POPIA Notice

Your rights under the Protection of Personal Information Act, explained in plain language.

1. Our commitment to your privacy

Mzansi Debt is committed to protecting the privacy and confidentiality of your personal information in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA"). This notice explains, in plain language, how we manage your information and the rights you have under POPIA.

This notice should be read together with our full Privacy Policy.

2. What POPIA means for you

POPIA is South Africa's data protection law, which gives you control over how organisations collect and use your personal information. It came into full force on 1 July 2021. Key principles include:

• Lawful, fair, and transparent processing.
• Limited collection, where we only ask for what we actually need.
• Purpose specification, where information is collected for a defined purpose.
• Storage limitation, where information is not kept longer than necessary.
• Information quality, ensuring accuracy and currency.
• Security safeguards, protecting your information from loss or misuse.
• Your participation, allowing you to access and correct your information.

3. What information we collect from you

We may collect the following categories of personal information from you:

• Identification details, including your name, surname, and South African ID number (where voluntarily provided).
• Contact details, including your phone number, WhatsApp number, email address, and physical or postal address.
• Financial details, including your income, expenses, debts, employer, and creditor information.
• Communication records, including emails, WhatsApp messages, recorded calls, and notes from consultations.
• Website usage data, collected automatically via cookies, analytics, and server logs.

4. Why we need this information

We process your personal information to:

• Assess whether debt review is right for your situation.
• Conduct a formal debt review on your behalf with your creditors.
• Communicate with credit bureaux to update your credit profile.
• Apply to the Magistrate's Court or National Consumer Tribunal for a debt review order.
• Distribute your monthly payments to creditors through a regulated Payment Distribution Agency.
• Comply with our obligations under the National Credit Act and other applicable laws.
• Respond to your enquiries and provide customer support.

5. Special personal information

POPIA classifies certain categories of information as "special personal information", including health, biometric, religious, political, and criminal record information. We do not request or process special personal information unless it is strictly necessary for legitimate purposes (for example, where reasonable expenses for medical conditions need to be factored into your debt review) and only with your explicit consent.

6. Children's information

Our services are only available to adults aged 18 and over. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child, we will delete that information promptly.

7. Who we share your information with

Your personal information is treated as confidential. We share it only with parties who are necessary to deliver our services or where required by law:

• Your credit providers, to manage your debt review.
• Payment Distribution Agencies (PDAs), who handle the distribution of your monthly payment to creditors.
• Credit bureaux (TransUnion, Experian, Compuscan, XDS), to update your credit profile.
• The National Credit Regulator, the National Consumer Tribunal, and Magistrate's Courts, as required by the NCA.
• Our regulated service providers, including IT, hosting, email, and analytics providers, under strict confidentiality.

We do not sell your personal information to any third party.

8. Your rights under POPIA

You have the following rights:

• Right of access. You can request a copy of the personal information we hold about you, free of charge once per year.
• Right to correction or deletion. You can request that we correct inaccurate information or delete information we no longer need.
• Right to object. You can object to certain types of processing, including direct marketing.
• Right to withdraw consent. Where processing is based on your consent, you can withdraw that consent at any time.
• Right to complain. You can lodge a complaint with the Information Regulator if you believe your rights have been infringed.

9. How to exercise your rights

To exercise any of your POPIA rights, contact our Information Officer using the details at the bottom of this page. We will respond to your request within 30 days. There is no charge for legitimate requests.

For your protection, we may need to verify your identity before responding to a request involving personal information.

10. Your consent

By submitting our assessment form, calculator, or any other contact form, you give Mzansi Debt your consent to process your personal information as described in this notice and in our full Privacy Policy. You may withdraw this consent at any time by contacting us, although doing so may mean we can no longer provide certain services to you.

11. How we keep your information safe

We use technical and organisational security measures to protect your personal information, including:

• Encrypted website connections (HTTPS) for all data transmission.
• Access controls limiting who can view client records.
• Strong password policies and two-factor authentication where applicable.
• Regular software updates and security patches.
• Staff training on POPIA compliance and confidentiality obligations.
• Incident response procedures for any suspected data breach.

12. If a data breach occurs

If we believe your personal information has been compromised in a way that could pose a real risk of harm to you, we will:

• Notify the Information Regulator within the timeframe required by POPIA.
• Notify you directly, in writing, as soon as reasonably possible.
• Explain the nature of the breach, the information involved, and the steps you can take to protect yourself.

13. International transfers

Some of the technology services we use (such as email and analytics platforms) may store data on servers located outside South Africa. In all such cases, we ensure that the receiving country provides an adequate level of data protection, or that appropriate safeguards are in place to protect your information as required by POPIA.

14. How long we keep your information

We keep your information only for as long as is necessary:

• Active debt review clients, for the duration of debt review plus five years after file closure (NCA requirement).
• Enquirers who did not become clients, for up to two years from your last interaction with us.
• Marketing contacts, until you opt out, after which we maintain a suppression record to ensure we do not contact you again.

15. Information Officer

In accordance with POPIA, Mzansi Debt has appointed an Information Officer to oversee our compliance with the Act and to receive any queries or complaints from data subjects. Contact details are provided in the box below.