Data Protection Notice

FICA / POPIA Information Notice

This notice explains why we collect your personal information, what we do with it, and your rights under the Protection of Personal Information Act 4 of 2013 (POPIA). Please read it before completing our verification form.

Mark Whitehorn Goldsmith is a fine jewellery studio operating as a sole proprietorship in Johannesburg, South Africa.

We are registered with the Financial Intelligence Centre (FIC) as an Accountable Institution under the Financial Intelligence Centre Act 38 of 2001 (FICA), registration number Org 61368. In terms of FICA, we are classified as a dealer in high-value goods.

We are required by law to verify the identity of certain clients and to understand the nature and source of funds involved in transactions. This is known as Customer Due Diligence (CDD).

The legal basis for processing your personal information is section 11(1)(c) of POPIA: processing is necessary to comply with a legal obligation. The relevant legal obligations are imposed by FICA, specifically sections 21 to 23, which require Accountable Institutions to identify clients, verify their identities, and keep records.

We do not rely on your consent as the legal basis for this processing. You are not required to give consent, and withholding consent does not affect your rights. The obligation to collect this information is ours, not yours to refuse.

Depending on the nature of your transaction, we may collect:

• Full name and date of birth
• Identity document or passport number and type
• Nationality
• Residential address
• Contact details (phone number and email address)
• Occupation or business activity and employer
• Source of funds
• Whether you are a politically influential person (PIP) or politically exposed person (PEP), or associated with one
• A copy of your identity document or passport, and a recent proof of residential address
• Any supporting documentation you provide

We collect only what is required by FICA and our Risk Management and Compliance Programme. We do not collect more information than is necessary.

Your information is used exclusively for the following purposes:

• Verifying your identity as required by FICA
• Assessing the risk associated with our business relationship
• Maintaining the records required by section 23 of FICA
• Complying with our reporting obligations to the FIC, including suspicious transaction reports and cash threshold reports where applicable
• Responding to lawful requests from the FIC, law enforcement, or a court

We do not use your information for marketing, profiling, or any purpose unrelated to our FICA compliance obligations.

Your information is stored securely in an access-controlled digital environment. Access is restricted to authorised staff involved in compliance review. We do not share your information with third parties except where required or permitted by law.

We are required by section 23 of FICA to retain client identification records and transaction records for a minimum of five years from the date the business relationship ends or the transaction is concluded. We will not retain your information beyond the period required by law.

If you are, or are associated with, a domestic prominent influential person (PIP) or a foreign prominent public official (PEP) as defined in the FICA Guidance Notes, we are required to apply enhanced due diligence measures. This includes obtaining senior sign-off before establishing or continuing a business relationship, and conducting additional source-of-funds verification. This is a legal requirement, not a reflection on you personally.

You have the following rights in relation to your personal information:

• Right to access: You may request confirmation of whether we hold your personal information and a copy of that information.
• Right to correction: You may request that we correct inaccurate or incomplete information.
• Right to object: You may object to the processing of your personal information, subject to our legal obligations overriding that objection where applicable.
• Right to complain: You may lodge a complaint with the Information Regulator of South Africa if you believe your rights under POPIA have been infringed.

Please note that because our processing is based on a legal obligation under FICA, the right to deletion does not apply during the five-year retention period required by section 23 of FICA.

If you are not satisfied with how we have handled your personal information, you may contact the Information Regulator of South Africa:

---

For any questions about this notice or to exercise your rights, please contact our Information Officer: