Privacy notice

Draft for the firm's review. This notice has been drafted for review by Lebesa CA and Advisory Services before publication. It applies the principles of the Lesotho Data Protection Act 2011 and should be checked against the firm's actual practices.

Who we are

Lebesa CA and Advisory Services is a registered audit firm in Maseru, Lesotho. In this notice, "we" and "us" mean the firm.

What we collect

We collect personal information that you give us, or that we receive in the course of our work. This may include:

your name, job title and contact details
information you send through our contact forms
login details and activity records for the client portal
documents and financial records that you or your organisation upload for an engagement
basic technical information needed to run the website securely

Why we use it

We only use personal information for lawful purposes connected with our work. These include:

answering your enquiries
deciding whether we can accept an engagement, including independence and identity checks
providing the services set out in an engagement letter
running and securing the website and client portal
meeting our legal and professional obligations

We collect only what we need for these purposes, and we try to keep it accurate and up to date.

Marketing

We will only send you newsletters or other marketing messages if you have given your consent. You can withdraw consent at any time, using the link in the message or by contacting us.

We do not sell personal information. We share it only where needed:

with service providers who process information on our behalf, such as our email provider, our document storage and hosting providers, and our IT support
with regulators or authorities where the law requires it
with others where you have asked us to, or agreed

We require our service providers to keep the information secure and to use it only on our instructions.

Where it is stored

Client documents uploaded to the portal are hosted in data centres in Johannesburg, South Africa, or in Lesotho. Some service providers, such as email providers, may process information in other countries. Where that happens, we take reasonable steps to make sure the information is properly protected.

Security

We use reasonable technical and organisational measures to protect personal information. These include encrypted connections, access controls and limiting access to staff who need it. No system is completely secure, so please tell us at once if you think your portal account has been misused.

How long we keep it

We keep personal information only for as long as we need it for the purposes above, and for any period required by law or professional rules. The firm sets and reviews its retention periods. When information is no longer needed, we delete it or make it anonymous.

Your rights

You may ask us:

whether we hold personal information about you, and for a copy of it
to correct information that is wrong or incomplete
to stop using your information for marketing

We may need to confirm your identity first. If some information must be kept for legal or professional reasons, we will explain.

Contact us

To make a request or ask a question about this notice, email us at the address published on our contact page.

We may update this notice from time to time. The date at the top shows when it was last changed.