POPIA Act

Our commitment

Fundaripay processes personal information in accordance with the Protection of Personal Information Act (POPIA) and other applicable South African law. Personal information is encrypted in transit and at rest using industry standard controls. We are accountable for personal information under POPIA and process it lawfully, fairly, and transparently.

What POPIA requires

POPIA regulates how responsible parties in South Africa must collect, use, store, share, and protect personal information. It also gives data subjects rights to access, correct, and object to processing in defined circumstances, and establishes oversight by the Information Regulator.

Lawful basis for processing

We process personal information when we have a valid reason under POPIA. This may include performing a contract with you, complying with a legal obligation, pursuing a legitimate interest where appropriate, or obtaining consent where consent is required, including for special personal information such as biometrics.

Information visible to Fundaripay

For account identity, verification, support, and regulatory purposes, the only customer personal information visible within Fundaripay operational systems is your South African identity number, first name and surname, email address, and mobile phone number. Access to this information is restricted by role, logged where appropriate, and used only for lawful purposes connected to the service.

• South African identity number
• First name and surname
• Email address
• Mobile phone number

Encryption and security safeguards

We apply encryption, access controls, monitoring, and secure development practices across the app, merchant portal, and payment flows. Sensitive fields are protected in storage and when transmitted between systems. Under POPIA Section 19, we must take appropriate reasonable technical and organisational measures to prevent loss, damage, or unauthorised access to personal information. Our controls include encryption, role based access, monitoring, and contractual safeguards with operators.

Payment information

Card and payment credential data is encrypted end to end within the payment environment. Fundaripay does not store or display full card numbers, CVV codes, or PINs. Payment credentials are processed by our payment facilitator under applicable payment industry standards. Fundaripay shares personal information with our licensed payment facilitator only where necessary to authorise, settle, and reconcile payments, meet financial crime obligations, and maintain a secure payment environment. We do not sell personal information. Our payment facilitator is contractually required to process information lawfully, apply appropriate security safeguards, and handle data only for the purposes we specify.

Biometric information

Biometric information is treated as special personal information under POPIA. Palm enrolment is optional and requires your explicit consent. When a palm is recorded at a Fundaripay terminal, the capture is encrypted immediately, used only to complete recognition or enrolment, and then deleted on the terminal without delay. Fundaripay never stores palm images, raw scan files, or reusable photographs. We do not retain reversible biometric data. Any matching data used for payment is handled in encrypted form and is not visible to merchants. Merchants and staff at participating stores do not receive access to biometric templates or identity documents through Fundaripay systems.

Operators and sharing

Where Fundaripay uses operators, including our licensed payment facilitator, we require written agreements that impose POPIA aligned security and confidentiality obligations. Personal information is shared only to the extent necessary for payment processing, fraud prevention, regulatory compliance, and service delivery.

Retention and deletion

Identity and contact details are retained only for as long as needed to provide the service, meet legal and regulatory obligations, prevent fraud, and resolve disputes. When information is no longer required, we delete it or de identify it in line with our retention schedules and POPIA. If you delete your account, we delete personal information linked to that account except where limited retention is required by law.

Deleting your account

You have the right to delete your Fundaripay account at any time under POPIA. You may delete your account directly in the Fundaripay app through account settings, or by emailing support@fundaripay.com and requesting account deletion. When your account is deleted, we delete or de identify personal information linked to your account. This includes your identity number, name and surname, email address, mobile phone number, and any biometric enrolment records. We also instruct our payment facilitator to delete or de identify personal information they hold for your account where applicable. Limited records may be retained only where South African law requires retention for regulatory, tax, fraud prevention, or dispute resolution purposes. Verified account deletion requests are processed without undue delay and within the timelines POPIA requires. We confirm once deletion is complete, or explain clearly if limited information must be retained by law.

• Open the Fundaripay app, go to account settings, and select delete account
• Or email support@fundaripay.com from your registered email address and request account deletion
• Complete identity verification if we request it to protect your account from unauthorised deletion
• We delete your account data and send confirmation once the process is complete

Your rights under POPIA

You may request access, correction, or deletion of personal information where POPIA allows it, delete your account at any time through the app or by contacting us, object to certain processing, withdraw consent where processing relies on consent, and lodge a complaint with the Information Regulator of South Africa if you are not satisfied with our response.

How to make a POPIA request

Email support@fundaripay.com with the request type you wish to make and sufficient detail for identity verification. We respond within the timelines POPIA requires. If you remain dissatisfied, you may contact the Information Regulator of South Africa.

Merchants and partners

Merchants must communicate fairly with customers at the till and limit staff access to what each role requires. Partner and merchant onboarding information is handled under the same privacy standards described on this page and in our Privacy Policy.