Privacy Policy & POPIA Notice

1. Who We Are — Responsible Party

2. Personal Information We Collect

We collect the following categories of personal information from and about users of our Platform:

• Identity information: Full name, South African ID number, date of birth, passport number (for international clients), nationality, and tax reference number (TIN/SARS).
• Contact information: Email address, phone number, and residential or postal address.
• Financial information: Bank account details, wallet balance, investment history, transaction records, income and employment information, source of funds declarations, and net asset value.
• FICA/KYC documents: Certified copy of ID or passport, proof of residence (not older than 3 months), proof of income or source of funds, and any other documentation required under the Financial Intelligence Centre Act (FICA).
• Investment profile information: Investment risk appetite, financial goals, investment horizon, investor type, and experience level.
• Technical and usage data: IP address, device type, operating system, browser type, login timestamps, pages visited, session duration, and search queries on the Platform.
• Cookies and tracking data: We use cookies, web beacons, and pixel tags to collect information about how you interact with the Platform. See clause 11 for more detail.
• Communication data: Support tickets, messages, and correspondence you send to us.

3. How We Collect Your Information

We collect personal information:

• Directly from you when you register, complete your profile, submit FICA/KYC documents, make investments, or contact our support team.
• Automatically through your use of the Platform via cookies, analytics tools, and server logs — including the pages you visit, time spent on those pages, and your device information.
• From third parties such as identity verification services, payment processors (e.g. Paystack, Ozow), and credit bureau or AML screening services as required by law.

4. Purposes of Processing

We process your personal information for the following specific, lawful purposes:

• Opening, verifying, and managing your investor account on the Platform.
• Performing Know Your Customer (KYC) and FICA identity verification as required by South African law.
• Processing investment applications, deposits, withdrawals, returns, and wallet transactions.
• Complying with Anti-Money Laundering (AML), Counter-Terrorist Financing (CTF), and Financial Intelligence Centre Act (FICA) obligations.
• Sending account statements, IT3(b) tax certificates, investment notifications, and maturity instructions.
• Fraud prevention, security monitoring, and audit trail maintenance.
• Communicating important platform or regulatory changes that affect your investments.
• Sending marketing and promotional communications — only with your explicit consent. You may withdraw this consent at any time.
• Improving and personalising your experience on the Platform.
• Reporting to the South African Revenue Service (SARS) as required under the Income Tax Act and other applicable legislation.
• Complying with any court order, subpoena, or other legal process or obligation.

5. Legal Basis for Processing (POPIA)

In accordance with POPIA, we process your personal information on the following lawful grounds:

• Consent: For marketing communications, cookie analytics, and optional data sharing. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Contractual necessity: To fulfil our obligations under your Investment Agency Agreement and manage your account and investments.
• Legal obligation: To comply with FICA, FAIS, AML, SARS, POPIA, and other applicable South African laws and regulations.
• Legitimate interest: For fraud prevention, platform security, internal analytics, and improvement of our services, where such interests are not overridden by your rights and freedoms.

6. Sharing Your Information

We may share your personal information with the following parties, strictly on a need-to-know basis and subject to appropriate confidentiality obligations:

• Regulatory bodies: The Financial Sector Conduct Authority (FSCA), the Financial Intelligence Centre (FIC), and the South African Revenue Service (SARS), as required by applicable law.
• Payment processors: Paystack and Ozow for deposit and payment verification purposes.
• Identity verification providers: For FICA/KYC compliance.
• Banking and trust account partners: For investment pool management, fund holding, and payout processing.
• Cloud and IT service providers: Hosting, database, and security providers who are contractually obligated to keep your information confidential and secure, and to use it only for specified purposes.
• Fund manager: Smartvest Financial Services (Pty) Ltd (FSP #52449) for investment oversight and FSCA reporting.
• Compliance and legal advisors: For FICA, AML, and regulatory compliance assessments.
• Law enforcement or courts: Where required by law or court order, or where necessary to protect our rights or the rights of others.

We do not sell, rent, or trade your personal information to any third party for commercial purposes.

7. International Transfers

Your personal information may be transferred to, stored at, or processed in countries other than South Africa — for example, on international cloud servers used by our technology partners. Where such transfers occur, we take reasonable steps to ensure that your information is handled in accordance with POPIA and this Policy, including ensuring that appropriate safeguards (such as data processing agreements) are in place with the relevant third parties.

8. Data Retention

We retain your personal information for the following minimum periods, after which it will be securely deleted or anonymised:

• FICA/KYC documents: 5 years after the termination of the business relationship (as required by FICA).
• Transaction records and investment history: 5 years after the transaction date (FAIS and SARS requirements).
• Account information: For the duration of your account plus 5 years thereafter.
• Audit logs and security records: 3 years from the date of the event.
• Marketing consent records: Until you withdraw consent or close your account.
• Support communications: 2 years after the matter is resolved.

Longer retention periods may apply where required by law or where the information is necessary for pending legal proceedings or regulatory investigations.

9. Your Rights Under POPIA

In terms of POPIA and applicable data protection principles, you have the following rights regarding your personal information:

To exercise any of these rights, please contact our Information Officer at admin@svcapital.co.za. We will respond to all requests within 30 days in accordance with POPIA.

10. Security Measures

We implement appropriate technical and organisational security measures to protect your personal information against unauthorised access, disclosure, loss, or destruction. These include:

• 256-bit SSL/TLS encryption for all data transmitted to and from the Platform.
• Encrypted storage for all sensitive documents and personal information at rest.
• Role-based access controls ensuring only authorised personnel can access your data.
• Two-factor authentication for investor accounts.
• Regular security audits and penetration testing.
• Strict employee data handling training and confidentiality agreements.
• Incident response procedures for security breaches, including notification to you and the Information Regulator where required by law.

Please note that no method of internet transmission or electronic storage is completely secure. While we take every reasonable precaution, we cannot guarantee the absolute security of your information.

11. Cookies and Tracking Technologies

Our Platform uses cookies and similar tracking technologies (including web beacons and pixel tags) to:

• Essential cookies: Maintain your session, authentication state, and security. These cannot be disabled as they are necessary for the Platform to function.
• Analytics cookies: Understand how you use the Platform so we can improve it. These are only set with your consent.
• Marketing cookies: Track the effectiveness of our marketing campaigns. These are only set with your explicit consent.

Cookies are small data files placed on your device that remember information about your use of the Platform. You may manage cookie preferences through your browser settings. Disabling essential cookies may affect Platform functionality. By continuing to use the Platform, you consent to our use of analytics and marketing cookies where you have indicated consent during registration.

12. Children's Privacy

The Platform is not directed to persons under the age of 18, and we do not knowingly collect personal information from minors. If you are a parent or guardian and believe that your child has provided us with personal information without your consent, please contact us immediately at admin@svcapital.co.za. We will take prompt steps to delete such information from our records.

13. Your Choices

• Marketing communications: You may opt out of receiving marketing emails at any time by clicking the "Unsubscribe" link in any marketing email or by contacting us at admin@svcapital.co.za. Opting out does not affect essential account communications.
• Cookie preferences: You may manage cookie settings through your browser. Disabling cookies may affect your experience on the Platform.
• Account closure: You may request closure of your account at any time, subject to the completion of any active investment periods and our legal retention obligations.

14. POPIA Compliance Statement

SV Capital (Pty) Ltd is committed to full compliance with the Protection of Personal Information Act 4 of 2013 (POPIA) and the regulations promulgated thereunder. We adhere to the eight Conditions for Lawful Processing set out in POPIA:

15. Changes to This Policy

We may update this Privacy Policy and POPIA Notice from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by email or by posting a prominent notice on the Platform at least 30 days before the changes take effect. Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the updated Policy.

16. Contact Us