Privacy Policy

1 Introduction

This Privacy Policy applies to all personal information processed by HelloCredit through our website (www.hellocredit.co.za), mobile applications and related services (the "Platform").

By using our Platform, you consent to the collection and use of your personal information as described in this Policy. If you do not agree with any part of this Policy, please discontinue your use of the Platform.

We may update this Policy from time to time. Where changes are material, we will notify you by email or through a notice on the Platform. The "last updated" date at the top of this page reflects the most recent revision.

2 Who We Are

HelloCredit (Pty) Ltd is the responsible party (as defined under POPIA) in respect of your personal information processed through this Platform. Our Information Officer can be contacted at the details provided in Section 13 of this Policy.

We are registered in the Republic of South Africa and operate in compliance with applicable South African laws including POPIA, the National Credit Act and the Electronic Communications and Transactions Act.

3 Information We Collect

3.1 Information you provide directly

• Identity information: full name, date of birth, South African ID number;
• Contact details: email address, mobile number, physical address;
• Financial information: income, employment status, existing debt obligations;
• Account credentials: username and password (stored in encrypted form);
• Communications: messages, enquiries or feedback you send us.

3.2 Information we collect automatically

• Device and usage data: IP address, browser type, operating system, pages visited, time spent, click data;
• Location data: approximate location inferred from IP address;
• Cookies and similar technologies (see Section 9).

3.3 Information from third parties

• Credit bureau data: your credit profile and score from South African credit bureaus (with your consent);
• Lender data: information received from lenders regarding loan applications made through our Platform.

4 How We Use Your Information

We use your personal information for the following purposes:

• To create and manage your HelloCredit account;
• To retrieve and display your credit score and credit profile;
• To match you with personalised loan offers from our lender partners;
• To provide and improve the Reboot programme and HelloBucks rewards;
• To communicate with you about your account, products and services;
• To comply with our legal and regulatory obligations;
• To detect, prevent and investigate fraud and security incidents;
• To analyse platform usage and improve our services;
• To send you marketing communications where you have opted in (you may opt out at any time).

We will not use your personal information for purposes incompatible with those listed above without your consent.

5 Legal Basis for Processing (POPIA)

Under POPIA, we process your personal information on the following lawful grounds:

• Consent: Where you have given us explicit consent, for example for credit bureau checks and marketing communications;
• Contract performance: Where processing is necessary to perform our services to you;
• Legitimate interests: Where processing is necessary for our legitimate business interests, such as fraud prevention and platform security, provided these do not override your rights;
• Legal obligation: Where we are required by law to process your information, such as under FICA or the NCA.

6 Sharing Your Information

We do not sell your personal information. We may share your information in the following limited circumstances:

• Lender partners: When you apply for a loan, your information is shared with the relevant registered credit provider to process your application;
• Credit bureaus: To verify your identity and retrieve your credit profile with your consent;
• Service providers: Third-party providers who assist in operating our Platform (e.g. cloud hosting, analytics), bound by confidentiality agreements;
• Legal compliance: Where required by law, court order or regulatory authority;
• Business transfers: In connection with a merger, acquisition or sale of assets, with appropriate data protection obligations imposed on any successor entity.

All third parties with whom we share your data are required to handle it in a manner consistent with POPIA and this Policy.

7 Your Rights Under POPIA

As a data subject under POPIA, you have the following rights regarding your personal information:

To exercise any of the above rights, please contact our Information Officer using the details in Section 13.

8 Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, disclosure, alteration, loss or destruction. These include:

• Encryption of data in transit (TLS/HTTPS) and at rest;
• Access controls and authentication requirements for our systems;
• Regular security assessments and employee training;
• Incident response procedures for personal data breaches.

In the event of a data breach that poses a risk to your rights, we will notify you and the Information Regulator as required by POPIA. No method of electronic storage or transmission is completely secure; while we strive to protect your information, we cannot guarantee absolute security.

9 Cookies & Tracking Technologies

We use cookies and similar technologies to improve your experience, understand how our Platform is used and deliver relevant content. Types of cookies we use include:

• Essential cookies: Necessary for the Platform to function correctly. These cannot be disabled.
• Analytics cookies: Help us understand how visitors interact with our Platform (e.g. Google Analytics). Data is anonymised or pseudonymised where possible.
• Marketing cookies: Used to show you relevant advertising where you have consented.

You can manage cookie preferences through your browser settings. Note that disabling certain cookies may affect Platform functionality. Our cookie consent banner allows you to manage non-essential cookies on your first visit.

10 Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Our standard retention periods are as follows:

• Active account data: retained for the duration of your account and 5 years thereafter;
• Loan application data: retained for 5 years in line with NCA requirements;
• Marketing data: retained until you unsubscribe or withdraw consent;
• Server and access logs: retained for up to 12 months.

When personal information is no longer required, we securely delete or anonymise it.

11 Children's Privacy

Our Platform is intended for users who are 18 years of age or older. We do not knowingly collect personal information from children under the age of 18. If we become aware that we have inadvertently collected personal information from a minor, we will take steps to delete it promptly. If you believe a minor has provided us with personal information, please contact us immediately.

12 Changes to this Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology or legal requirements. Where changes are material, we will provide prominent notice by email or on the Platform at least 30 days before the changes take effect.

Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the updated Policy. We encourage you to review this Policy regularly.

13 Contact Us & Information Officer

For any questions, requests or complaints regarding your personal information or this Privacy Policy, please contact our Information Officer:

• Email: privacy@hellocredit.co.za
• General support: support@hellocredit.co.za
• Contact form: www.hellocredit.co.za/ContactUs/
• Entity: HelloCredit (Pty) Ltd, Republic of South Africa

You also have the right to lodge a complaint with the Information Regulator of South Africa if you believe your rights under POPIA have been infringed: www.justice.gov.za/inforeg.