Who we are. Walt Capital Management (Pty) Ltd (registration number 2018/393397/07, FSP 50218) is the "responsible party" that decides how and why your personal information is processed. Office: The Vineyard Office Estate, 99 Jip de Jager Drive, De Bron, Cape Town, 7530. Postal address: 5 Pascali Street, Rosendal, Durbanville, Cape Town, Western Cape, 7550 · +27 82 255 4403 · [email protected]. Our Information Officer is Pierre van der Walt, with Jason van der Walt as deputy; both can be reached at the same details.
What we collect. When you become a client we collect: your identity details (names, ID or passport number, date and place of birth, nationality); contact details and addresses; banking details; tax number; employment, occupation and industry; the source of the money you invest; marital status; whether you or people close to you hold prominent public positions; your answers to our risk profile questionnaire; copies of the verification documents you upload (such as your ID, proof of address, proof of bank account and tax verification); your typed signatures with the date, place, and technical details of the device used to sign (IP address and browser identifiers); and our communications with you.
Why we collect it, and on what basis. We process your information:
- because the law requires it — the Financial Intelligence Centre Act requires us to identify and verify you, understand the source of your funds and the purpose of the relationship, screen against financial sanctions lists, and keep records; the Financial Advisory and Intermediary Services Act and its codes of conduct require us to know your financial circumstances, objectives and risk profile and to keep records of the services we render;
- because it is necessary to perform our contract with you — managing your investments under the mandate you sign, reporting to you, and administering your account; and
- with your consent — only for anything not covered above (such as optional profile items or marketing, if any). You may withdraw such consent at any time; withdrawal does not affect processing we must do by law or under our contract with you, and does not affect what was lawfully done before you withdrew.
Is providing information voluntary? The information marked as required during onboarding is mandatory: without it the law does not allow us to open or continue a business relationship with you, and we will not be able to take you on as a client. Optional items are marked as such.
Who we share it with. Your information is shared only where needed: with the stockbrokers and investment platforms through which your portfolio is managed; with our independent external compliance officer (Providus Compliance Consulting); with our contracted IT service providers that host and support our systems; with regulators and authorities where the law requires or permits it; and with professional advisers (such as auditors) where applicable. We do not sell your personal information, and we do not share it with anyone for their own marketing.
Where it is stored (overseas transfer). Our client system is hosted with Supabase in Frankfurt, Germany (European Union). Your information there is protected by the European Union's General Data Protection Regulation — a data-protection law that provides a level of protection substantially similar to South Africa's POPIA — and by a binding data-processing agreement with the host. If you invest in offshore portfolios, the information needed to open and operate accounts with foreign brokers is transferred to those brokers because the transfer is necessary to perform your mandate; those brokers are regulated in their home jurisdictions.
How long we keep it. We keep client records for at least five years after our relationship (or the relevant transaction) ends, because financial-sector laws require it; we keep records longer only where there is a lawful reason. If you start signing up but do not finish, your incomplete onboarding information is deleted after 14 days.
How we protect it. Access to your information is restricted by role and protected by authentication, including two-factor authentication, and key actions in our systems are recorded in audit logs that cannot be edited or deleted. Verification documents are stored in access-controlled storage and served only through expiring, signed links.
Your rights. You may: ask whether we hold personal information about you and request access to it; ask us to correct or, where the law allows, delete it; object on reasonable grounds to processing (where the processing is not required by law); withdraw any consent you gave; and complain to the Information Regulator. We will tell you if your personal information is ever accessed by an unauthorised person, as the law requires.
The Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 · [email protected] · complaints can also be lodged on the Regulator's eServices portal (eservices.inforegulator.org.za).
Special personal information. We do not intentionally collect special personal information (such as health, religious or biometric information). If a document you provide happens to contain such information, we process it only as far as the law permits and for no other purpose.
Direct marketing. We will only send you electronic marketing if you have consented, or if you are an existing client and the message concerns similar services — and every such message will offer a way to opt out.
Changes. If this notice changes materially, we will publish the updated version and tell you. This notice was last updated on 21 July 2026.