provide only to respond to your enquiry and, if you engage us, to provide the service requested.

9Direct Marketing

We do not send unsolicited electronic direct marketing. Where we communicate with you, it is for the purpose of the service or in response to your enquiry. In accordance with POPIA section 69, any electronic marketing would be sent only with your consent or as otherwise permitted by law, and you may opt out at any time by contacting Compliance@SATalent1st.com.

10Cross-Border Transfers

Two kinds of cross-border transfer occur, and they are set out separately because they arise for different reasons.

Website enquiries. Enquiries submitted through the contact form are received and stored by Netlify, Inc. on infrastructure outside South Africa. The transfer is necessary for the performance of the step you asked for, which is that your message reaches us, and it is made on that basis under POPIA section 72.

Website measurement. The visit counts described in section 18 are processed and stored in the European Union. No personal information is included in that data, and the service that holds it never receives anything you send us. The European Union requires a level of protection substantially similar to POPIA, and the transfer is made on that basis under POPIA section 72.

Engagements. Where a finance hiring or advisory engagement involves parties outside South Africa, your personal information may be transferred to, and processed in, countries outside South Africa in order to facilitate the service. Where such transfers occur:

• They are strictly for legitimate service purposes
• Appropriate safeguards are implemented, including contractual data protection obligations on the receiving party
• Your explicit consent is obtained where required by POPIA or GDPR

Where personal information is transferred to a country that does not provide an adequate level of data protection, we ensure that appropriate contractual or other safeguards are in place to protect your information, in accordance with POPIA section 72.

11Data Security

We implement appropriate technical and organisational measures to protect personal information against unauthorised access, loss, destruction or damage.

• Our website is served over encrypted connections (TLS) and stores no personal information itself; website enquiries are transmitted through a secure form-delivery service
• Where finance hiring candidate information is processed, it is managed on the Hired1st recruitment platform (operated for SATalent1st by PowerHouse Hub), which is ISO 27001-certified and operates on secure, globally recognised cloud infrastructure with encryption in transit and at rest
• Role-based access controls, multi-factor authentication, and access logging and monitoring
• Restricted internal access limited to authorised personnel only

Security measures are reviewed regularly and updated as necessary to address emerging threats and vulnerabilities.

12Data Retention

We retain personal information only for as long as is necessary to fulfil the purposes for which it was collected, or as required by law.

• Enquiry records are retained only as long as necessary to respond to and follow up on your enquiry
• Where we source candidates, candidate profiles held on the SATalent1st platform may be retained for up to 3 years from the date of last activity, unless earlier deletion is requested
• Records required for regulatory compliance or audit purposes may be retained for the period prescribed by applicable law

You may request deletion of your personal information at any time by contacting Compliance@SATalent1st.com. We will action your request unless we are required by law to retain the information.

13Automated Decision-Making and Profiling

Where we source finance candidates, we may match skills, qualifications and availability to suitable roles. We do not make decisions that produce legal effects concerning you, or similarly significantly affect you, based solely on automated processing. Shortlisting and placement decisions are reviewed personally by a qualified member of our team.

You have the right to request human intervention, to express your point of view, and to contest any such decision, in accordance with POPIA section 71 and, where applicable, GDPR Article 22.

14Your Rights

Under POPIA, and where applicable the GDPR, you have the following rights in relation to your personal information:

• Access: to request confirmation of whether we hold personal information about you, and a copy of that information
• Correction: to request correction or updating of inaccurate, incomplete or misleading personal information
• Deletion: to request deletion or destruction of your personal information where it is no longer necessary for the purpose for which it was collected
• Objection: to object to the processing of your personal information on reasonable grounds
• Withdrawal of consent: to withdraw consent at any time, where processing is based on consent
• Restriction of processing: to request that we restrict the processing of your personal information in certain circumstances (GDPR)
• Data portability: to receive your personal information in a structured, commonly used and machine-readable format, and to transmit it to another controller (GDPR)
• Complaint: to lodge a complaint with the Information Regulator of South Africa or, for EU data subjects, with the relevant supervisory authority in your member state

To exercise any of these rights, please contact Compliance@SATalent1st.com. We will respond to your request within the timeframes required by applicable law (generally within 30 days under POPIA, or one month under GDPR).

15Children's Data

Our services are directed at businesses and professionals and are not intended for children. We do not knowingly collect or process the personal information of children (persons under 18) without the consent of a competent person, as required by POPIA section 34. If you believe we have inadvertently collected such information, please contact Compliance@SATalent1st.com and we will delete it.

16Data Breaches

In the event of a personal data breach that poses a risk to the rights and freedoms of data subjects, we will:

• Take immediate steps to contain and remediate the breach
• Notify the Information Regulator of South Africa as soon as reasonably possible, as required by POPIA section 22
• Notify affected data subjects where the breach is likely to result in a risk to their rights and freedoms
• Where applicable, notify the relevant EU supervisory authority within 72 hours in accordance with GDPR Article 33

All suspected or actual data breaches are investigated under our internal Data Breach Protocol and recorded for audit purposes.

17Third-Party Processing: Hired1st Platform

Where finance hiring involves candidate information, SATalent1st utilises the Hired1st recruitment platform (operated by PowerHouse Hub) to securely manage that information.

17.1 Roles and Responsibilities

• SATalent1st acts as the Data Controller (Responsible Party) and determines the purposes and means of processing
• Hired1st acts solely as Data Processor (Operator) and processes personal information only on SATalent1st's documented instructions

All personal data processed on the platform remains the property of SATalent1st and/or the relevant data subject. Hired1st does not use personal data for analytics, marketing or any purpose other than providing the recruitment platform service.

17.2 Data Processing Standards

• Only in accordance with SATalent1st's documented instructions
• In alignment with applicable privacy laws, including POPIA and GDPR
• Under ISO 27001-certified information security management standards

17.3 Security Controls

• Encryption of data in transit (TLS) and at rest (AWS SSE-S3/KMS)
• Role-based access controls and multi-factor authentication
• Comprehensive access logging
• Secure, globally recognised cloud infrastructure (AWS)

Access by Hired1st personnel occurs only where necessary (for example, support or troubleshooting) and is subject to strict authorisation and logging controls.

17.4 Candidate Privacy Controls

• Candidates control what information employers can view on their profile
• Candidates can set availability status, removing their profile from active search results
• Candidates can edit, update or delete their profiles at any time
• Candidate contact details are hidden from employers until the candidate is shortlisted

17.5 Retention and Deletion

Data processed via the Hired1st platform is retained for the duration of the active service relationship unless deletion is requested. Upon termination of the service agreement, data is securely deleted in accordance with Hired1st's data retention and termination policy, unless otherwise instructed by SATalent1st.

18Website and Cookies

Our website does not set cookies for analytics, marketing, advertising or profiling. Any cookies used are strictly essential to the operation and security of the site.

18.1 How we count visits

We use Plausible Analytics to count how many people visit the site and which pages they read. In the same aggregate way it also counts clicks on links that lead away from this site, downloads of documents published here, and the fact that the contact form was submitted, never its contents. We use it because it does the counting without identifying anyone.

It sets no cookies and creates no persistent identifier. It does not store your IP address. It records the page address, the website you arrived from, your browser, your operating system, your device type and your country, and it keeps all of that in aggregate. Nothing it records identifies you, and nothing it records can follow you to another website. Because no personal information is involved, no consent banner is required and none is shown.

We also count how often the main buttons are used, so we can tell which pages lead to an enquiry. That count records the button, never the person who pressed it.

The data is held in the European Union. See section 10.

19Access to Information (PAIA)

Your right of access to records held by Kanton-West is governed by the Promotion of Access to Information Act, 2000 (PAIA). Our PAIA manual sets out the procedure for requesting access to information and is available on request from Compliance@SATalent1st.com.

20Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology or legal requirements. The most recent version will always be published on our website. We encourage you to review this policy periodically. Where material changes are made that affect how we process your personal information, we will take reasonable steps to notify you.

21Governing Law

This Privacy Policy and any processing of personal information described in it are governed by the laws of the Republic of South Africa, including POPIA and PAIA. Where we process the personal information of data subjects in the European Union, the GDPR applies to that processing.

22Contact and Complaints

For any questions regarding this Privacy Policy, your personal information, or to exercise any of your rights, please contact:

• Information Officer: Fransua van der Westhuizen
• Responsible party: Fransua van der Westhuizen, trading as Kanton-West
• Compliance: Compliance@SATalent1st.com
• General enquiries: Info@SATalent1st.com

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Regulator of South Africa (inforegulator.org.za) or, for EU data subjects, the supervisory authority in your member state of residence.