Bridging Today

Building Tomorrow.

Privacy Policy

How CapVerge collects, uses and protects your personal information · Version 1.0 · Effective 27 July 2026

This Privacy Policy explains what personal information CapVerge collects about you, why we collect it, who we share it with, how long we keep it and what rights you have. It is issued in terms of the Protection of Personal Information Act 4 of 2013 (“POPIA”).

1. Who is responsible for your information

CapVerge (Pty) Ltd is the responsible party for the personal information described in this policy.

Item	Detail
Responsible party	CapVerge (Pty) Ltd, registration number 2025/149059/07
Registered office	362 Main Reef Road, Wentworth Park, Krugersdorp, Gauteng, 1739
NCR registration	NCRCP23705
Information Officer	[name and designation to be confirmed]
Information Officer email	[privacy@capverge.co.za — mailbox to be created]
General enquiries	info@capverge.co.za

2. What information we collect

2.1 Information you give us

Identity: full name, identity or passport number, date of birth, gender, nationality.
Contact: physical and postal address, email address, mobile and other telephone numbers.
Financial: income, expenses, bank account details, bank statements, payslips, existing debt obligations.
Employment: employer name, occupation, length of service, employment status.
Application: loan amount requested, purpose of the loan, dependants, marital status and marital regime.

2.2 Information we obtain from others

Credit bureau data: your credit record, payment profile, judgments, defaults and enquiry history.
Verification data: identity, bank account and income verification from accredited third-party providers.
Fraud data: information from fraud prevention databases and industry registers.

2.3 Information collected automatically

Technical: IP address, device and browser type, operating system, referring pages.
Usage: pages visited, time on page, links clicked, application progress.
Cookies: as described in section 8 below.

We do not knowingly collect information from anyone under 18. If we learn that we hold information about a minor, we will delete it.

3. Why we process your information, and on what legal basis

Purpose	Legal basis under POPIA
Assessing your application, verifying your identity and conducting affordability assessments	Necessary to conclude or perform a contract; compliance with a legal obligation under the NCA
Conducting credit bureau enquiries and reporting your payment behaviour	Compliance with a legal obligation under the NCA; your consent
Administering your loan, collecting repayments and issuing statements	Performance of a contract
Preventing, detecting and investigating fraud and money laundering	Compliance with a legal obligation (FICA); legitimate interests
Responding to your queries and complaints	Performance of a contract; legitimate interests
Marketing our products to you	Your consent, which you may withdraw at any time
Improving our website, products and service	Legitimate interests
Meeting record-keeping, audit, tax and regulatory obligations	Compliance with a legal obligation

4. Who we share your information with

We share personal information only where it is lawful and necessary, and always under a written agreement that requires the recipient to protect it. Recipients may include:

Registered credit bureaus — for credit enquiries and mandatory payment reporting.
Our loan management and origination system providers — for processing and administering your loan.
Banks and payment processors — for disbursing funds and collecting repayments.
Identity, income and bank verification providers — for confirming the information you supply.
Insurers — where credit life cover forms part of your agreement.
Debt collectors and attorneys — only where an account is in default.
Regulators, courts and law enforcement — where we are legally required to disclose.
Professional advisers and auditors — under a duty of confidentiality.

We do not sell your personal information.

5. Cross-border transfers

Some of our service providers may store data outside South Africa. Where that happens we transfer information only where the recipient country or the recipient’s binding agreements provide a level of protection substantially similar to POPIA, as required by section 72.

6. How we protect your information

Encryption of data in transit using TLS, and encryption of sensitive data at rest.
Role-based access control — staff access only the information their role requires.
Multi-factor authentication on administrative and system access.
Logging and monitoring of access to customer records.
Written confidentiality and data-protection obligations in every staff and supplier contract.
Documented backup, business continuity and disaster recovery arrangements.

Detail on payment-specific controls appears in our Payment & Data Security statement.

7. How long we keep it

Record type	Retention period
Credit agreements and supporting documents	5 years from termination of the agreement (NCA regulations)
FICA identification and verification records	5 years from the end of the business relationship
Declined applications	3 years from the date of the decision, unless a shorter period is requested
Accounting and tax records	5 years (Companies Act and Tax Administration Act)
Website analytics and cookie data	As set out in section 8
Marketing consent records	Until consent is withdrawn, plus 3 years

Once a retention period expires, records are securely destroyed or de-identified.

8. Cookies

Our website uses cookies and similar technologies:

Strictly necessary — required for the site and application forms to function. These cannot be switched off.
Performance and analytics — help us understand how the site is used so we can improve it.
Functional — remember your preferences.
Marketing — used to measure and target our advertising. These are set only with your consent.

You can manage cookies through your browser settings or through the cookie banner on our website. Disabling strictly necessary cookies may prevent parts of the site from working.

9. Your rights

Under POPIA you have the right to:

be told what personal information we hold about you, and to request a copy;
ask us to correct, update or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;
object to processing based on legitimate interests, on reasonable grounds;
withdraw your consent to marketing at any time, at no cost;
not be subject to a decision based solely on automated processing that has legal consequences for you, without being able to make representations; and
complain to the Information Regulator.

To exercise these rights, contact the Information Officer using the details in section 1. We may need to verify your identity first. Requests for access are made on Form 2 under the Promotion of Access to Information Act 2 of 2000 (“PAIA”) and may attract the prescribed fee.

10. Direct marketing

We will only send you electronic marketing where you have consented, or where you are an existing customer and the marketing relates to similar products. Every marketing message contains an unsubscribe mechanism, and you may opt out at any time by emailing info@capverge.co.za.

11. Automated decision-making

Part of our credit assessment uses automated scoring based on the information you supply and data from credit bureaus. A declined application is not final: you may ask for the decision to be reviewed and may make representations to us. We will tell you the dominant reason for a decline where the NCA requires it.

Add Your Heading Text Here

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Ut elit tellus, luctus nec ullamcorper mattis, pulvinar dapibus leo.

12. Security breaches

If a breach compromises your personal information, we will notify you and the Information Regulator as soon as reasonably possible after establishing the extent of the breach, in accordance with section 22 of POPIA.

13. Complaints to the Information Regulator

Information Regulator (South Africa)
Address	JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Complaints email	complaints.IR@justice.gov.za
General enquiries	enquiries.IR@justice.gov.za
Website	www.inforegulator.org.za

14. Changes to this policy

We review this policy at least annually. The current version is always published at www.capverge.co.za. Material changes will be brought to your attention.

Version 1.0 · Effective 27 July 2026 · Next review July 2027. Derived from the internal CapVerge POPIA & Data Protection Policy v1 (February 2026). Items in square brackets require confirmation before publication.