Privacy policy

Effective date: 10 November 2026

This policy explains how Catalyst Platform collects, uses, stores and shares information, and the rights people have under the Protection of Personal Information Act, 2013 (POPIA). Read it with our Terms of use.

1. Who we are

Catalyst Platform is run by Catalyst Technology Holdings (Pty) Ltd, registration number 2024/694247/07, of 42 Bloemhof Road, Amber Close, Bellville, Cape Town, Western Cape, 7530 (“we”, “us”). The accounting practice that uses Catalyst Platform is responsible for its clients’ information, and we process that information for the practice.

2. What we collect, and where it comes from

• From the systems the practice connects: accounting data from Xero, data from other systems the practice connects, such as payroll and company register systems, and the email and files the practice connects. This can include personal information about the practice’s clients and their staff, directors, shareholders, customers and suppliers.
• From the people who sign in: name, work email address, role, sign-in details and a record of what they do in Catalyst Platform.

3. Why we use it

We use the information to give the practice findings, reports and service provider matches for its clients, to keep Catalyst Platform secure and to meet our legal obligations. We use Xero data only for this purpose. We may produce statistics that do not identify any person or business, for our own use. We never use Xero data to train or fine-tune an artificial intelligence model.

4. Who we share it with

We share information only with our hosting and service providers, who process it for us; with service providers (such as funders and advisers) that a client has consented to share it with, and then only what the client consented to; and where the law requires it. We never sell personal information or Xero data, and we do not pass Xero data to anyone else without the consent of the client it belongs to.

5. Where we store it, how we protect it and how long we keep it

The main data stays in South Africa. Some data, such as issued reports, is stored outside South Africa, with appropriate safeguards. We encrypt the data, keep each practice’s data separate from every other practice’s, and record access in an audit log. We keep information only as long as we need it for the purposes above or as the law requires, and then delete it.

6. Disconnecting Xero

A Partner or Practice manager can disconnect a client’s Xero organisation at any time in Catalyst Platform, on Connections or on the client’s Data and sync tab. Anyone with access to the organisation can also disconnect Catalyst Platform in Xero, under Connected apps. Either way, the sync stops.

7. Your rights

Under POPIA you may ask whether we hold information about you and for a copy of it, ask us to correct or delete it, object to its use, and withdraw a consent you gave. If you are a client of an accounting practice, contact the practice first. Otherwise, or if the practice cannot help, contact us as shown in section 8. You may also complain to the Information Regulator at POPIAComplaints@inforegulator.org.za (inforegulator.org.za).

8. Changes and contact

We will publish any change on this page with a new effective date. For questions about this policy, or to use your rights, email us at support@catalystholdings.globalor write to us at 42 Bloemhof Road, Amber Close, Bellville, Cape Town, Western Cape, 7530.