POPIA Processing Notice

1. Who we are

VulaCheck is the Responsible Party for the processing of your personal information.

You can contact us with any query about this notice or about your personal information at info@vulacheck.com.

2. What information we collect

When you apply for credit with us, we collect:

• Identity information — full name, South African ID number, date of birth, gender
• Contact information — email address, mobile number, residential and postal address
• Employment and income information — employer details, salary, income source
• Financial information — bank account, expenses, existing credit obligations
• Bureau information — your credit profile obtained from registered credit bureaux
• Supporting documents — copies of your ID, payslip, bank statement, and proof of address

3. Why we collect it

We process your personal information for the following purposes:

• To assess your application for credit and conduct affordability and creditworthiness checks as required by the National Credit Act, 2005 (NCA)
• To verify your identity and the accuracy of the information you provide
• To enter into and perform a credit agreement with you
• To collect repayments and recover amounts owed
• To report your account performance to the credit bureaux as required by NCA section 70
• To meet our obligations under the NCA, POPIA, the Financial Intelligence Centre Act (FICA), and other applicable laws
• To prevent fraud and protect the security of our systems

4. Is providing this information voluntary or mandatory?

Providing this information is voluntary, but it is required for us to consider your application. If you choose not to provide it, we will not be able to assess your application or enter into a credit agreement with you.

5. Who we share your information with

We may share your personal information with:

• Registered credit bureaux — to obtain your credit profile and to report account performance, as required by the NCA
• The South African Credit and Risk Reporting Association (SACRRA) — for industry-wide credit reporting
• Payment processors and collection partners — to collect repayments via DebiCheck or other approved instruments
• Our technology provider, VulaCheck (Pty) Ltd, which acts as our Operator under POPIA section 1 and processes your information on our behalf and under our instruction
• Regulatory authorities, including the National Credit Regulator, the Financial Intelligence Centre, and the Information Regulator, where required by law
• Our professional advisors (legal, accounting, audit) under duties of confidentiality

6. Cross-border transfers

Some of the technology services we use store data on servers located outside South Africa (in the European Union). Where this happens, the transfer is made to a jurisdiction that provides a level of protection for personal information substantially similar to that required by POPIA, in accordance with POPIA section 72.

7. How long we keep your information

We keep your personal information for as long as is necessary to fulfil the purposes set out above and to meet our regulatory retention obligations. The NCA and other laws may require us to retain certain records for several years after the end of our relationship with you.

8. Your rights

Under POPIA, you have the right to:

• Ask us to confirm whether we hold your personal information (section 23)
• Ask us to correct or delete information that is inaccurate, irrelevant, excessive, out-of-date, incomplete, misleading, or unlawfully obtained (section 24)
• Object to the processing of your personal information in certain circumstances (section 11(3))
• Withdraw any consent you have given (section 11(2)(b))
• Object to direct marketing (section 69)
• Lodge a complaint with the Information Regulator if you believe we have not handled your information lawfully

9. Contact for queries and complaints

For any request relating to your personal information, contact us first at info@vulacheck.com.

You may also lodge a complaint with the Information Regulator (South Africa):

• Website: inforegulator.org.za
• Email: complaints.IR@justice.gov.za