Privacy Policy

AfricaPay and its associated services (collectively referred to as "AfricaPay", "we", "us", or "our"), provides payment infrastructure, merchant acquiring, digital wallets, payment gateways, and digital asset services.

We are dedicated to safeguarding the privacy of our clients, merchants, consumers, authorized representatives, and ultimate beneficial owners. This Privacy Policy governs the collection, use, processing, disclosure, storage, and protection of Personal Information in compliance with the Protection of Personal Information Act, No. 4 of 2013 ("POPIA"), while fulfilling our statutory compliance and reporting obligations under the Financial Intelligence Centre Act, No. 38 of 2001, as amended ("FICA"), the Protection of Constitutional Democracy Against Terrorist and Related Activities Act, No. 33 of 2004 ("POCDATARA"), and other applicable South African financial regulations.

AfricaPay is the Responsible Party in respect of all Personal Information processed under this Policy:

• Entity Name: AfricaPay
• Registration Number: 2021/963668/07
• Registered Address: 16 14th Street, Menlo Park, Pretoria, Gauteng, 0081
• Website: https://africapay.co.za/
• Compliance & Information Officer Email: privacy@africapay.co.za / compliance@africapay.co.za

To establish business relationships, process financial and digital asset transactions, and satisfy mandatory statutory Customer Due Diligence (CDD) obligations, we collect the following categories of information:

We process your Personal Information only where a valid legal basis exists under POPIA, categorized as follows:

In accordance with Section 20A and Section 21 of FICA, AfricaPay is strictly prohibited from establishing or maintaining a business relationship, or executing transactions with anonymous clients, clients using false/fictitious names, or parties whose identities cannot be verified.

Providing accurate, authenticated identification and source of funds documentation is a statutory requirement. Failure or refusal to provide mandatory information will result in:

1. Immediate refusal or termination of the business relationship or single transaction.
2. Potential filing of regulatory reports with the Financial Intelligence Centre (FIC) where circumstances appear suspicious or irregular.

We do not sell personal data. We disclose information strictly in accordance with legislative requirements or to authorized service providers under formal data-processing agreements:

• Regulatory & Statutory Authorities: We share data directly with the Financial Intelligence Centre (FIC), the South African Reserve Bank (SARB), the South African Revenue Service (SARS), and law enforcement agencies pursuant to statutory duties (e.g., FICA Sections 28, 28A, 29, 35).
• Verification & Screening Partners: Identity verification providers, credit bureaus, CIPC lookup nodes, and third-party AML/Sanctions compliance platforms (e.g., DocFox).
• Payment Infrastructure & Liquidity Partners: Registered acquiring banks, payment card networks (Visa/Mastercard), payment switches, and certified digital asset infrastructure partners (e.g., liquidity and on/off-ramp providers) to facilitate settlements and conversions.
• Legal Privilege & Secrecy Limitations: In terms of Section 37 of FICA, statutory reporting obligations override common law and contractual duties of secrecy and confidentiality, excluding communications protected by legal professional privilege.
• Anti-Tipping Off Obligations: In terms of Section 29 of FICA, AfricaPay and its employees are legally prohibited from informing any client or third party that a regulatory report or inquiry has been filed with the FIC.

AfricaPay operates across African and international financial corridors. Personal information and transaction telemetry may be transferred, processed, and hosted on secure cloud infrastructure located outside of South Africa.

Cross-border transfers occur strictly under Section 72 of POPIA, ensuring that:

1. The recipient country maintains data protection laws providing a level of protection substantially similar to POPIA; or
2. The transfer is governed by binding contractual agreements (Standard Contractual Clauses) imposing rigorous data protection, confidentiality, and security standards; or
3. The transfer is directly necessary for the performance of a cross-border contract or remittance transaction initiated by the client.

In alignment with Section 8 of our Risk Management and Compliance Programme and statutory directives under FICA, all Personal Information, identity verification files, client communications, transaction ledgers, declined/terminated client records, and regulatory filings are retained for a minimum period of 5 (five) years.

The 5-year retention period begins from the latest of:

• The date of the client’s final transaction;
• The formal termination date of the business relationship; or
• The date on which a formal report was submitted to the Financial Intelligence Centre (FIC).

Upon the lapse of statutory retention mandates, data will be safely destroyed, de-identified, or irreversibly anonymized in terms of POPIA.

AfricaPay maintains comprehensive physical, technical, and operational security measures to prevent loss, unauthorized access, destruction, or unlawful alteration of Personal Information:

• Encryption Standards: Data at rest is encrypted using AES-256 standards, and all data in transit across networks is protected via Transport Layer Security (TLS 1.3).
• Access Governance: Role-based access control (RBAC), multi-factor authentication (MFA), and detailed immutable audit trails for all system operations.
• Infrastructure Security: Enterprise-grade cloud environments, real-time threat detection, automated AML/fraud monitoring, regular vulnerability scanning, and independent security assessments.

Subject to statutory limitations imposed by FICA, POCDATARA, and the Prevention of Organised Crime Act (POCA), data subjects have the right to:

• Access: Request confirmation of whether we hold Personal Information about you and receive a copy of that record.
• Correction & Rectification: Request correction, completion, or updating of inaccurate, irrelevant, out-of-date, or misleading information.
• Deletion / Destruction: Request erasure of Personal Information, provided the data is no longer necessary for contractual purposes and the statutory retention period under FICA (5 years) has elapsed.
• Objection: Object to processing based on reasonable grounds relating to your particular situation (unless processing is mandated by law).
• Complaints: Lodge a complaint with our Information Officer at privacy@africapay.co.za or escalate to the South African Information Regulator.

This Privacy Policy is subject to an annual review alongside our internal Risk Management and Compliance Programme (RMCP). Any changes necessitated by legislative developments, operational adjustments, or supervisory notices will be updated on this page with a revised "Last Updated" date.