Privacy Notice

Firstrate Capital is a registered credit provider in South Africa and is regulated by the National Credit Regulator (NCR). NCR Registration Number: NCRCP22727 We are committed to protecting your personal information in accordance with: • Protection of Personal Information Act 4 of 2013 (POPIA) • National Credit Act 34 of 2005 (NCA) • Electronic Communications and Transactions Act 25 of 2002 (where applicable) • Any other applicable South African legislation governing personal information and credit services. WHY WE COLLECT YOUR PERSONAL INFORMATION We collect personal information so that we can: • Verify your identity. • Process your application for credit. • Conduct affordability assessments. • Assess your creditworthiness. • Prevent fraud and financial crime. • Meet our legal and regulatory obligations. • Manage your loan account. • Communicate with you. • Collect outstanding amounts where legally permitted. • Improve our products and customer service. • Protect our legitimate business interests. WHAT INFORMATION WE COLLECT Depending on the services you use, we may collect: Personal Information • Full names • South African ID or Passport Number • Date of Birth • Gender (where required) • Contact details • Residential and Postal Address • Email Address Financial Information • Bank Account Details • Employment Information • Employer Details • Salary Information • Payslips • Bank Statements • Existing Credit Obligations • Credit Bureau Information • Affordability Assessment Information Technical Information • Device Information • Browser Information • IP Address • Login History • Security Logs • Cookies where applicable Supporting Documentation • Proof of Identity • Proof of Residence • Proof of Income • Supporting documents required by law or regulation. LEGAL BASIS FOR PROCESSING We process your personal information because: • it is necessary to perform or conclude a credit agreement with you; • we must comply with legal obligations under applicable legislation; • it is necessary to protect our legitimate interests or yours; • you have provided consent where consent is required. Not all processing relies on consent. Certain processing is required by law or is necessary to perform a credit agreement. CREDIT BUREAU PROCESSING Where permitted or required by law, we may obtain and share information with registered credit bureaux and other authorised parties for purposes such as: • Credit risk assessment • Affordability assessment • Fraud prevention • Account performance reporting • Debt recovery • Compliance with the National Credit Act WHO WE SHARE YOUR INFORMATION WITH We may share your information with authorised parties including: • Registered Credit Bureaux • Payment Service Providers • Banking Partners • Debt Collection Service Providers • Attorneys acting on our behalf • Regulators • Auditors • Fraud Prevention Agencies • Technology Service Providers acting under contract • Government authorities where required by law All service providers who process information on our behalf are required to maintain appropriate confidentiality and security safeguards. INTERNATIONAL TRANSFERS If your information is transferred outside South Africa, we will ensure that appropriate legal and technical safeguards are in place before any transfer occurs, in accordance with applicable law. HOW LONG WE KEEP YOUR INFORMATION We retain your personal information only for as long as: • required by law; • necessary to administer your credit agreement; • required to resolve disputes; • required for regulatory reporting; • necessary to protect our legal rights. Where legislation prescribes minimum retention periods, we will retain records for at least those periods before securely deleting or anonymising the information, unless a longer retention period is legally required. YOUR RIGHTS Subject to applicable law, you have the right to: • Request access to your personal information. • Request correction of inaccurate information. • Request deletion where legally permissible. • Object to certain processing activities. • Withdraw consent where processing is based on consent. • Submit a complaint to the Information Regulator. • Ask questions about how your information is processed. Certain rights may be limited where legislation requires us to retain or continue processing your information. SECURITY We use administrative, technical and physical safeguards designed to protect your personal information against: • Unauthorised access • Loss • Theft • Alteration • Disclosure • Destruction No electronic system is completely secure, but we continuously monitor and improve our security controls. MARKETING COMMUNICATIONS We will only send marketing communications where permitted by law. You may opt out of direct marketing communications at any time. Operational communications relating to your loan account will continue where necessary. MONTHLY PRIVACY REVIEW To promote transparency and keep you informed, we ask you to review this Privacy Notice on your first login each calendar month. If material changes have been made, they will be highlighted before you acknowledge the updated notice. This process helps ensure you remain informed about how your personal information is processed. CONTACT OUR INFORMATION OFFICER Information Officer Name: Brian Modjadji Email: brian@firstratecapital.co.za Telephone: 076 120 3692 Physical Address: 1 Century Boulevard, Johannesburg, South Africa COMPLAINTS If you believe your personal information has not been processed in accordance with applicable law, you may contact our Information Officer. If your complaint is not resolved, you may lodge a complaint with the Information Regulator (South Africa). CONSENT By selecting "I Agree", you confirm that: • You have read this Privacy Notice. • You understand how your personal information will be processed. • You acknowledge your rights under applicable privacy legislation. • You understand that some processing is required by law and to administer your credit agreement. • Where consent is the legal basis for processing, you provide that consent voluntarily and understand that you may withdraw it where permitted by law.