FICME (Pty) Ltd ("FICME", "we", "us" or "the Organisation") is committed to protecting your privacy. This Core Privacy Policy explains how we collect, verify, store, use and share personal information through the FICME app and website (the "Services") for our core compliance-document services and related account, security and billing operations. It must be read with our General Privacy Statement, which sets out our general POPIA responsibilities and practices.
This policy informs you about our processing. Using the Services or acknowledging this policy does not, by itself, constitute consent to every processing activity. Where consent is relied upon, we obtain and retain evidence of a voluntary, specific and informed authorisation.
FICME operates a secure electronic platform designed to facilitate the collection, verification, secure storage and controlled disclosure of personal information and supporting documentation required by accountable institutions to comply with the provisions of the Financial Intelligence Centre Act, 38 of 2001 ("FICA"), the Protection of Personal Information Act, 4 of 2013 ("POPIA"), and other applicable legislation.
FICME also offers optional add-on verification services that subscribing accountable institutions may use to verify personal information and supporting documentation made available to them through the platform and to conduct relevant customer due diligence checks. These services may include identity and company-information verification, sanctions and watchlist screening, and adverse-media searches through authorised third-party providers and lawfully accessible sources. The resulting verification report is made available to the requesting institution through the FICME app for review and download. Each institution remains responsible for assessing the results and fulfilling its own statutory obligations, and all checks remain subject to applicable lawful processing grounds and any required consent or regulatory authorisation.
FICME determines the purposes and means of processing in operating its platform and acts as a responsible party under POPIA for that processing, whether information is submitted directly by a data subject or by an authorised representative. Accountable institutions and other recipients remain responsible parties for their own processing. Providers processing information on FICME’s behalf under its instructions are governed by the operator provisions in the General Privacy Statement.
Nothing in this Privacy Policy limits the responsibilities of any accountable institution, company, trust or other organisation that collects, submits, accesses or otherwise processes personal information through the FICME platform. Such entities may, in relation to their own processing activities and legal obligations, also constitute responsible parties in terms of POPIA and remain responsible for ensuring that their collection, disclosure and processing of personal information are lawful, transparent and authorised, that they have an appropriate legal basis for such processing, and that they comply with all applicable obligations imposed by POPIA, FICA and any other applicable legislation. FICME's role as a responsible party in relation to the operation of the platform does not relieve any such entity of its own statutory or contractual responsibilities in respect of the personal information that it processes.
Responsible Party:
FICME (Pty) Ltd
(Registration number: 2026/646530/07)
Information Officer Details:
Information Officer: Lorraine Oosthuysen
Physical Address: 3 Rose Street, Wellington, Western Cape, 7655
Postal Address: PO Box 899, Wellington, Western Cape, 7654
Telephone Number: +27 21 864 5180
Email address: privacy@ficme.app
Personal information we collect:
We collect information to provide compliance-document collection, verification, storage and authorised sharing, related document extraction, readiness indicators and electronic-signing features where selected, and the account administration, security, support and billing needed for those services. The categories below apply according to the selected service, entity and recipient’s requirements; not every document is mandatory for every user. We limit collection to information that is adequate, relevant and not excessive. Categories may include:
Account information: name, email, mobile number, password hash.
Identity information: South African ID number, passport number, date of birth.
Verification documents and results: identity and passport documents, proof of address, bank confirmations, relevant tax-registration or tax-status documents, CIPC registration and beneficial ownership documents, and results received through a lawfully accessible verification service.
Contact and address details for you and, for business accounts, the entities you manage.
Sharing, authorisation and audit records: the information shared, recipient, person authorising it, authentication method, scope, time and duration of authorisation, access events and withdrawal or expiry.
Technical data: IP address, device and browser information, log data.
Billing and credit information: relevant billing contacts, invoices, payment references and status, credit purchases, balances, usage and refunds. Payment providers process payment details needed for their services and may act as independent responsible parties for their own activities.
Where you use document extraction, email-to-vault or electronic signing, we process the relevant documents and extracted fields, incoming attachments and necessary sender and delivery details, or signatory details and signature/authentication evidence, as applicable. Signing evidence may include timestamps and relevant device or IP information. Information about directors, trustees, beneficiaries, beneficial owners and other linked persons is processed only to the extent needed for the selected lawful purpose; adding an entity or relationship does not itself authorise screening every linked person.
We identify mandatory and optional fields at collection, any particular law requiring the information and the consequences of non-provision, such as inability to complete a selected check. Optional information is identified as such. Choosing not to use FICME does not remove an institution’s independently applicable customer due diligence requirements.
Why we process your personal information (purpose and lawful basis):
To create and operate your account and compliance passport: where necessary to conclude or perform a contract with you, or another applicable section 11 ground where the data subject is not a party to that contract.
To respond to support and information requests and communicate about requested services: contractual necessity or applicable legitimate interests, subject to POPIA.
To share selected documents with a subscribing accountable institution through your instruction and consent, or the instruction of an appropriately authorised representative, together with a lawful basis for each affected data subject’s information. Organisational authority does not automatically establish authority to consent for every individual named in a document.
To send expiry reminders and service notifications (legitimate interest / performance of contract).
To comply with record-keeping and reporting duties actually imposed on FICME by law. An institution’s FICA duties are not FICME’s own duties merely because it uses the platform. FICME facilitates document availability and retains records for its own lawful purposes as described below; it is not appointed as the institution’s statutory record keeper under section 24 of FICA.
To protect lawful rights and safety and establish, exercise or defend legal claims: an applicable legal obligation or legitimate interest, subject to necessity and proportionality.
To perform requested verification through lawfully accessible records, authorised providers or permitted interfaces with relevant authorities, which may include CIPC, Home Affairs, SARS and publicly available FIC resources where the relevant service and lawful access exist. The service notice identifies the check, source or provider category and information submitted and received. User consent does not create access rights to restricted databases.
To provide selected document-extraction, readiness and electronic-signing features: an applicable section 11 ground, including contractual necessity where the data subject is a party to the relevant contract, or an appropriately assessed legitimate interest. Extracted fields, matches and readiness indicators assist review and may require correction; they do not establish identity, document authenticity or an institution’s compliance. The feature notice explains material processing, the relevant provider and recipients, and the information needed to use the feature.
To secure the platform, prevent fraud and abuse (legitimate interest).
To administer subscriptions, credit purchases, credit usage, payments, refunds and collections: contractual necessity, applicable legal obligations or legitimate interests where appropriate.
FICME identifies an applicable lawful basis for each processing activity. Where consent is relied upon, we retain evidence; where another ground applies, acknowledgement of this policy is not a substitute for meeting its requirements. Further processing must comply with POPIA, including purpose compatibility.
Where a requested service processes special personal information or children’s information, or involves a solely automated decision with legal or substantial effects, the relevant service notice identifies the processing and applicable safeguards. We assess the applicable requirements of sections 26–35, 57–58 and 71 of POPIA before enabling the affected processing and obtain prior authorisation where required. Ordinary identity verification does not, by itself, require prior authorisation. Screening for criminal behaviour or objectionable conduct on behalf of third parties requires a separate assessment; not storing the resulting report does not remove the processing from POPIA. The General Privacy Statement explains our general approach to these requirements.
Who we share it with
We distinguish user-directed compliance-document sharing from necessary service-provider access and legally justified disclosures. We disclose information only for an identified lawful purpose and to the extent reasonably necessary, to the following recipients:
Subscribing accountable institutions that you specifically approve through the platform’s sharing process, with an audit trail identifying the authorised recipient and information shared.
Service providers that host, secure or support the platform, deliver communications, process payments, carry out permitted verification or provide necessary support and lawfully enabled analytics. Operators acting on our instructions are subject to written confidentiality and security obligations. Providers determining their own purposes and means remain responsible parties for their activities.
Regulators, courts, law enforcement, legal advisers or other recipients where disclosure is required by law or otherwise supported by an applicable lawful basis and appropriate safeguards.
We do not sell personal information or permit recipients to use compliance documents for their own unrelated marketing. Necessary disclosure to deliver a paid service is governed by the purposes, lawful grounds and safeguards described in these policies.
Uploading information does not make it public or authorise its inclusion in public directories or profiles. Compliance-document sharing through FICME remains subject to the identified subscribing accountable institution, scope and authorisation controls in this policy.
User-directed document sharing requires authorisation through the applicable authentication process, including OTP or another secure method where implemented. We record its recipient, scope and duration. Authentication is evidence of a process step and does not by itself establish authority to represent another data subject. Necessary operator access and legally justified disclosures are governed separately above.
You choose the information you upload and authorise for sharing, subject to applicable law and your authority to act for others. You may revoke ongoing sharing authorisation through the available controls or privacy@ficme.app. We give effect to withdrawal as soon as reasonably practicable and stop further disclosure under that authorisation. Withdrawal does not guarantee interruption of a transfer already completed or in progress before withdrawal takes effect and cannot retrieve copies already lawfully downloaded or override a recipient’s independent lawful retention duties. Necessary operator access and legally justified disclosures are governed separately by this policy and the General Privacy Statement.
When you authorise the release of your personal information or supporting documents to a subscribing accountable institution, that institution may use FICME’s add-on verification services to verify the information supplied and conduct relevant customer due diligence checks. Depending on the service requested and lawfully available, these may include identity and CIPC verification, sanctions and watchlist screening, and searches of relevant publicly available adverse media. Checks are conducted through lawfully accessible records, authorised service providers or permitted interfaces with relevant authorities, which may include CIPC, the Department of Home Affairs, SARS and publicly available Financial Intelligence Centre resources. The applicable service notice identifies the nature and purpose of the check, the source or provider category, and the information submitted and received. Verification results are presented to the requesting institution in a report through the FICME app, which the institution may download and retain; FICME does not store that report. The institution remains responsible for assessing the results and fulfilling its own legal obligations. Your authorisation to release information does not constitute unrestricted consent to every form of screening: each check remains subject to an applicable lawful basis and any additional consent, notice or regulatory authorisation required by law. Neither your authorisation nor the availability of a service through FICME creates a right to access restricted databases.
Repeated, bulk or ongoing checks remain subject to the notified purpose, an applicable lawful basis and any required consent or authorisation for each affected person. An authorisation to share documents is not unlimited permission to screen every person connected to an entity. An institution must review results, including possible false matches or outdated information, before relying on them. It must download and securely retain any report needed for its own records while access is available.
Written operator agreements require authorised processing, confidentiality, appropriate security and immediate notification to FICME where an operator has reasonable grounds to believe that information has been accessed or acquired by an unauthorised person. We take reasonable steps to assess and oversee the relevant safeguards.
Authorised personnel and providers may access information where reasonably necessary for the identified service, security, support or another lawful purpose, subject to access controls and confidentiality. This applies to email-to-vault processing where that feature is used; it is not a promise that no person can ever access submitted information.
We assess the legal authority and scope of requests from authorities before disclosure. We notify affected persons where lawful and appropriate; the law may prohibit or permit delayed notification. An informal request does not automatically compel disclosure.
Cross-border transfers
Where we transfer personal information outside South Africa, including through hosting, backups or remote support, we establish an applicable ground under section 72 of POPIA before transfer. Where we rely on the recipient’s law, binding corporate rules or binding agreement, the protection must be adequate and substantially similar to POPIA, including restrictions on onward transfers. We give the information about intended transfers and the level of protection required by section 18 through this notice and applicable supplementary notices. Details of relevant locations, recipient categories and safeguards are available from privacy@ficme.app. Transfers of children’s or special personal information are also assessed against section 57(1)(d).
Retention
We retain information only as long as necessary for its identified lawful purpose or otherwise permitted or required under section 14 of POPIA. Retention criteria differ for uploaded documents, signed documents and signing evidence where applicable, consent and sharing records, security logs and billing, credit and refund records. FICME does not store the verification report described above. Audit-trail integrity does not mean that audit records are kept indefinitely. We restrict access and securely delete or effectively de-identify information when retention is no longer justified.
Cancelling a subscription is different from closing an account. The Cancellation and Refund Policy governs subscription cancellation, which may move the account to the free plan without deleting its content.
On a confirmed account-closure request, we ordinarily provide a 30-day export window beginning when we notify you that the request is confirmed. We then delete or effectively de-identify account content unless further retention is lawfully justified, for example by a statutory obligation or an appropriately assessed need to establish, exercise or defend a legal claim. Retention is limited to the relevant purpose and records. Backups are isolated from ordinary use and removed through the applicable deletion cycle; deletion controls also apply on restoration. The ordinary export window does not postpone deletion, restriction or other action required sooner by law. We explain any lawful retention exception and relevant access consequences when handling the request.
Copies already received by an institution are subject to its independent lawful retention duties. Closing a user’s account does not authorise destruction of copies the institution must lawfully retain in its own records.
FICME facilitates the authorised availability and sharing of compliance documents through its platform.
FICME does not undertake an accountable institution’s statutory record-keeping duties and is not appointed as a third-party record keeper under section 24 of the Financial Intelligence Centre Act, 38 of 2001. Each subscribing accountable institution remains responsible for obtaining and downloading the documents and information it requires while authorised access is available, and for maintaining its own complete, legible, secure and retrievable records for the periods prescribed by applicable law. An institution must not rely on continued availability of documents on the FICME platform to fulfil these obligations. Expiry or withdrawal of platform access, termination of a subscription, closure of an account or deletion of documents from the platform does not relieve an institution of its independent record-keeping obligations. FICME’s retention of information for its own lawful processing purposes remains governed by its privacy policies and applicable law.
Security
FICME maintains appropriate, reasonable technical and organisational safeguards against loss, damage, unauthorised destruction and unlawful access or processing. Measures include role-based access, secure authentication, encryption appropriate to the information and risk, activity logging, security monitoring and time-limited sharing controls. We identify reasonably foreseeable risks, implement safeguards, regularly verify their effectiveness and update them as risks or deficiencies arise.
No system is perfectly secure. Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we notify the Information Regulator and affected data subjects as required by section 22 of POPIA, as soon as reasonably possible after discovery and subject to its statutory qualifications and exceptions. There is no additional materiality threshold. Notifications include the information required by law to assist affected data subjects to take protective measures.
Cookies
See our Cookie Policy for the technologies, providers, purposes, durations and available choices, and the General Privacy Statement for our general rules on analytics and direct marketing. Essential functionality is distinguished from optional tracking. Where consent is the applicable basis, the relevant optional processing starts only after consent and may be stopped through the available controls.
Children
FICME is not intended for children to operate independent accounts, but authorised adults may submit information about minor beneficiaries or other children for a lawful service purpose. We process children’s information only where authorised by section 35 of POPIA, including prior consent of a competent person under section 35(1)(a) where applicable.
A submitter must have authority and establish the applicable authorisation for processing a child’s information. Where consent is relied upon, it must be given beforehand by a competent person as defined in POPIA. Authority to represent a trust or company does not automatically include authority to consent for a child. Any special personal information about a child must also satisfy the applicable sections 26–33 requirements.
Where prior competent-person consent is the applicable authorisation, it must be obtained before the child’s personal information is submitted or otherwise processed for the service, including capture of an identity number. A later consent step does not retrospectively authorise earlier processing.
You must provide evidence of the relevant authority or consent on reasonable request. FICME applies proportionate checks and may restrict processing or request further evidence where authority is unclear. These assurances do not displace FICME’s own duties. Any contractual liability for an unlawful submission is governed by the applicable Terms of Service and law.
Your rights
Under POPIA you may:
ask free of charge whether we hold personal information about you and request access, subject to lawful procedures and limitations;
request correction or deletion of inaccurate, irrelevant, excessive, outdated, incomplete, misleading or unlawfully obtained information, and deletion or destruction of information we are no longer authorised to retain;
object to processing on the grounds and in the circumstances provided by POPIA, including applicable legitimate-interest processing and direct marketing, and request restriction where section 14(6) applies;
withdraw consent for future consent-based processing without affecting the lawfulness of earlier processing. We explain any service consequences and identify any separate lawful basis for limited continued processing;
complain to the Information Regulator without first having to exhaust FICME’s internal complaint process. Current procedures are available at https://inforegulator.org.za/complaints/; POPIA complaints: POPIAComplaints@inforegulator.org.za; telephone: 010 023 5200.
To exercise these rights, contact privacy@ficme.app or use the contact channels and procedures in the General Privacy Statement and / or our PAIA Manual. We may require proportionate proof of identity and authority. Correction, deletion and objection requests are handled free of charge under POPIA and the applicable Regulations; any access fee must be legally permitted and disclosed in advance. You need not hold a FICME account to exercise rights relating to your information.
Consent and Authorisation
Subscribing accountable institutions receive compliance information for the authorised customer due diligence purpose and remain responsible for the lawfulness, security and retention of their own processing. Further use must comply with POPIA, including purpose compatibility, or another applicable statutory authorisation or valid consent. Recipient obligations must also be reflected in the applicable subscriber agreement.
Information is obtained from data subjects, persons lawfully submitting it, permitted public records and authorised verification sources described in the applicable service notice. We do not access restricted sources without lawful authority. For indirect collection, we take reasonably practicable steps to notify affected data subjects before or as soon as reasonably practicable after collection unless a lawful exception applies. A submitter may assist, but FICME remains responsible for its own compliance.
Subscribers and users must:
take reasonable steps to supply complete, accurate and up-to-date information and notify us of corrections;
ensure that information about others is submitted with the necessary authority and on an applicable lawful basis;
authorise sharing only with identified subscribing accountable institutions and within the scope of their authority;
provide a fresh sharing authorisation unless an ongoing authorisation has been expressly selected. Ongoing authorisation must identify the recipient, information covered, whether future updates are included, and its duration or expiry, and must be capable of withdrawal;
recognise that revocation does not automatically retrieve information already lawfully disclosed or override independent retention duties; and
recognise that FICME facilitates document and verification services but does not determine whether an institution has fulfilled its own FICA duties. This does not limit FICME’s responsibility for its own services and processing.
Changes to this Policy
We may update this policy to reflect lawful changes to our processing practices. We publish the revised version and its effective date and give appropriate direct notice of material changes by email, in the app or through another suitable channel. Where a change requires fresh consent or further notification, we obtain that consent or provide that notice before the affected processing begins. Posting an amended policy does not retrospectively authorise processing or remove accrued rights.
General Privacy Statement
This Core Privacy Policy addresses processing through the FICME platform for compliance-document collection, verification, storage and authorised sharing, and related document-extraction, readiness and electronic-signing features where selected, together with the account, security and billing activities needed to deliver those services.
The General Privacy Statement addresses FICME’s general POPIA responsibilities across its business, including employment, recruitment, procurement, professional services, ordinary business communications and other relationships. It also supplies the general safeguards and rights procedures applicable to platform processing.
The General Privacy Statement is available under Legal Notices on our website and on request at privacy@ficme.app. Both documents must be made reasonably accessible to affected data subjects, including individuals whose information is submitted by someone else.
This policy must be read with the General Privacy Statement and any applicable collection or service notice. Cross-references do not replace the information and notification required at the relevant time under POPIA.
The General Privacy Statement sets out FICME’s general POPIA responsibilities and practices across its business. The Core Privacy Policy supplements it with specific rules for the FICME platform and its core services. Both documents must be read together. The specific platform rules govern those activities, while the general safeguards continue to apply. General provisions on recipients, marketing, research or business operations do not authorise use or disclosure of compliance documents outside the purposes and controls in the Core Privacy Policy. Neither document limits applicable law or data subject rights.
Authority to Submit and Disclose Personal Information
Where you submit or share personal information relating to yourself or another person or organisation, you represent, warrant and undertake that you will:
have authority to submit it and, where applicable, act for the organisation concerned;
ensure that your collection and disclosure comply with POPIA and laws applicable to your activities;
obtain required consent or other authorisation before submission and provide relevant privacy information where required;
distinguish organisational authority from authority to consent for associated individuals, including directors, trustees, beneficiaries, beneficial owners and employees. Where you do not represent an individual, establish another applicable lawful basis for that individual’s information;
take reasonable steps to provide complete, accurate and up-to-date information and correct it where necessary; and
provide reasonable evidence of authority, consent or the applicable lawful basis on request, including for children’s information.
FICME may reasonably rely on a submitter’s assurances, but remains responsible for its own lawful processing. We apply proportionate checks, request evidence where appropriate and investigate indications of unauthorised or unlawful submissions. We may restrict access or suspend affected processing while a concern is investigated, subject to applicable law. Where consent is relied upon, we retain appropriate evidence of that consent.
Any contractual remedies for a user’s unlawful submission or breach are governed by the applicable Terms of Service and law. Nothing in this notice excludes FICME’s statutory responsibility, transfers liability for its own unlawful conduct to a data subject or limits a data subject’s rights against FICME.