Privacy Notice / Privacy Policy

1. Introduction

NoCash Payments (Pty) Ltd (registration number 2024/310643/07) (“No-Cash”, “we”, “us”, “our”) respects your privacy and is committed to processing personal information lawfully, transparently and securely.

This Privacy Notice explains how we collect, use, disclose, store and otherwise process personal information when you:

• visit or use our website at www.nocashpay.co.za;
• create or use a No-Cash account, profile, dashboard, QR page, payment page or payout route;
• make or receive a payment, tip, gratuity, donation or other transaction through the No-Cash platform;
• sign up as an individual recipient or as an entity;
• are added by an entity as a managed recipient, staff member or related contact;
• contact us, request support, participate in a promotion, or otherwise engage with us.

This Privacy Notice must be read together with any applicable No-Cash click-wrap agreement, onboarding disclosures, fee schedules, cookie notice and any additional product-specific or campaign-specific privacy disclosures we may publish from time to time.

2. Who We Are

Depending on the context, No-Cash may act as a responsible party, operator, or participant in a broader processing chain involving payment partners, banking partners, verification providers, merchants, entities, employers, venue operators or managed recipients.

3. Scope of This Privacy Notice

This Privacy Notice applies to personal information processed by or on behalf of No-Cash in connection with:

• website visits and interactions;
• customer / payer payment flows;
• individual-recipient sign-ups and profile use;
• entity / organisation sign-ups, dashboards and public-facing QR or payment pages;
• managed-recipient or staff-related administration by entity customers;
• payment processing, settlement, verification, fraud prevention, support, analytics and related business operations.

It does not apply to third-party websites, payment pages, social-media pages, applications or services that we do not control, even if they are linked from our platform.

4. The Types of Information We Collect

Depending on your relationship with us, we may collect and process the following categories of information:

4.1 Identity and Registration Information

• full name, username, display name, company or entity name;
• identity number, passport number or other identification details where required;
• company registration details, tax details, beneficial ownership details or authorised signatory details;
• date of birth or age-confirmation information where required;
• photographs, profile images, selfies, video verification or ID-document images where required.

4.2 Contact Information

• email address;
• mobile number or telephone number;
• physical or postal address;
• support correspondence and communication preferences.

4.3 Profile and Platform Information

• profile content, QR-linked pages, public profile settings, account preferences and dashboard settings;
• venue, site, workplace or business information;
• managed-recipient and administrator information submitted by an entity;
• records of acceptance of our terms, notices and click-wrap agreements.

4.4 Financial and Payout Information

• bank account details, payout-route details or voucher-routing details;
• payment-partner, settlement and payout metadata;
• transaction history, chargebacks, reversals, refunds, reserves and negative-balance records.

4.5 Transaction and Payment Information

• payment amounts, timestamps, channels, currency and transaction references;
• customer / payer details provided during payment flows;
• transaction status, fraud flags, dispute information, chargeback and assessment information;
• supporting records or evidence relating to complaints, refunds, disputes or settlements.

4.6 Compliance, Fraud and Risk Information

• device information, IP address, session logs, geolocation signals and browser or app data;
• fraud, sanctions, anti-money-laundering, card-testing or unusual-activity indicators;
• source-of-funds or source-of-wealth information where required;
• records of KYC, verification, screening, audit or compliance checks.

4.7 Website, Cookie and Technical Information

• log files, IP address, browser type, device type, operating system and referral URLs;
• cookie identifiers and similar tracking technologies;
• analytics, event, performance and usage data.

4.8 Communications and Support Information

• emails, messages, calls, recordings, support tickets, complaints and feedback;
• documents, screenshots, photos, proofs and other materials submitted to us.

4.9 Sensitive or Special Personal Information

We do not intentionally request or process special personal information unless it is strictly necessary, lawful and appropriately safeguarded. Please do not submit unnecessary special personal information to us.

5. How We Collect Information

We may collect personal information:

• directly from you when you register, make a payment, complete a form, upload information, contact us or use the platform;
• from your device, browser, cookies or similar technologies when you use the website or platform;
• from payment partners, banks, settlement providers and verification providers;
• from entity customers, employers, principals, venue operators or administrators where they lawfully submit information about managed recipients or authorised users;
• from lawful third-party sources used for verification, fraud prevention, sanctions screening, compliance or analytics;
• from public sources where this is lawful and reasonably necessary for verification, fraud prevention, enforcement or risk management.

6. Why We Process Personal Information

We may process personal information for one or more of the following purposes, as applicable:

• to create, administer and maintain user accounts, profiles, dashboards, QR pages and payment pages;
• to onboard, identify and verify users, entities, managed recipients and authorised representatives;
• to process payments, route transactions, effect settlements and manage payout methods;
• to detect, prevent, investigate and manage fraud, abuse, chargebacks, disputes, complaints, suspicious transactions and security incidents;
• to comply with contractual, legal, regulatory, sponsor-bank, payment-partner and industry requirements;
• to provide support, communicate with users, respond to queries and resolve complaints;
• to monitor, audit, test, troubleshoot, maintain, secure and improve the website, platform and services;
• to conduct reporting, internal research, trend analysis, performance measurement and service optimisation;
• to create, validate, use and refine de-identified, aggregated and derived analytics, scores, models, benchmarks and commercial insights;
• to facilitate or support lawful financial inclusion, affordability, underwriting support, transaction-history, insurance, savings, payments, credit or referral use cases;
• to enforce our agreements, recover debts, establish or defend legal claims and protect our business;
• to carry out mergers, acquisitions, restructurings, financing transactions, investments, sales of assets or sales of business;
• to send service messages, operational notices, legal notices and, where lawful, marketing communications.

7. Our Legal Grounds for Processing

Depending on the circumstances, we process personal information on one or more lawful grounds recognised under applicable law, including where:

• you have consented to the processing;
• the processing is necessary to conclude or perform a contract with you;
• the processing is required to comply with a legal obligation;
• the processing protects a legitimate interest of yours;
• the processing is necessary for the proper performance of a public-law duty by a public body, where applicable; or
• the processing is necessary for pursuing our legitimate interests or the legitimate interests of a third party, provided those interests are not overridden by your rights and interests.

8. Payment Partners, Banking Partners and Transaction Processing

No-Cash uses third-party payment and settlement partners to operate the platform and process transactions and settlements. This means we may share relevant personal information and transaction information with payment processors, acquiring banks, sponsor banks, settlement providers, disbursement providers, fraud tools and other service providers where reasonably necessary to:

• authorise, process, route or settle transactions;
• verify identity or account ownership;
• detect or manage fraud, disputes or chargebacks;
• comply with law, card-scheme rules, partner requirements or lawful instructions.

9. Analytics, De-identified Data, Derived Data and Commercial Insights

As between you and No-Cash, No-Cash retains rights in the platform architecture, logs, metadata, transaction records, platform outputs and other platform data structures, subject always to any rights data subjects have in their personal information.

Where lawful, No-Cash may create and use de-identified data, aggregated data and derived analytics, including trends, cohort analysis, benchmarks, affordability indicators, behavioural metrics, risk indicators, fraud flags, segmentations, models, scores and commercial insights. Where lawful, No-Cash may use, license, commercialise, disclose, transfer or otherwise exploit such non-personal or lawfully de-identified outputs for analytics, benchmarking, product development, partner solutions, underwriting support, research, funding, insurance, market intelligence and strategic transactions.

For the avoidance of doubt, this Privacy Notice does not mean that No-Cash sells personal information as such in disregard of POPIA. Personal information will only be used, disclosed or transferred where we have a lawful basis to do so.

10. Direct Marketing and Communications

We may send you service-related, operational, legal, settlement, verification and support communications where necessary.

Where lawful, we may also send marketing or promotional communications about No-Cash products, features, campaigns or related financial-inclusion opportunities. Where consent is required by law, we will ask for it. You may opt out of non-essential marketing communications at any time by using the unsubscribe mechanism provided or by contacting us.

11. When We Share Personal Information

We may disclose personal information, where lawful and reasonably necessary, to:

• payment processors, sponsor banks, acquiring banks, settlement providers and payout partners;
• verification providers, sanctions-screening tools, fraud tools, AML/CFT service providers and risk-management providers;
• cloud-hosting providers, software providers, analytics providers, communications providers and other IT or operational service providers;
• professional advisers, auditors, insurers, accountants, attorneys, collections agents and compliance consultants;
• entity customers or administrators where this is necessary for dashboard administration, managed-recipient administration, allocation, reporting, support, disputes or compliance;
• law-enforcement agencies, regulators, competent authorities, courts or other bodies where disclosure is required or permitted by law;
• investors, funders, acquirers, successors or counterparties in a merger, acquisition, disposal, restructuring, financing, investment, securitisation or sale of business, subject to applicable law and confidentiality arrangements;
• any other third party where you have consented or where disclosure is otherwise lawful.

12. Cross-Border Transfers

Some of our service providers, infrastructure providers or counterparties may be located outside South Africa. Where personal information is transferred outside South Africa, we will do so only where lawful and with appropriate safeguards, for example where:

• the recipient is subject to a law, binding corporate rules or agreement that provides an adequate level of protection;
• the transfer is necessary for the performance or conclusion of a contract;
• you have consented to the transfer; or
• the transfer is otherwise permitted by POPIA.

13. Retention of Personal Information

We keep personal information only for as long as reasonably necessary for the purposes described in this Privacy Notice, including for:

• account administration and platform operation;
• payment processing, settlement, disputes and reconciliations;
• fraud prevention, risk management and security;
• business records, analytics, model validation and audit purposes;
• legal, regulatory, tax and partner-retention requirements;
• the establishment, exercise or defence of legal claims; and
• mergers, acquisitions, restructurings or sales of business.

We may retain de-identified, aggregated or derived data for longer where lawful.

14. Security

We take reasonable technical and organisational measures to help protect personal information against loss, misuse, unauthorised access, disclosure, alteration or destruction. These measures may include access controls, verification controls, monitoring, logging, encryption where appropriate, partner due diligence, contractual safeguards and fraud-screening tools.

No method of transmission over the internet or method of electronic storage is completely secure. You are responsible for maintaining the confidentiality of your own login details, devices, credentials and QR materials.

15. Cookies and Similar Technologies

We may use cookies, pixels, SDKs and similar technologies for website operation, login continuity, fraud prevention, security, analytics, performance, preferences and, where lawful, marketing.

You may be able to control cookies through your browser settings or through cookie controls we make available. Disabling some cookies may affect website or platform functionality.

16. Children's Information

The platform is not intended for use by children who cannot lawfully contract or use the service. We do not knowingly collect personal information directly from children where consent from a competent person is required, unless permitted by law and appropriately safeguarded.

17. Your Rights

Subject to applicable law, you may have the right to:

• ask whether we hold personal information about you;
• request access to personal information we hold about you;
• request correction, updating or deletion of inaccurate, irrelevant, excessive, out-of-date, incomplete, misleading or unlawfully obtained personal information;
• object, on reasonable grounds, to certain processing;
• object to processing for purposes of direct marketing;
• withdraw consent where processing is based on consent, subject to the lawfulness of prior processing;
• complain to the Information Regulator if you believe your personal information has been processed unlawfully.

We may ask you to verify your identity before responding to a privacy request. We may refuse or limit a request where the law allows us to do so.

18. Complaints and Regulator Contact

If you have a privacy concern or wish to exercise your rights, please contact us first at support@nocashteam.com.

You may also lodge a complaint with the Information Regulator (South Africa):

19. Third-Party Links and Services

Our website or platform may contain links to third-party websites, tools or content. We are not responsible for the privacy practices of those third parties. You should review their privacy notices separately.

20. Changes to This Privacy Notice

We may update this Privacy Notice from time to time. The updated version will be published on our website with the revised effective or last-updated date. Where required by law, we will take additional steps to notify users of material changes.

21. Contact Us