How we handle your information

1Who we are

DNA Invest is an advisor platform operated by attooh! Financial Wellness (Pty) Ltd, an authorised Financial Services Provider under licence number 32189. In this policy "we", "us" and "our" mean attooh! Financial Wellness (Pty) Ltd.

We are the responsible party for the personal information we process about advisors who use the platform, and about visitors to this website. Where a financial advisor uses DNA Invest to record information about their own clients, the advisor and their licensed practice remain the responsible party for that client information; we process it on their instruction as an operator.

2What personal information we collect

Whose information	What we hold
Advisors using the platform	Name, email address, telephone number, branch or office, FSP category, licence details, a securely hashed password, sign-in activity, and the records you create in the platform.
Advisors' clients captured by an advisor	Name and contact details, South African identity number or passport number, date of birth, gender and citizenship derived from that number, physical address, marital status, policy and contract references, investment amounts and the funds they are held in, risk profile scores and matched model portfolios, dates of advice and review, adviser notes, and documents the advisor uploads to the client's file.
Website visitors	Anything you submit through the enquiry form, including your name, business name, email address and your message. Standard technical information such as your browser type and the pages you view.

Identity numbers, financial detail and any information about your health or family circumstances are treated as sensitive. We collect them only where we need them for financial advice, or to meet an obligation placed on us by law.

3Why we hold it, and on what basis

Purpose	Lawful basis under section 11
Operating advisor accounts and the platform	Performance of a contract with you
Recording advice, suitability and the advice trail	Compliance with an obligation in law — the Financial Advisory and Intermediary Services Act
Verifying identity and screening	Compliance with an obligation in law — the Financial Intelligence Centre Act
Calculating and settling commission	Performance of a contract, and our legitimate interest in running the business
Answering an enquiry you send us	Steps taken at your request before entering a contract
Improving and securing the platform	Our legitimate interest, balanced against your rights

We do not use personal information for a new purpose that is incompatible with the one it was collected for, unless you consent or the law allows it.

4Where the information comes from

Most information comes directly from you, or from the advisor acting for you. Some is derived rather than asked for: a South African identity number, once validated, yields the date of birth, age, gender and citizenship rather than our asking again. We may also receive information from product providers, administrators and public registers where that is necessary for advice or for a statutory check.

5Who we share it with

We do not sell personal information. We share it only where there is a reason to, and only as far as that reason requires:

• Your advisor and their practice, who need it to advise you.
• Product providers, administrators and fund managers, where an investment is placed or serviced.
• Our operators — the suppliers who host the platform, send email on our behalf and provide supporting services. They act on our instruction, under contract, and may not use the information for their own purposes.
• Regulators, auditors and law enforcement, where we are required or permitted to disclose.

6Sending information outside South Africa

The platform and its database are hosted in a cloud environment. Where personal information is processed outside South Africa, we do so only where the receiving country or the supplier is subject to a law, binding rules or a contract that upholds principles substantially similar to POPIA, as section 72 requires.

7How we protect it

We take the steps section 19 requires to secure the integrity and confidentiality of personal information. In practice that includes:

• Passwords stored only as a one-way cryptographic hash, never in readable form.
• Access controlled by role, so an advisor sees only their own clients.
• Client documents stored outside the public web path and released only after an ownership check.
• A database that is not reachable from the public internet.
• Encryption of traffic between your browser and the platform.

If a security compromise affects your personal information, we will notify you and the Information Regulator as soon as reasonably possible after establishing what happened, as section 22 requires.

8How long we keep it

We keep records for as long as we need them for the purpose they were collected for, and then for as long as the law requires us to. Records of financial advice and the supporting client file are kept for a minimum of five years, as required under FAIS and FICA. Where we no longer need a record and no law requires us to keep it, we delete it or de-identify it.

9Your rights

Under POPIA you may:

• Ask what personal information we hold about you, and ask for a copy.
• Ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully.
• Object to our processing on reasonable grounds, where we rely on legitimate interest.
• Withdraw a consent you have given, without affecting processing already carried out.
• Complain to the Information Regulator.

Make a request about your information →

You can also write to our Information Officer using the details at the foot of this page. A request for access to a record follows the PAIA procedure set out in Part 2. We may need to verify your identity before we act, so that we do not disclose your information to somebody else.

10Direct marketing

We send electronic marketing only where you are an existing customer and the message concerns a similar product or service, or where you have consented. Every message carries a way to opt out, and we act on an opt-out promptly. We do not sell your details to anybody else for their marketing.

11Cookies and local storage

This website uses only what it needs to work. The portal sets a session cookie so that you stay signed in; without it you could not use the platform. The marketing site stores a small flag in your browser's local storage once you have registered, so that the advisor tools stop showing as locked. We do not use advertising or cross-site tracking cookies. You can clear or block these through your browser, though the portal will not keep you signed in if you block its session cookie.

This manual tells you what records attooh! Financial Wellness (Pty) Ltd holds and how to ask for access to them. It is available free of charge on this page, and on request at our offices.

12Particulars of the private body

Registered name	attooh! Financial Wellness (Pty) Ltd
Trading as	attooh! Financial Wellness · DNA Invest
Registration number	to be supplied
FSP licence number	32189
Registered address	to be supplied
Postal address	to be supplied
Telephone	to be supplied
Website	www.attooh.co.za

13Information Officer

The head of the private body is the Information Officer for the purposes of PAIA and POPIA. All requests for access to records, and all queries about personal information, should be addressed to:

Information Officer	name to be supplied
Email	dnainvest@attooh.co.za
Deputy Information Officer	if appointed

14The Regulator's guide on how to use the Act

The Information Regulator has published a guide, in terms of section 10, on how to use the Act. It is available from the Regulator in each official language, and can be obtained from the contact details at the foot of this page or downloaded from inforegulator.org.za.

15Categories of records we hold

Category	Records
Company	Founding documents, statutory registers, minutes, shareholder records, insurance policies.
Financial	Annual financial statements, ledgers, tax records, banking records, commission and billing records.
Advisors	Contracts, licence and accreditation records, commission agreements, correspondence.
Clients	Client files, records of advice, suitability analyses, FICA verification, application forms, investment instructions, review records.
Employees	Employment contracts, payroll, leave, disciplinary records, training records.
Compliance	Compliance reports, risk management plans, regulatory correspondence, complaints records.
Operational	Supplier contracts, platform and system records, correspondence.

Listing a category does not mean the records in it are available on request. Access is decided against the grounds for refusal in Chapter 4 of the Act.

16Records available without a formal request

The following are available without a PAIA request: this manual, the privacy policy, the material published on this website, and any document we are required by another law to make public. We have not published a notice under section 52(2), so any other record must be requested under section 18.

17How to request a record

1. Complete Form 2 of the PAIA regulations, the prescribed form for a request to a private body, available from the Information Regulator's website.
2. Send the completed form to the Information Officer at the address above.
3. Give enough detail for us to identify the record and to identify you, and state the form of access you would like and how you would like to be told the outcome.
4. If you are asking for the record in order to exercise or protect a right, say which right and how the record would help you do so. The Act requires this.
5. If you are asking on somebody else's behalf, attach proof that you are authorised to do so.
6. Pay the request fee where one is payable. We will confirm the amount.

We will decide within 30 days and tell you the outcome in writing. That period may be extended by a further 30 days where the request is for a large number of records or where a search through separate offices is needed. We will tell you if it is extended, and why.

18Fees

Two fees may apply. A request fee is payable before we process the request. An access fee covers the cost of searching for, preparing and reproducing the record, and is payable before it is released. Where we estimate that preparation will take more than the prescribed hours, we may require a deposit.

Fees are those prescribed in the PAIA regulations and are revised from time to time by the Minister. The current schedule is published by the Information Regulator; we will quote the applicable amount in writing when we acknowledge your request. A personal requester asking for a record about themselves is not charged a request fee.

19Grounds on which we may refuse

Chapter 4 of the Act requires or permits us to refuse access in certain circumstances, including where the record contains:

• Personal information about a third party, the disclosure of which would be unreasonable.
• Commercial information of a third party, such as a trade secret, where disclosure would harm them.
• Information held in confidence, where disclosure would be a breach of a duty of confidence.
• Information whose disclosure would endanger a person's life or physical safety, or prejudice property security.
• Privileged material that could not be produced in legal proceedings.
• Our own commercial information, where disclosure would put us at a disadvantage in negotiations or in competition.
• A research proposal or results, where disclosure would expose the researcher or the subject.

Where part of a record may be refused and part may not, we will release the part that may be.

20If we refuse your request

We will tell you in writing which ground we relied on and give you adequate reasons. A private body has no internal appeal, so if you are not satisfied you may:

• Lodge a complaint with the Information Regulator under section 77A, within 180 days; or
• Apply to a court of competent jurisdiction for relief under section 78.