Privacy Policy

This Policy explains how Asante Financial Services collects, uses, shares, and protects your personal information in accordance with the Protection of Personal Information Act, 4 of 2013 ("POPIA"), section 18.

Last updated: TBC — set this to the date this Policy is finalised, e.g. "15 July 2026"

1. Who We Are & Our Information Officer

Asante Financial Services (Pty) Ltd, registration number [COMPANY REGISTRATION NUMBER], NCR registration number NCRCP12345 ("we", "us", "our"), is the responsible party for personal information processed through this Website in terms of POPIA. Our Information Officer is registered with the Information Regulator and can be contacted as follows:

Name: Information Officer

Email: privacy@asantefs.co.za

Contact: +27 31 301 9000

2. Scope of This Policy

This Policy applies to personal information we collect through the Website, our customer Portal, our admin systems, and any related communication channels (email, SMS, WhatsApp, telephone), whether you are a prospective applicant, a current customer, a former customer, or a visitor to the Website. It does not apply to information processed by third-party websites we may link to, which are governed by their own privacy policies.

3. Key Definitions

  • "Personal information" means information relating to an identifiable, living natural person, as defined in section 1 of POPIA (for example, your name, ID number, contact details, and financial information).
  • "Special personal information" means personal information concerning religious/philosophical beliefs, race/ethnic origin, trade union membership, political persuasion, health, sex life, biometric information, or criminal behaviour, which POPIA treats with additional restrictions. We do not intentionally collect special personal information from you except where strictly necessary and lawfully permitted (for example, biometric verification used solely for identity confirmation, where applicable).
  • "Processing" means any operation performed on personal information, including collection, storage, use, disclosure, or deletion.
  • "Operator" means a third party that processes personal information on our behalf and under our instruction, such as our email, SMS/WhatsApp, and hosting service providers.
  • "Data subject" means the person to whom personal information relates — that is, you.

4. Purposes for Which We Process Your Information

  • Processing your loan application, including assessing affordability, suitability, and identity/document verification.
  • Concluding, administering, and enforcing a Credit Agreement, including collecting repayments and managing arrears.
  • Communicating with you about your application, account, documents required, decisions, and repayments.
  • Reporting to credit bureaus and the National Loans Register as required by the NCA.
  • Complying with legal and regulatory obligations, including record-keeping under the NCA, tax law, and the Financial Intelligence Centre Act 38 of 2001 ("FICA") for identity verification and anti-money-laundering purposes.
  • Fraud prevention, risk management, and information security monitoring.
  • Improving our Website and services, including troubleshooting and analytics.
  • Direct marketing, where you have consented, or as otherwise permitted under section 69 of POPIA (see Section 12 below).

6. Categories of Personal Information We Collect

Data subjects: loan applicants, customers, and, where relevant, references or emergency contacts you provide.

The categories of personal information we collect and process include:

  • Identity information: full name, South African ID number or passport number, date of birth, gender.
  • Contact information: email address, mobile number, residential and postal address.
  • Financial information: income, expenses, banking details, employment status and employer details, and existing debt obligations, used for affordability assessment.
  • Application and account records: application history, loan amounts, repayment terms, payment history, and correspondence with us.
  • Document metadata: copies of supporting documents you upload (such as proof of income or proof of residence) and associated file metadata.
  • Technical information: IP address, browser type, device information, and Website usage data collected automatically (see Section 8 on Cookies).
  • Credit information: information obtained from registered credit bureaus regarding your credit history and existing obligations, used for affordability assessment.

We do not knowingly collect personal information from children (persons under the age of 18), as we do not offer credit products to minors. See Section 18 below.

7. How We Collect Your Information

  • Directly from you, when you register, apply for a loan, upload documents, or otherwise interact with the Website, our Portal, or our staff.
  • From registered credit bureaus, for affordability assessment and credit risk purposes.
  • From your employer or other third parties, where necessary to verify information you have provided (for example, income or employment verification), and only to the extent permitted by law.
  • Automatically, through cookies and similar technologies when you use the Website (see Section 8).

8. Cookies & Tracking Technologies

We use cookies and similar technologies to keep you securely logged in, remember your preferences, and understand how the Website is used so we can improve it. This may include strictly necessary cookies (required for the Website to function, such as session and CSRF-protection cookies) and, where applicable, analytics cookies. You can control or disable non-essential cookies through your browser settings; disabling strictly necessary cookies may prevent parts of the Website, including the application process, from working correctly.

9. Recipients of Personal Information

We may share your personal information with:

  • Our branches and internal staff who require the information to process your application or administer your account.
  • Registered credit bureaus and the National Loans Register, as required by the NCA.
  • Regulators, law enforcement, and courts, where required or permitted by law (including the NCR, the Information Regulator, and the South African Revenue Service).
  • Operators (service providers) who process information on our behalf and under our instruction, including email, SMS/WhatsApp delivery, hosting, and security service providers, each bound by written agreements requiring them to keep your information confidential and secure and to process it only as we instruct.
  • Professional advisors (such as auditors or attorneys), where necessary and subject to confidentiality obligations.
  • A prospective buyer or successor, in the event of a merger, acquisition, or sale of all or part of our business, subject to appropriate confidentiality and POPIA-compliant safeguards.

We do not sell your personal information to third parties.

10. Cross-Border Transfers

Some of our operators (for example, cloud hosting or communication providers) may process personal information outside South Africa. Where this occurs, we take steps, in accordance with section 72 of POPIA, to ensure the recipient is subject to a law, binding corporate rules, or a binding agreement that provides an adequate level of protection substantially similar to POPIA, or that you have consented to the transfer, or that the transfer is otherwise necessary for the performance of a contract with you.

11. Automated Decision-Making & Credit Scoring

As part of our affordability and credit risk assessment, we may use automated processing, including credit-scoring tools, to help evaluate your application. In accordance with section 71 of POPIA, you have the right not to be subject to a decision based solely on automated processing that significantly affects you, without an opportunity for a human review. If your application is declined based substantially on automated assessment, you may request that a staff member review the decision, and you may request information on the underlying logic of that assessment, subject to our legitimate interest in protecting proprietary risk models and trade secrets.

12. Direct Marketing

If you are not yet a customer, we will only send you direct marketing electronic communications (such as email or SMS) where you have given your consent, in accordance with section 69 of POPIA. If you are an existing customer, we may send you direct marketing about similar products or services, in accordance with section 69(3), unless you have opted out. You may withdraw your consent or opt out of direct marketing at any time, free of charge, by using the unsubscribe link in our communications or by contacting our Information Officer using the details in Section 1.

13. Your Rights as a Data Subject

  • Right of access (POPIA s23): request confirmation of, and access to, the personal information we hold about you.
  • Right to correction (POPIA s24): request that we correct or update inaccurate, incomplete, misleading, or outdated personal information.
  • Right to deletion (POPIA s24): request that we delete or destroy personal information we no longer have authority to retain, subject to our lawful retention obligations described in Section 16.
  • Right to object (POPIA s11(3)): object, on reasonable grounds, to the processing of your personal information, including for direct marketing purposes.
  • Right to withdraw consent: where processing is based on consent, withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
  • Right to lodge a complaint: lodge a complaint with our Information Officer and/or the Information Regulator, as described in Section 20.

14. How to Exercise Your Rights

You can submit access, correction, or deletion requests through the customer Portal, where available, or by contacting our Information Officer using the details in Section 1. To protect your information, we will take reasonable steps to verify your identity before actioning a request. We aim to respond to requests within a reasonable time, and in any event within the timeframes required by POPIA (ordinarily within 30 days for access requests, subject to any lawful extension).

15. Security Safeguards

In accordance with section 19 of POPIA, we implement appropriate technical and organisational measures to protect the integrity and confidentiality of your personal information against loss, unauthorised access, interference, or disclosure, including:

  • Encryption at rest: sensitive personal information is stored using field-level encryption.
  • Secure transport: we use HTTPS/TLS to encrypt information in transit.
  • Access control: access to personal information is restricted to staff who require it to perform their role, on a least-privilege basis.
  • Audit logging: security-relevant events are recorded in an append-only, tamper-evident audit log.
  • Ongoing review: we periodically review our security measures to address emerging risks.

16. Retention Periods

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, regulatory, accounting, or reporting obligations. In particular:

  • Credit Agreement and application records: retained for the period required under the NCA and other applicable financial services and tax legislation, generally for at least five years after the agreement ends, and longer where required for legal or regulatory purposes.
  • Access requests: responded to within the timeframes required by POPIA (see Section 14).
  • Deletion requests: actioned within a reasonable period, subject to a limited grace period necessary for technical processing, and always subject to our lawful retention obligations described above.
  • Unsuccessful applications: retained for a limited period to comply with regulatory and audit requirements and to respond to any subsequent enquiry, after which the information is securely deleted or anonymised.

17. Data Breach Notification

If we become aware of a security compromise that has resulted, or is reasonably likely to result, in unauthorised access to or acquisition of your personal information, we will notify the Information Regulator and affected data subjects as soon as reasonably possible, in accordance with section 22 of POPIA, providing sufficient information to allow you to take protective measures.

18. Children's Personal Information

Our services are intended for adults aged 18 and over, and we do not knowingly collect personal information relating to children, as defined in POPIA. If we become aware that we have inadvertently collected personal information from a child without the necessary consent of a competent person, we will take reasonable steps to delete that information.

19. Changes to This Policy

We may update this Policy from time to time to reflect changes in our processing practices or legal requirements. Where changes are material, we will take reasonable steps to notify you (for example, via email or a notice on the Website) before the changes take effect. The "Last updated" date at the top of this page indicates when this Policy was last revised.

20. Complaints Procedure

If you believe your personal information has not been handled in accordance with POPIA, please contact our Information Officer first, using the details in Section 1, so that we can investigate and attempt to resolve your concern. If you remain dissatisfied, you have the right to submit a complaint to the Information Regulator:

The Information Regulator (South Africa)
Email: enquiries@inforegulator.org.za
Complaints: complaints.IR@justice.gov.za
Website: www.justice.gov.za/inforeg/

21. Contact Us

For any questions about this Policy or how we handle your personal information, please contact our Information Officer using the details in Section 1, or reach our general support team:

Asante Financial Services (Pty) Ltd
Email: info@asantefs.co.za
Phone: +27 31 301 9000
Address: [PHYSICAL / REGISTERED ADDRESS], Durban, KwaZulu-Natal, South Africa

This Policy should be read together with our Terms & Conditions, which govern your use of this Website and any Credit Agreement you enter into with us.

chat Chat with us