Privacy notice

This document is a working draft prepared for launch and is subject to final legal review. [PENDING: legal-review]

Who we are

African Payment Solutions (Pty) Ltd (registration number 2015/201375/07, registered office 2nd Floor, Sunclare Building, Cnr Dreyer and Protea Roads, Claremont, 7708, South Africa) is the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA), and the controller under the EU and UK General Data Protection Regulation (GDPR) where it applies, for personal information collected through this website, africanpaymentsolutions.com. Our information officer can be contacted at info@africanpaymentsolutions.com.

This notice covers this website only. If your business applies for or uses our payment services, the information gathered during onboarding and operation is collected through our LekkaPay platform under its own privacy notices, provided to you there.

What we collect on this site

This site collects what you choose to submit through the "Talk to us" form: your name, your work email address, your company name if you give it, the markets and profile you select, and the message you write to us.

We also keep minimal technical logs, the kind every web server produces, to keep the site secure and available.

With your consent, and only with your consent, we run two measurement tools: Google Analytics 4, which tells us in aggregate how people use the site, and the LinkedIn Insight Tag, which lets us measure the LinkedIn campaigns that bring people here. Neither runs until you accept it in the cookie banner, and you can withdraw consent at any time through "Cookie settings" in the footer. Details of the cookies each tool sets are in our cookie notice.

Why we collect it

We use form submissions to respond to your enquiry. That is the whole purpose. Our lawful basis is our legitimate interest in answering the people who contact us, together with the consent you give by choosing to send the form. Technical logs are used to keep the site secure, available and performing properly. Analytics and campaign measurement run on the basis of your consent.

What we do not do

• We do not sell personal information, to anyone, for any purpose.
• We do not build advertising profiles of individual visitors.
• We do not send you marketing because you asked a question. You will only receive marketing from us if you have expressly consented to it, and you can withdraw that consent at any time.

How long we keep it

Form submissions are kept only as long as needed to handle your enquiry and any follow-up that flows naturally from it, after which they are deleted. Technical logs are retained briefly for security and operational purposes and then discarded. Google Analytics data is retained for 14 months. Your cookie preference is stored for 12 months.

Your rights

POPIA, and where it applies the GDPR, give you the right to:

• ask whether we hold personal information about you, and request access to it;
• request correction of information that is inaccurate or out of date;
• request deletion of information we no longer have grounds to keep;
• object to processing, including any direct marketing, and withdraw consent at any time;
• lodge a complaint with the Information Regulator (South Africa), or with your local supervisory authority if you are in the EU or UK, if you believe your information has been mishandled.

Security of processing

Connections to this website are encrypted in transit. We store the minimum information necessary, and access to it is restricted to the people who need it to answer you. African Payment Solutions (Pty) Ltd is a PCI DSS Level 1 compliant service provider, and the discipline that standard demands of our payment systems shapes how we treat website data too.

Where your information is processed

Our infrastructure is hosted with cloud providers whose services may process data outside South Africa, and Google and LinkedIn process the measurement data described above on their own infrastructure. Where personal information crosses a border, it does so under the safeguards POPIA and the GDPR require: recipients bound by law, binding corporate rules or agreements that uphold protection comparable to the conditions for lawful processing.

How to exercise your rights

To exercise any of these rights, reach us through our contact page or email our information officer at info@africanpaymentsolutions.com. We will respond within a reasonable time and, where the law sets a deadline, within that deadline.