POPIA Compliance Policy

Tholulwazi Verify is a business verification platform operated by Tholulwazi Capital CC (Registration Number 2010/091355/23), trading as Tholulwazi Verify. We are committed to protecting personal information and processing it in accordance with the Protection of Personal Information Act, 2013 (POPIA), the Financial Intelligence Centre Act (FICA), the Electronic Communications and Transactions Act (ECTA), and other applicable South African legislation.

This Policy explains how personal information is collected, processed, stored, shared, protected, and retained when using the Tholulwazi Verify Platform.

The purpose of this Policy is to:

• protect the privacy rights of individuals;
• promote lawful processing of personal information;
• explain our responsibilities as an Operator;
• explain our customers' responsibilities as Responsible Parties;
• comply with applicable legislation; and
• promote responsible use of verification services.

For most verification services provided through the Platform: your organisation is the Responsible Party under POPIA; Tholulwazi Verify acts as the Operator and processes personal information on your behalf.

Where we collect personal information directly for our own business purposes, such as customer account management, billing, technical support, fraud prevention, or website administration, Tholulwazi Verify acts as the Responsible Party.

Depending on the services used, we may process:

Identity Information

• Full names
• South African identity numbers
• Passport numbers
• Date of birth
• Nationality

Contact Information

• Email addresses
• Telephone numbers
• Residential and business addresses

Business Information

• Company registration details
• Director information
• VAT registration numbers
• Business contact information

Verification Information

• Identity verification results
• Facial comparison results
• Liveness detection results
• Bank account verification
• AML screening
• Politically Exposed Person (PEP) screening
• Sanctions screening
• Fraud indicators
• Verification reports
• Audit records

Technical Information

• IP addresses
• Browser information
• Device identifiers
• Login history
• API activity
• System logs
• Cookies

Personal information is processed only where permitted by POPIA, including where:

• processing is necessary to provide requested services;
• processing is required by law;
• processing protects a legitimate interest of the data subject;
• processing protects our legitimate business interests;
• consent has been obtained where required; or
• processing is necessary for fraud prevention, identity verification or compliance.

Customers are responsible for confirming that they have a lawful basis before submitting any verification request.

Personal information is processed only for legitimate business purposes, including: identity verification; Know Your Customer (KYC); Customer Due Diligence (CDD); Anti-Money Laundering (AML) screening; fraud prevention; sanctions screening; Politically Exposed Person (PEP) screening; business verification; regulatory compliance; customer support; account management; payment processing; API management; audit logging; information security; and legal compliance.

Personal information will not be processed for purposes incompatible with these objectives.

Customers using the Platform agree that they:

• have a lawful reason to request each verification;
• have obtained consent where required by law;
• comply with POPIA and all applicable legislation;
• process personal information fairly and lawfully;
• protect login credentials and API keys;
• report unauthorised access immediately; and
• use verification results responsibly.

Customers remain responsible for decisions made using verification results.

Personal information may be shared only where necessary with:

• authorised verification providers;
• banking verification providers;
• identity verification partners;
• fraud prevention providers;
• payment service providers;
• cloud infrastructure providers;
• technology partners;
• auditors;
• legal advisers;
• regulators;
• law enforcement agencies; or
• courts where required by law.

We do not sell personal information.

We maintain reasonable technical and organisational safeguards to protect personal information, including:

• encrypted communications;
• encrypted storage where appropriate;
• role-based access control;
• multi-factor authentication where available;
• audit logging;
• continuous monitoring;
• vulnerability management;
• firewall protection;
• secure API authentication;
• access reviews; and
• regular security testing.

Although we apply reasonable safeguards, no electronic system can be completely secure.

Personal information is retained only for as long as necessary to:

• provide our services;
• comply with FICA;
• comply with POPIA;
• resolve disputes;
• enforce agreements;
• investigate fraud;
• maintain audit records; or
• comply with legal obligations.

Information that is no longer required is securely deleted, anonymised, or destroyed in accordance with applicable legislation.

Subject to applicable legislation, individuals may request to:

• access their personal information;
• correct inaccurate information;
• update incomplete information;
• object to certain processing;
• request deletion where legally permitted;
• withdraw consent where consent applies;
• request information regarding processing activities; and
• lodge a complaint with the Information Regulator.

Requests may be submitted using the contact details below.

Where personal information is processed outside South Africa, Tholulwazi Verify will take reasonable steps to ensure that the recipient provides an adequate level of protection consistent with POPIA.

Where a security compromise involving personal information occurs, we will:

• investigate the incident;
• contain the breach where reasonably possible;
• assess affected information;
• notify affected customers where required by law;
• notify the Information Regulator where legally required; and
• implement corrective measures to reduce future risk.

Our website uses cookies and similar technologies to:

• improve website performance;
• maintain secure login sessions;
• analyse website traffic;
• detect fraudulent activity; and
• remember user preferences.

Users may manage cookie settings through their web browser.

The Platform integrates with licensed third-party verification providers. Those providers process information in accordance with their own legal and contractual obligations. Tholulwazi Verify is not responsible for the privacy practices of third-party websites or services that are outside our control.

This Policy may be updated from time to time to reflect changes in legislation, technology, business operations, or verification services. The latest version will always be available on the Tholulwazi Verify website. Continued use of the Platform constitutes acceptance of the updated Policy.

Tholulwazi Verify, trading as Tholulwazi Capital CC

Registration Number: 2010/091355/23

Website: https://verify.tholulwazicapital.co.za

Support Email: support@tholulwazicapital.co.za

Telephone: 087 821 3154

Tholulwazi Verify has appointed an Information Officer responsible for overseeing compliance with POPIA and responding to requests relating to personal information. Requests relating to personal information, POPIA, or this Policy may be submitted using the contact details above.

If you believe your personal information has been processed unlawfully, you may submit a complaint to the Information Regulator of South Africa.

Website: https://www.justice.gov.za/inforeg/

Email: complaints.IR@justice.gov.za

Telephone: 010 023 5200