Privacy Policy

Last Updated: 24 September 2026

​

• 1.1 Purpose and Scope of the Privacy Policy: This policy outlines how BlackLeaf Holdings and its operating subsidiaries collect, process, secure, and retain sensitive personal and corporate data in the execution of our Multi-Family Office (MFO) mandates.

• 1.2 Statutory Alignment with the Protection of Personal Information Act (POPIA): We are unconditionally committed to safeguarding your privacy in strict accordance with South Africa’s Protection of Personal Information Act (POPIA), ensuring lawful processing, purpose specification, and data minimization.

• 1.3 Applicability of the General Data Protection Regulation (GDPR) for Global Families: For clients and data subjects residing in the European Economic Area (EEA), our data processing protocols are aligned with the rigorous standards of the GDPR, particularly concerning cross-border wealth coordination.

• 2.1 Applicability to High-Net-Worth Individuals, Family Offices, and Corporate Founders: This policy governs the data provided by private clients, family principals, and corporate executives engaging our wealth, advisory, and fiduciary structuring services.

• 2.2 Applicability to Third-Party Vendors and External Partners: It applies to all independent legal, accounting, and institutional partners integrating with our ecosystem.

• 2.3 Applicability to Digital Platform Visitors and Client Portal Users: This policy covers all individuals accessing the BlackLeaf website, the proprietary Business Marketplace, and our secure Client Portals.

• 3.1 Personal Identification and Contact Information: Including, but not limited to, government-issued identity documents, passports, tax residency certificates, marital contracts, and family registry data.

• 3.2 Corporate & Wealth Data: Highly sensitive financial information including trust deeds, capitalization tables, multi-generational financial statements, private equity holdings, and real estate portfolios.

• 3.3 FICA & AML Compliance Data: Information strictly required by law, such as Ultimate Beneficial Ownership (UBO) declarations, source of funds documentation, and risk profiling data.

• 3.4 Technical & Telemetry Data: Information collected automatically during digital engagement, such as IP addresses, portal login timestamps, browser types, and secure session cookies.

• 4.1 Execution of M&A, Corporate Advisory, and Wealth Coordination Mandates: We process financial and corporate data to facilitate buy-side/sell-side M&A, capital raising, and overarching wealth coordination.

• 4.2 Facilitation of Fiduciary Structuring and Trust Administration: Data is processed to structure corporate vehicles and trusts through BlackLeaf Fiduciary Management and our External Partners.

• 4.3 Statutory Anti-Money Laundering (AML), Sanctions Screening, and FICA Compliance: As a Trust and Company Service Provider (TCSP), we are legally mandated to process personal data to fulfill our obligations under the Financial Intelligence Centre Act (FICA).

• 4.4 Client Portal Security, Identity Verification, and Fraud Prevention: Telemetry and identity data are utilized to maintain the absolute security of our digital infrastructure and prevent unauthorized access.

• 5.1 Secure Internal Data Flow Between BlackLeaf Holdings Subsidiaries: To provide unified MFO services, data is securely shared as necessary between BlackLeaf Wealth, BlackLeaf Advisory Group, BlackLeaf Capital, BlackLeaf Properties, BlackLeaf Fiduciary Management, and BlackLeaf Business Marketplace.

• 5.2 Controlled Data Sharing with Independent External Partners: We selectively share strictly necessary financial and structural data with our highly vetted, independent external partners—specifically attorneys regulated by the Legal Practice Council (LPC) and accountants regulated by the South African Institute of Chartered Accountants (SAICA)—to execute formal legal or audit mandates.

• 5.3 Mandatory Disclosures to Regulatory Bodies: Where legally compelled, we will disclose data to the Financial Intelligence Centre (FIC), the Companies and Intellectual Property Commission (CIPC), the Master of the High Court, or other competent authorities.

• 5.4 Prohibition on the Sale or Unauthorized Monetization of Client Data: Under no circumstances does BlackLeaf Group sell, rent, or commercialize your personal or corporate data to third parties.

• 6.1 Scope of Legal Privilege with Independent External Legal Counsel: Communications explicitly directed to our independent, LPC-regulated external legal partners for the purpose of seeking reserved legal counsel are protected by strict Legal Professional Privilege.

• 6.2 Classification of General Business Communications with In-House Corporate Advisors: Clients must note that general strategy discussions, commercial contract drafting, and business correspondence with BlackLeaf’s internal corporate team do not carry absolute Legal Professional Privilege.

• 6.3 Client Waiver Protocols for Multi-Disciplinary Coordination: By utilizing our MFO coordination model, you consent to the necessary internal sharing of structural information across our subsidiary network to ensure seamless strategy execution.

• 7.1 Jurisdictional Processing: In managing offshore trusts, international relocations, and cross-border M&A, your data may be routed to or processed in jurisdictions outside of South Africa (e.g., Mauritius, the UAE, or the USA).

• 7.2 POPIA Adequacy Requirements and the Use of Standard Contractual Clauses (SCCs): We only transfer data to jurisdictions with adequate data protection laws or utilize robust Standard Contractual Clauses and Binding Corporate Rules to guarantee POPIA-equivalent protection.

• 7.3 Secure Transmission Protocols for Offshore Wealth Structuring: All international data transmissions are subjected to rigorous end-to-end encryption protocols.

• 8.1 Institutional-Grade Hosting and Network Security: Client data and secure document vaults are hosted in enterprise-grade, SOC 2 and ISO 27001 compliant cloud environments.

• 8.2 Data Encryption Protocols: Your information is encrypted both at rest (on our servers) and in transit (during transmission over the internet).

• 8.3 Mandatory Multi-Factor Authentication (MFA) for the Client Portal: Access to the BlackLeaf Client Portal requires MFA, ensuring that compromised passwords cannot result in a data breach.

• 8.4 Incident Response and Data Breach Notification Protocols: In the highly unlikely event of a data breach, BlackLeaf will notify the Information Regulator and affected data subjects as swiftly as legally required under POPIA.

• 9.1 The Superseding Nature of FICA and Financial Sector Retention Laws over POPIA Erasure Requests: While POPIA grants data subjects the right to request the erasure of personal data, BlackLeaf operates as an Accountable Institution. FICA statutory retention obligations legally supersede POPIA erasure requests.

• 9.2 Mandatory Five-Year Minimum Retention Period Post-Relationship: We are legally required to retain all client KYC records, UBO declarations, and transaction histories for a minimum of five (5) years after the termination of a business relationship or the conclusion of a specific transaction.

• 9.3 Secure Archiving and Cryptographic Data Destruction Procedures: Once statutory retention periods expire, data is permanently and cryptographically destroyed or irreversibly anonymized.

• 10.1 Right to Access and Request Copies of Personal Records: You may request a record of the personal information we hold about you.

• 10.2 Right to Rectification of Inaccurate Wealth or Corporate Data: You have the right to request the correction or updating of inaccurate, irrelevant, or outdated information.

• 10.3 Right to Restrict Processing: You may object to or request the restriction of data processing, subject to our ongoing statutory and contractual mandates.

• 10.4 Specific Limitations on the "Right to be Forgotten": As detailed in Section 9, requests for immediate data deletion will be denied if the data is subject to mandatory AML/TCSP retention laws.

• 11.1 Essential Session Management Cookies: Our client portals utilize essential cookies required for secure authentication, load balancing, and session continuity. These cannot be disabled.

• 11.2 Analytics and Performance Tracking: We use anonymized analytics cookies to monitor website performance and improve user experience.

• 11.3 User Consent Management and Opt-Out Mechanisms: Upon your first visit, a cookie consent manager will allow you to opt in or out of non-essential tracking technologies.

• 12.1 Periodic Review Process for Ongoing Regulatory Alignment: This policy is subject to ongoing review to ensure compliance with the latest FSCA, FIC, LPC, and Information Regulator directives.

• 12.2 Communication of Material Privacy Changes to Active Clients: If material changes are made to how we process your sensitive data, active clients will be notified via their secure client portal or registered email address.

• 13.1 Role and Responsibilities of the Designated Privacy & Compliance Officer: BlackLeaf Holdings has appointed a dedicated Compliance Officer responsible for overseeing POPIA alignment and managing Data Subject Access Requests (DSAR).

• 13.2 Dedicated Contact Channels:

  • Physical Address: The Loft Office, 439 Diagonal Street, Pringle Bay, Western Cape, 7196.

  • Compliance & Privacy Enquiries: compliance@blackleafwealth.com

  • General Enquiries: enquiries@blackleafwealth.com

  • Office Line: +27 79 203 5844

• 13.3 Escalation Procedures to the South African Information Regulator: If you believe your data has been processed unlawfully and we have not resolved your grievance, you hold the right to lodge a formal complaint with the Information Regulator of South Africa.