Efficacy Payments Proprietary Limited Privacy Policy

Updated:

November 17, 2025

THIS PRIVACY POLICY (THE "PRIVACY POLICY") APPLIES TO HOW WE COLLECT, USE AND PROCESS YOUR PERSONAL INFORMATION. PLEASE READ THIS PRIVACY POLICY CAREFULLY.

All of the provisions of this Privacy Policy are important, but please pay special attention to the parts that are in bold writing. These parts contain information about provisions that have special consequences for you. These parts are only intended to bring such provisions to your attention, and, where necessary, to explain their fact, nature and effect. Where explanations are given, they may be contained in a box. Such boxed explanations are aids to understanding only and are not provisions themselves. They do not limit the meaning or application of the provisions, and do not apply only to the situations and examples described in the boxes or only to similar situations or examples.

SCOPE OF THIS PRIVACY POLICY
1. Introduction and scope
  1. Efficacy Payments Proprietary Limited ("Efficacy" or "we" or "us" or "our") is a designated clearing system participant as designated by the South African Reserve Bank.
  2. Efficacy strives to ensure that our use of the Personal Information of a data subjects (a person to whom Personal Information relates, which includes you) is lawful, reasonable, and relevant to our business activities, with the ultimate goal of improving our offerings and your experience.
  3. We have appointed an Information Officer who is responsible for overseeing questions in relation to the Privacy Policy. You may contact our Information Officer at compliance@efficacypayments.com to discuss this Privacy Policy or your rights under data protection laws that are applicable to you.
  4. This Privacy Policy describes how we will treat your Personal Information whether provided by you to us, or collected by us through other means in your ordinary use of our products and/or services, which includes access to our website (“the Website").
  5. This Privacy Policy must be read together with any Website terms of use and any other documents or agreements that describe the manner in which we, in specific circumstances, collect or process Personal information about you. This will enable you to understand the manner in which Efficacy will process your Personal Information. This Privacy Policy supplements such other documents and agreements but does not supersede them and in the event of any conflict, ambiguity or inconsistency between this Privacy Policy and such other documents and agreements, the terms of the particular document or agreement will prevail.
THE PERSONAL INFORMATION THAT WE COLLECT ABOUT YOU?
1. Efficacy may collect, acquire, receive, record, organise, collate, store, update, change, retrieve, read, process, analyse, use and share your Personal Information in the manner as set out in this Privacy Policy. When we perform one or more of these actions, we are "Processing" your Personal Information.
2. "Personal Information" refers to private information about an identifiable natural or juristic person. Personal Information does not include information that does not identify a person (including in instances where that information has been anonymised). The Personal Information that we collect about you may differ on the basis of the products and services that you receive from Efficacy.
3. We may process various types of Personal Information as follows:
  1. Identity Information, which includes information concerning your name, the name of your business or association, unique identifiers that are associated with you (such as payer identity numbers allocated to you by us and third parties), date of birth, gender, race and marital status;
  2. Contact Information, which includes your physical and postal addresses, email addresses and telephone numbers, as well as company secretarial information that has been disclosed in relation to you;
  3. Financial Information, which includes bank account details, payment card details and online banking login credentials, the details of third parties that receive payments from you (or make payments to you), insurance information, financial statements and VAT registration numbers and credit ratings;
  4. Access Device and Access Device event information, which may include information such as your IP address, unique device identifier, the nature of the devices ("Access Device”) which you use to access or use our services (or the Website), the geographic location from which you accessed or used our services and/or Website (i.e. the geographic location of your Access Device), hardware model and settings, operating system type and version, browser language, system activity, crashes;
  5. Log information, which includes information that is automatically collected and stored by us in server logs (i.e. our web servers automatically record and maintain a log of your activities), which may include your “activity information”, such as details of how, when and for how long you accessed our services and Website and the features that you utilised; and
  6. Location information, which includes information generated by various technologies used by us to determine your actual location, such as geographical data from your Access Device (which is usually based on the IP location).
4. Efficacy may also process, collect, store and/or use aggregated data, which may include historical or statistical data ("Aggregated Data") for any purpose. Aggregated Data may be derived from your Personal Information but is not considered Personal Information, as this data does not directly or indirectly reveal your identity. However, if we combine or connect Aggregated Data with your Personal Information in a manner that has the result that it can directly or indirectly identify you, we will treat the combined data as Personal Information, which will be managed in accordance with this Privacy Policy.
HOW WE COLLECT YOUR PERSONAL INFORMATION
1. We collect your Personal Information in three ways, namely:
  1. through direct or active interactions with you;
  2. through automated or passive interactions with you; and
  3. from third parties, including third party service providers.
2. Direct or active collection from you
  1. We may require that you submit certain information to enable you to access portion of the Website, to make use of our services, to facilitate the conclusion of an agreement with us, or that is necessary for our fulfilment of our statutory or regulatory obligations. We also collect Personal Information directly from you when you communicate directly with us, for example via e-mail, telephone calls, feedback forms, site comments or forums.
  2. If you contact us, we reserve the right to retain a record of that correspondence, which may include Personal Information.
  3. The Personal Information that we actively collect from you may include any of the Personal Information listed in paragraph 2 of this Privacy Policy.
3. Passive collection from your Access Device
  1. We may passively collect certain of your Personal Information from the Access Device that you use to access and navigate the Website and/or to receive or use our services, by way of various technological applications, for instance, using server logs to collect and maintain log information.
  2. We also use cookies and anonymous identifiers which enable our computer system to recognise you when you next visit the Website to distinguish you from other users and to improve our service to you, and which can be used to enhance the content of the Website and make it more user-friendly, as well as to give you a more personalised experience.
  3. A cookie is a small piece of data (an alphanumeric identifier) which our computer system transfers to your Access Device through your web browser when you visit the Website and which is stored in your web browser. When you visit the Website again, the cookie allows the site to recognise your browser. Cookies may store user preferences and other information.
  4. You may disable the use of cookies by configuring your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do so, you may not be able to enjoy all of the features and functionality of the Website.
  5. The Personal Information that we passively collect from your Access Device may include any of the Personal Information listed in paragraph 2 of this Privacy Policy.
4. Personal Information collected from third parties
  1. Efficacy receives Personal Information about you from various third parties and public sources, including:
    1. our clients to whom we provide payment services;
    2. third party service providers, such as credit vetting agencies;
    3. third parties who provide Personal Information to data controllers, and who in turn provide this Personal Information to Efficacy; and
    4. our information technology suppliers.
HOW WE USE YOUR PERSONAL INFORMATION
1. We use the Personal Information we collect from you to maintain and improve the Website and to improve the experience of our users, to facilitate the sale of our products and the provision of our services and to fulfil our statutory and regulatory obligations.
2. We may also use your Personal Information to:
  1. retain and make information available to you on the Website;
  2. create your user account and allow use of the Website;
  3. maintain and update our customer, or potential customer, databases;
  4. establish and verify your identity on the Website;
  5. operate, administer, secure and develop the Website and the performance and functionality of the Website;
  6. detect, prevent or manage actual or alleged fraud, security breaches or the abuse, misuse or unauthorised use of the Website and contraventions of this Privacy Policy or any of the terms and conditions that apply to your use of the Website;
  7. inform you about any changes to the Website, this Privacy Policy or other changes that are relevant to you;
  8. create user profiles and to analyse and compare how you and other users make use of the Website, including your browsing habits, click-patterns, preferences, frequency and times of use, trends and demographic information;
  9. provide you with marketing material that is relevant to you;
  10. diagnose and deal with technical issues and customer support queries and other user queries;
  11. protect our rights in any litigation that may involve you;
  12. for security, administrative and legal purposes;
  13. comply with our statutory obligations, including submissions to the Companies and Intellectual Property Commission ("CIPC"), as well as engaging with regulatory authorities;
  14. facilitate publication on the Stock Exchange News Services ("SENS") and to enable users to access SENS announcements;
  15. for customer relations purposes;
  16. conduct Efficacy's recruitment and hiring processes, which includes the conducting of criminal record and credit checks, referrals, the capturing of job applicant's details and the providing of status updates to job applicants;
  17. to fulfil any contractual obligations that we may have to you or any third party;
  18. communicate with you and retain a record of our communications with you and your communications with us;
  19. analyse and compare the types of Access Devices that you and other users make use of and your physical location;
  20. to comply with requirements of our sponsoring banks or card schemes; and
  21. for other lawful purposes that are relevant to our business activities or regulatory functions.
3. Efficacy will restrict its processing of your Personal Information to the original purpose for which it was collected, unless Efficacy reasonably considers that it is necessary to process it for another purpose that is compatible with the original purpose.
4. Efficacy may, where permitted or required to do so by applicable legislation, process your Personal Information without your knowledge or consent, and will do so in accordance with the further provisions of this Privacy Policy.
COMPULSORY PERSONAL INFORMATION AND CONSEQUENCES OF NOT SHARING WITH US

Where Efficacy is required to process certain Personal Information by law, or in terms of a contract that we have with you, and you fail to provide such Personal Information when requested to do so, Efficacy may be unable to perform in terms of the contract we have in place or are trying to enter into with you. In this case, Efficacy may be required to terminate the contract and/or relationship, upon notification to you, which termination will be done in accordance with the terms of the contract and all applicable legislation. Alternatively, Efficacy may be unable to effect a payment instruction on your behalf if you do not provide us with this compulsory Personal Information.

In the paragraph above, you agree and accept that there is certain compulsory Personal Information you must provide us with if you want to enjoy all of the features and functionality on the Website. If you decide not to provide us with such compulsory Personal Information, you agree that we may limit certain features and functionality on the Website.

SHARING OF YOUR PERSONAL INFORMATION
1. We will not intentionally disclose your Personal Information, whether for commercial gain or otherwise, other than with your permission, as permitted by applicable law or in the manner as set out in this Privacy Policy.
2. Efficacy may share your Personal Information under the following circumstances:
  1. with our agents, advisers, service providers and suppliers that have agreed to be bound by this Privacy Policy or similar terms, which offer the same level as protection as this Privacy Policy;
  2. with our employees, suppliers, service providers, contractors and agents if and to the extent that they require such Personal Information in the provision of services for or to us. These services include, but are not limited to, hosting, development and administration, technical support and other support services relating to the Website or the operation of Efficacy's business. This includes third-party providers offering the following services:
    1. Cloud hosting, infrastructure and development tools;
    2. Communication, collaboration, and workflow management services;
    3. Business and financial operations;
    4. Marketing, analytics, and customer support;
    5. Security, privacy, and compliance;
    6. Payments and banking services;
    7. Document management and signing platforms; and
    8. Design and creativity tools.
  3. to enable us to enforce or apply any other contract between you and us;
  4. to protect our rights, property or safety or that of our customers, employees, contractors, suppliers, service providers, agents and any other third party;
  5. to mitigate any actual or reasonably perceived risk to us, our customers, employees, contractors, agents or any other third party;
  6. with governmental agencies, card schemes, sponsoring banks and other regulatory or self-regulatory bodies, if required to do so by law or we reasonably believe that such action is necessary to:
    1. comply with the law or with any legal, contractual or regulatory process;
    2. protect and defend the rights, property or safety of Efficacy, or our customers, employees, contractors, suppliers, service providers, agents or any third party;
    3. detect, prevent or manage actual or alleged fraud, security breaches, technical issues, or the abuse, misuse or unauthorised use of the Website and contraventions of this Privacy Policy including cooperating with law enforcement agencies, such as the South African Police Service (SAPS), for the purpose of fraud investigations; and
    4. protect the rights, property or safety of members of the public (if you provide false or deceptive information or misrepresent yourself, we may proactively disclose such information to the appropriate regulatory bodies and/or commercial entities).
  7. Where we appoint a third party to process your Personal Information on our behalf, we shall, among other things, enter into written agreements with those third parties governing our relationship with them and containing confidentiality and non-disclosure provisions.
STORAGE AND TRANSFER OF YOUR PERSONAL INFORMATION
1. We store your Personal Information on our servers or those of our service providers and in hard copy format at our offices and at the storage facilities of our third party record storage and management providers.
2. We reserve the right to transfer to and/or store your Personal Information on servers in a jurisdiction other than where it was collected, or outside of South Africa in a jurisdiction that may not have comparable data protection legislation.
3. If the location to which Personal Information is transferred and/or is stored does not have substantially similar laws to those of South Africa, which provide for the protection of Personal Information, we will take reasonably practicable steps, including the imposition of appropriate contractual terms to ensure that your Personal Information is adequately protected in that jurisdiction.
4. Please contact us if you require further information as to the specific mechanisms used by us when transferring your Personal Information outside of South Africa or to a jurisdiction that is different to the one in which we collected your Personal Information.
SECURITY
1. We take reasonable technical and organisational measures to secure the integrity of retained information and protect it from misuse, loss, alteration and destruction though the use of accepted technological standards that prevent unauthorised access to or disclosure of your Personal Information.
2. We also create a back-up of your information for operational and safety purposes to the extent that we are permitted to do so in terms of applicable laws.
3. We review our information collection, storage and processing practices, including physical security measures periodically, to ensure that we keep abreast of good practice.
4. Despite the above measures being taken when Processing Personal Information, we do not guarantee that your Personal Information is 100% secure.
5. Efficacy has implemented procedures to address actual and suspected data breaches and undertakes to notify you and the relevant regulatory authorities of breaches in instances in which Efficacy is legally required to do so and within the period in which such notification is necessary.

In this paragraph, you acknowledge that you know and you accept that technology is not absolutely secure and there is a risk that your Personal Information will not be secure when processed by means of technology. We do not promise that we can keep your Personal Information completely secure. You will not be able to take action against us if you suffer losses or damages in these circumstances.

RETENTION OF YOUR PERSONAL INFORMATION AND SPECIAL PERSONAL INFORMATION
1. We may retain and Process some or all of your Personal Information if and for as long as:
  1. we are required or permitted by law, a code of conduct or a contract with you to do so;
  2. we reasonably need it for lawful purposes related to the performance of our functions and activities;
  3. we reasonably require it for evidentiary purposes; or
  4. you agree to us retaining it for a specified further period.
2. To determine the appropriate retention period for Personal Information, Efficacy will consider, among other things, the nature and sensitivity of the Personal Information, the potential risks or harm that may result from its unauthorised use or disclosure, the purposes for which we process it and whether those purposes may be achieved through other means. Efficacy will always comply with applicable legal, regulatory, tax, accounting or other requirements as they pertain to the retention of Personal Information.
MAINTENANCE OF YOUR PERSONAL INFORMATION AND SPECIAL PERSONAL INFORMATION
1. In accordance with applicable legislation and the rules of Efficacy, Efficacy will take all necessary steps to ensure that the persons responsible for the maintenance of your Personal Information do so in a manner that ensures that it is accurate, complete, not misleading and is up to date.
2. It is your responsibility to advise Efficacy or the persons responsible for the maintenance of your Personal Information should any of Personal Information we have about you be incorrect, incomplete, misleading or out of date, by notifying us at the contact details set out in paragraph 18.1 below.
YOUR RIGHTS
1. Data protection laws confer certain rights on you in respect of your Personal Information, which include the right to:
  1. Request access to your Personal Information (often referred to as a “data subject access request”), which entitles you to receive a copy of the Personal Information retained about you.
  2. Request the correction of your Personal Information, in order to ensure that any incomplete or inaccurate Personal Information is corrected.
  3. Request erasure of your Personal Information, where there is no lawful basis for the retention or continued processing of it.
  4. Object to the processing of your Personal Information for legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms.
  5. Request restriction of processing of your Personal Information. This enables you to ask Efficacy to suspend the processing of your Personal Information in limited circumstances, which may differ by jurisdiction.
  6. Withdraw consent previously given in respect of the processing of your Personal Information at any time which withdrawal of consent will not affect the lawfulness of any processing carried out prior to your notice of withdrawal. Withdrawal of consent may limit the ability of Efficacy or a third party to provide certain products or services to you, but will not affect the continued processing of your Personal Information in instances in which your consent is not required.
2. As far as the law allows, we may charge a fee for attending to any of the above requests, and may also refuse to carry out any of your requests in whole or in part.
CHANGES TO THIS PRIVACY POLICY

This Privacy Policy may be amended from time to time and we will take reasonably practicable steps to inform you when changes are made.

CHILDREN

The Website and Efficacy's products and services are not targeted at children (a natural person under the age of 18 years). We will not knowingly collect Personal Information in respect of children without express permission to do so from a competent person (any person who is legally competent to consent to any action or decision being taken in respect of any matter concerning a child).

THIRD PARTY SITES
1. This Privacy Policy does not apply to the websites of any other parties, or the applications, products or services, such websites advertise and which may be linked to this Website, or websites that link to or advertise this Website. Efficacy is not responsible for the privacy practices of such third party websites.
2. We advise you to read the privacy policy of each third party website and decide whether you agree to their privacy practices and policies, as these third party websites may also be collecting or sharing your Personal Information.

We are not liable if you suffer losses or damages when visiting third party websites by following a link to that website from this Website. You accept that there may be risks when you use such third party websites, and you do so at your own risk.

CONSUMER PROTECTION ACT, PROTECTION OF PERSONAL INFORMATION ACT AND OTHER LAWS
1. If this Privacy Policy or any provision in this Privacy Policy is regulated by or subject to the Consumer Protection Act, the Protection of Personal Information Act, 2013 ("POPIA") or other laws, it is not intended that any provision of this Privacy Policy contravenes any provision of the Consumer Protection Act, POPIA or such other laws. Therefore all provisions of this Privacy Policy must be treated as being qualified, to the extent necessary, to ensure that the provisions of the Consumer Protection Act, POPIA and such other laws are complied with.
2. No provision of this Privacy Policy:
  1. does or purports to limit or exempt us from any liability (including, without limitation, for any loss directly or indirectly attributable to our gross negligence or wilful default or that of any other person acting for or controlled by us) to the extent that the law does not allow such a limitation or exemption;
  2. requires you to assume risk or liability for the kind of liability or loss, to the extent that the law does not allow such an assumption of risk or liability; or
  3. limits or excludes any warranties or obligations which are implied into this Privacy Policy by the Consumer Protection Act (to the extent applicable), POPIA (to the extent applicable), or other applicable laws or which we give under the Consumer Protection Act (to the extent applicable), POPIA (to the extent applicable), or other applicable laws, to the extent that the law does not allow them to be limited or excluded.
GENERAL
1. You agree that this Privacy Policy our relationship and any dispute of whatsoever nature relating to or arising out of this Privacy Policy whether directly or indirectly is governed by South African law, without giving effect to any principle of conflict of laws.
2. Our failure to exercise or enforce any right or provision of this Privacy Policy shall not constitute a waiver of such right or provision.
3. Each provision of this Privacy Policy, and each part of any provision, is removable and detachable from the others. As far as the law allows, if any provision (or part of a provision) of this Privacy Policy is found by a court or authority of competent jurisdiction to be illegal, invalid or unenforceable (including without limitation, because it is not consistent with the law of another jurisdiction), it must be treated as if it was not included in this Privacy Policy and the rest of this Privacy Policy will still be valid and enforceable.
QUERIES AND CONTACT DETAILS OF THE INFORMATION REGULATOR
1. Should you feel that your rights in respect of your Personal Information have been infringed, please address your concerns to the Efficacy Information Officer at compliance@efficacypayments.com.
2. If you feel that the attempts by Efficacy to resolve the matter have been inadequate, you may lodge a complaint with the South African Information Regulator by accessing their website at https://inforegulator.org.za/.

‍