PROCESSING NOTICE IN TERMS OF SECTION 18 OF THE PROTECTION OF PERSONAL INFORMATION ACT, NO. 4 OF 2013
PURPOSE OF THIS STATEMENT
We, FICME (Pty) Ltd (registration number 2026/646530/07), referred to as “we”, “us”, “the Company”, “the Organisation” or “FICME”, process personal information when conducting our business and interacting with data subjects. We act as a responsible party for the processing whose purposes and means we determine and must comply with the Protection of Personal Information Act, 4 of 2013 (“POPIA”). This Statement explains our general processing practices and supports the notification required by section 18 of POPIA.
For the purpose of this Processing Notice, please take note of the following words and phrases which will be used throughout this Processing Notice:
“Consent” means a voluntary, specific and informed expression of will permitting identified processing of personal information. Where consent is relied upon, we obtain and retain evidence of it. Acknowledging this Statement, silence or merely providing information does not automatically establish valid consent to every use. Additional formalities applicable to particular processing, including electronic direct marketing, must also be met.
“Data Subject” means the person to whom personal information relates, including an identifiable living natural person or an identifiable existing juristic person. The person submitting information is not necessarily the data subject.
“Operator” means a person who processes personal information for a responsible party under a contract or mandate without coming under that party’s direct authority. A provider’s role depends on the actual processing. An auditor, legal practitioner, verification provider, payment provider or public authority is not automatically an operator and may be a separate responsible party for its own activities.
"Personal Information", means Personal Information relating to any identifiable, living, natural person, and an identifiable, existing juristic person, including, but not limited to:
your name, address, contact details, date of birth, place of birth, identity number, passport number, bank details, details about your employment, tax number and financial information;
vehicle registration;
dietary preferences;
financial history;
information about your next of kin and or dependants;
information relating to your education or employment history; and
“Special Personal Information” means information concerning religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information, or criminal behaviour relating to alleged offences or related proceedings or their disposal, as contemplated in section 26 of POPIA. Other information, such as nationality or gender, is personal information but is not automatically special personal information. An ordinary photograph or recording is not automatically a biometric identification technique.
"processing" / “process” or processed” means in relation to Personal Information, the collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use; dissemination by means of transmission, distribution or making available in any other form; merging, linking, as well as restriction, degradation, erasure or destruction of information; or sharing with, transfer and further processing, including physical, manual and automatic means. This is a wide definition and therefore includes all types of usage of your Personal Information by us including the initial processing when we first collect your Personal Information and any further and ongoing processing;
“Purpose” means the reason why your Personal Information needs to be processed by us;
“Responsible Party” means a public or private body or other person which, alone or together with others, determines the purpose of and means for processing personal information. FICME is the responsible party for its platform operations and general business processing described here; other organisations remain responsible for their own processing.
“You” means the relevant data subject, whether information is collected directly from you or lawfully obtained from another source.
In terms of POPIA, where a person processes another’s Personal Information, such processing must be done in a lawful, legitimate and responsible manner and in accordance with the provisions, principles and conditions set out under POPIA.
In order to comply with POPIA, a person processing another’s Personal Information must:
take reasonably practicable steps to notify the data subject of the information required by section 18 before direct collection, or before or as soon as reasonably practicable after indirect collection, unless an applicable exception permits otherwise; and
get permission or consent, explicitly or implied, from the Data Subject, to process the Personal Information and establish an applicable ground under section 11 for each processing activity. These grounds include valid consent or processing that:
is necessary to carry out actions for the conclusion or performance of a contract to which the owner / Data Subject of the Personal Information is a party;
complies with an obligation imposed by law on the responsible party;
protects a legitimate interest of the data subject, or is necessary to pursue the legitimate interests of the responsible party or a third party to whom the information is supplied, subject to POPIA and the applicable right to object; or
is necessary for the proper performance of a public-law duty by a public body. FICME does not assume this ground applies merely because it supplies a service to a public body.
A lawful purpose alone is not a substitute for a section 11 ground. Special personal information and children’s information require an applicable authorisation under sections 26–35 in addition to the general processing conditions. We limit collection to information that is adequate, relevant and not excessive, maintain information quality through reasonable steps and assess whether further processing is compatible with the identified purpose.
1.6 Children and special personal information: we establish the applicable authorisation under sections 27–33 or section 35 before processing. Where consent for a child is relied upon, it must be given beforehand by a competent person as defined in POPIA. For special personal information about a child, both sets of requirements apply. We retain evidence, apply proportionate authority checks and limit access and retention. The Core Privacy Policy addresses information about minor beneficiaries and other children submitted through the platform.
1.7 Prior authorisation and automated decisions: we assess any processing falling within sections 57–58, including specified identifier-linking, criminal or objectionable-conduct processing for third parties, credit reporting and certain foreign transfers of children’s or special information. We do not begin processing requiring prior authorisation until the applicable requirements are met. Any solely automated decision with legal or substantial effects must meet section 71 and its applicable safeguards, including an opportunity to make representations where required.
APPLICATION
This General Privacy Statement applies to all personal information processed by FICME, whether in connection with the use of the FICME platform or otherwise in the ordinary course of our business and operations. Accordingly, it applies not only to users, subscribers and other persons whose information is processed through the platform, but also, where applicable, to employees, applicants, contractors, service providers, professional advisers, representatives of regulators and public bodies, and any other data subjects with whom FICME interacts.
This General Privacy Statement sets out FICME’s general POPIA responsibilities and practices across its business. The Core Privacy Policy supplements it with specific rules for the FICME platform and its core services. Both documents must be read together. The specific platform rules govern those activities, while the general safeguards continue to apply. General provisions on recipients, marketing, research or business operations do not authorise use or disclosure of compliance documents outside the purposes and controls in the Core Privacy Policy. Neither document limits applicable law or data subject rights.
This Privacy Statement applies to the following persons:
Interactors: persons who interact with us, physically or via email or via our websites, applications, mobile applications, or social media portals or platforms, or who come onto our sites and / or who enter our offices or facilities.
Users of our Sites: persons who use our websites, applications, mobile applications, or social media portals or platforms whether in order to find out more about us, to make enquiries about us, or our products or services or where persons want to do business with us be it providing or selling to us or receiving or buying from us, certain goods and services, etc.
Employees, Applicants, Interns: persons who are employed by us and / or wish to apply for a vacant position, employment opportunity , internship, or a sponsorship from us.
Customers, Clients and Subscribers: persons who enquire about, purchase, subscribe to or use our products or services, or communicate with us about them. Receipt of a service does not automatically authorise unrelated marketing.
Contractors, Vendors and Service Providers: persons who are desirous of, or who do provide us with goods, and services, or who we provide goods and services to, including consultancy and infrastructure related services and who we interact and communicate with, either physically or via email or via our websites, applications, mobile applications, or social media portals or platforms, and / or who come onto our sites, facilities and / or who enter our offices.
Regulators and Public Bodies: representatives of bodies with which we lawfully interact, including but not limited to SARS, relevant labour authorities, the Financial Intelligence Centre, the Department of Home Affairs and CIPC, where relevant to our activities and obligations.
Business partners: whether in their capacity as operators or not, who provide services, goods and other benefits to us, our employees or to our customers, clients and service providers, such as medical aids, pension or provident funds, administrators, financial service providers, advertising, marketing or PR agencies, wellness or health and medical providers.
PURPOSE FOR PROCESSING YOUR PERSONAL INFORMATION
The purposes below apply only where relevant to your relationship with FICME. We identify an applicable lawful basis, the information needed and any additional conditions for the particular activity. A contract with an organisation does not, by itself, establish contractual necessity for information about individuals who are not parties to that contract.
Core Business Purpose: platform-based collection, verification, storage and authorised sharing of compliance documents, and the account, security and billing functions supporting those services. The Core Privacy Policy supplies the specific purposes, sources, authorisation controls and retention arrangements; this Statement does not broaden those permissions.
Due diligence: to assess relevant qualifications, business credentials, financial standing or other proportionate information before engagement, on an applicable contractual, legal or legitimate-interest basis. Checks are limited to those necessary for the relationship and use lawfully accessible sources. Medical, criminal, biometric and other special-information checks require the applicable additional authorisation; they are not routine checks for every relationship.
Contract assessment and conclusion: to take steps necessary to conclude a contract to which the data subject is a party, or on another applicable lawful basis where information concerns representatives or other persons. Any due diligence must meet the safeguards above.
Service delivery and procurement: to provide or receive agreed goods or services, administer contracts, communicate instructions and requirements, respond to queries or complaints and exercise contractual rights. Processing must be necessary for the relevant contract or supported by another applicable lawful basis.
Financial administration: to administer registrations, subscriptions, credit purchases, balances, usage, refunds, fees, quotations, invoices, payments, reconciliations and accounting records. Grounds include contractual necessity, applicable tax or accounting obligations and legitimate interests where appropriate. The Core Privacy Policy addresses platform-specific billing records.
Communications: to respond to enquiries and provide necessary business or service communications on the applicable contractual, legal or legitimate-interest basis. Platform document sharing follows the specific authorisation process in the Core Privacy Policy. That process is distinct from necessary operator access and legally justified disclosures. We retain appropriate authorisation and access records.
Risk management: to detect and prevent fraud, bribery, corruption, abuse and security incidents, protect lawful rights and property and investigate concerns. Processing relies on an applicable legal obligation or legitimate interest and must be necessary and proportionate. Criminal or adverse-conduct screening is subject to any additional POPIA authorisation and prior-authorisation requirements.
Legal obligations and claims: to comply with obligations actually applicable to FICME, including relevant tax, employment and regulatory requirements; establish, exercise or defend legal claims; and respond lawfully to court orders or authorised regulatory requests. We assess the authority, basis and scope of requests. A request from an official does not automatically require disclosure.
Premises and information security: to control authorised access, protect people, premises and systems and respond to emergencies or cyber incidents, on an applicable legal or legitimate-interest basis. Where CCTV or other monitoring is used, the relevant collection point must identify it and provide an appropriate notice. Monitoring is limited to an identified purpose and proportionate scope.
Direct marketing: to send promotional communications where permitted by section 69 of POPIA and applicable consumer law. We obtain consent where required; for the existing-customer exception we meet its conditions, including marketing our own similar products or services and offering an opportunity to object at collection and in each communication. We identify the sender and provide a means to stop marketing without charge other than the cost of transmission. Failure to opt out is not consent. Essential service notices are treated separately.
Research and improvement: to assess and improve our services using effectively de-identified information where practicable. Use of identifiable information requires an applicable lawful basis, a specific purpose and compliance with further-processing limitations. This provision does not authorise unrelated research on compliance documents or training general-purpose AI models on their contents. Any materially different proposed use requires its own assessment and appropriate notice and consent where required.
Business restructuring: to assess or implement a proposed merger, acquisition or business transfer where supported by a lawful basis. Disclosure is limited to what is necessary, with de-identification or redaction where practicable, confidentiality and appropriate security safeguards. A transaction does not automatically authorise a recipient to use information for unrelated purposes or override the Core Privacy Policy’s restrictions.
WHAT PERSONAL INFORMATION OR INFORMATION DO WE COLLECT FROM YOU?
The categories below describe information that may be relevant across different relationships; they are not a mandatory checklist for every data subject. We identify the information needed at the collection point, whether it is voluntary or mandatory, any particular law requiring it and the consequences of non-provision. We do not collect every category from every person.
Platform compliance information: identification, registration, address, tax-registration or tax-status, ownership and control information and verification results, as applicable to the selected service and described in the Core Privacy Policy.
Contact and relationship information: names, business and personal contact details, organisational roles, relevant professional affiliations and representatives’ details needed for the applicable relationship. Visitor or vehicle details are collected only where necessary for an identified premises-security purpose.
Special personal information and children’s information: only the relevant information lawfully needed for a defined purpose, such as employment-equity obligations, necessary workplace accommodations, benefits administration or an authorised verification service. General contractual necessity or legitimate interests alone do not remove the additional protections in sections 26–35. We do not routinely request a person’s sexual history or unrelated medical or criminal details.
Account and authentication information: usernames, password hashes, authentication methods, roles, account profiles and service history; and billing, bank or payment-reference information relevant to transactions. We do not require users to disclose their passwords to support personnel. Payment providers’ access and roles depend on the payment service, as described in the Core Privacy Policy.
User Content, such as content of communications, suggestions, questions, comments, feedback, and other information you send to us, that you provide to us when you contact us, or that you post on our websites, applications, mobile applications, or social media portals or platforms including information in alerts, folders, notes, and shares of content), and similar data which are required to perform contractual matters and / or in order to provide you access to services or attend to queries.
Device and browser information: IP address, browser and device characteristics, operating system and technical logs needed for functionality, security or an identified analytical purpose. Cookie or advertising identifiers are processed only where actually used and lawfully justified under the applicable Cookie Policy and consent controls.
Usage and interaction information: service usage, errors, diagnostic events, settings, access and sharing logs, and relevant website interactions. Optional analytics, email tracking or advertising measurements require a separately identified purpose and lawful basis; they are not automatically necessary to perform a contract. The Cookie Policy describes the technologies actually deployed.
Location information: address information supplied for the relevant relationship and approximate location inferred from technical data where needed for security or service operation. Precise device location is collected only where a specific feature requires it, with appropriate notice, a lawful basis and any required device permission.
Demographic information: relevant age, date of birth, language, nationality or other demographic details needed for a specific service, employment, benefits or legal purpose. Collection is limited to what is necessary; special-information safeguards apply where relevant.
Images and recordings: identification images, authorised communications recordings, event images or security footage only where relevant and notified. Biometric identification or matching requires the additional assessment and authorisation applicable under POPIA.
Identity information: relevant identity, passport, registration or tax identifiers needed for a specific lawful purpose. Use of identifiers for linking information held by other responsible parties is assessed against section 57 where applicable.
Financial information: relevant bank, billing, payment, tax and VAT details needed to administer transactions, comply with law or address related claims. Credit assessments are performed only for a defined lawful purpose and with any additional requirements that apply.
Recruitment and employment information: relevant applications, qualifications, references, work experience, professional registrations, work eligibility, remuneration and performance records needed for recruitment, employment, payroll, benefits or applicable law. We do not routinely collect unrelated personal history.
Health and assessment information: only information necessary and lawfully authorised for a defined employment, accommodation, benefits or other permitted purpose. Access is restricted. Medical or psychological testing must also comply with applicable employment legislation; a general consent clause does not override those requirements.
Public or social-media information: only information relevant to an identified lawful purpose and obtained through a permitted source. Public availability does not remove POPIA’s requirements or authorise unrestricted profiling, marketing or republication.
SOURCES OF INFORMATION - HOW AND WHERE DO WE COLLECT YOUR PERSONAL INFORMATION FROM?
We collect information directly where required by section 12 of POPIA. Indirect collection is limited to circumstances permitted by that section. We identify relevant sources and take reasonably practicable steps to notify affected data subjects before or as soon as reasonably practicable after indirect collection unless a lawful exception applies. The following sources are used only where relevant to the identified purpose:
Direct collection: You provide personal information to us when you:
Use our websites, applications, mobile applications, or social media portals or platforms.
Interact with us.
Enquire about, or search for our services.
Create or maintain a profile or account with us.
Conclude a contract with us.
Purchase or subscribe to our services.
Use our services.
Purchase, use, or otherwise interact with content, products, or services from third party providers who have a relationship with us.
Create, post, or submit user content on our websites, applications, mobile applications, or social media portals or platforms.
Register for or attend one of our events or locations.
Request or sign up for information, including marketing material.
Communicate with us by phone, email, chat, in person, or otherwise.
Complete a questionnaire, survey, support ticket, or other information request form.
When you submit a quotation, or offer to do business with us, a tender or when you conclude a contract with us.
When you express an interest in an employment position, internship or sponsorship.
Automatic collection: relevant technical or interaction information may be collected automatically in the circumstances below, subject to the purposes, lawful grounds and choices described in this Statement, the Core Privacy Policy and the Cookie Policy:
Search for, visit, interact with, or use our websites, applications, mobile applications, or social media portals or platforms.
Use our services (including through a device).
Access, use, or download content from us.
Open emails or click links where tracking is actually used and has been appropriately notified and lawfully enabled; optional tracking is not a condition of receiving essential service notices.
Otherwise interact or communicate with us (such as when you attend one of our events or locations, when you request support or send us information, or when you mention or post to our social media accounts).
Collection from third parties: where permitted by section 12 and supported by an applicable processing ground, we may obtain relevant information from:
Your organization and others with whom you have a relationship with that provide or publish personal information related to you, such as from our customers or from others when they create, post, or submit user content that may include your personal information.
Regulators, professional or industry organizations and certification / licensure agencies that provide or publish personal information related to you.
Third parties with a relevant relationship to FICME or the data subject, only where their disclosure and our collection are lawful.
Service providers and business partners who work with us and that we may utilize to deliver certain content, products, or services or to enhance your experience.
Recruitment or marketing providers, only for a defined lawful activity. Acquisition of contact details does not itself authorise unsolicited electronic marketing.
Authorised verification providers, permitted authority interfaces or lawfully accessible public records, including relevant CIPC, Home Affairs, SARS or FIC resources where actual lawful access exists. Checks involving SAPS or credit bureaus require a specific permitted service and compliance with applicable access conditions. Consent does not create access rights to restricted databases.
Government agencies, regulators and others who release or publish public records.
Lawfully accessible public records, websites or other sources, only to the extent relevant and necessary. We do not treat public availability as blanket permission to compile or publish personal profiles.
HOW WE SHARE INFORMATION
We disclose information only for an identified lawful purpose and to the extent reasonably necessary. The recipient categories below do not authorise every recipient to receive every type of information. Platform compliance-document sharing remains subject to the specific controls in the Core Privacy Policy. Necessary operator access and legally justified disclosures are distinct from user-directed sharing.
Subscribing accountable institutions: compliance documents are shared with specifically approved subscribing institutions through the authorisation process in the Core Privacy Policy. Authority to represent an organisation does not automatically establish consent for every individual named in a document. Institutions remain responsible for their own lawful processing and retention.
Authorised personnel: employees and contractors may access information on a need-to-know basis for their duties and subject to confidentiality and access controls. Any disclosure to a separate group entity requires its own lawful purpose and basis; group membership alone does not justify access.
Your organisation and authorised representatives: relevant information may be disclosed where necessary for a lawful contractual, employment or other identified purpose and within the recipient’s authority. Being in the same organisation, paying a subscription or appearing in someone’s contacts does not automatically give access to that person’s compliance documents or other private information.
Business partners: limited relevant information may be shared to deliver an agreed service or respond to an authorised request, on an applicable lawful basis. Any independent marketing use requires separate compliance with the applicable marketing rules and cannot override the restrictions on compliance documents.
Content or benefit providers: only where relevant to the actual relationship and a lawful purpose, such as administering an employee benefit. Health or other special information is disclosed only under an applicable authorisation and appropriate confidentiality safeguards.
Service providers: providers of hosting, communications, payments, verification, professional advice, employment administration or support may receive the information needed for the relevant service. We distinguish operators processing on our instructions from providers acting as separate responsible parties for their own activities.
Technical providers: access for support, development, testing or security is limited to what is necessary and lawfully justified. We use de-identified or synthetic test data where practicable and restrict production-data access. Optional tracking or profiling is not automatically authorised by a technical support arrangement.
Advertising providers: where an advertising activity is lawfully implemented and appropriately notified, we disclose only the information necessary for that activity and obtain consent where required. Compliance documents, identity-verification results and confidential vault contents are not disclosed for advertising, audience matching or unrelated profiling. Recipients may not use those documents for their own unrelated marketing.
Users: Personal information uploaded to FICME is not made publicly available merely because it has been submitted to the platform. If FICME offers an optional review, comment or other posting feature, the intended audience will be clearly identified before publication, and information will be displayed only within the scope of your authorised posting and subject to applicable law. You may include another person’s personal information only where you have the necessary authority and a lawful basis to disclose it. This Statement does not authorise FICME to aggregate personal information into public directories or profiles. Sharing of private compliance documents with subscribing accountable institutions remains subject to the purposes, authorisation requirements and access controls set out in the Core Privacy Policy.
A prospective or actual business acquirer: disclosure is subject to the restructuring safeguards described above. A successor must honour applicable privacy obligations and established purpose restrictions, and any new use requires its own lawful basis and appropriate notification.
Authorities and legal recipients: disclosure to regulators, courts, law enforcement or advisers occurs where required by law or otherwise supported by an applicable lawful basis. We assess the request’s legal authority and scope and do not assume that every request compels disclosure. We notify affected persons where lawful and appropriate; the law may prohibit or permit delayed notification.
We do not sell personal information or permit recipients to use compliance documents for their own unrelated marketing. Necessary disclosure to deliver a paid service is governed by the purposes, lawful grounds and safeguards described in these policies. The Core Privacy Policy supplies the detailed rules for compliance-document processing. These specific rules are not displaced by the general recipient categories above.
SECURITY OF INFORMATION
We maintain appropriate, reasonable technical and organisational safeguards, taking account of the information, purposes and reasonably foreseeable risks. We identify risks, implement safeguards, regularly verify their effectiveness and update them when risks or deficiencies change. Relevant measures include controlled access, secure authentication, appropriate encryption, logging, monitoring and staff confidentiality obligations.
Your Personal Information will be stored electronically which information, for operational reasons, will be accessible to persons employed or contracted by us on a need-to-know basis, save that where appropriate, some of your Personal Information may be retained in hard copy.
We retain personal information only for as long as necessary for the identified purpose or otherwise permitted or required under section 14 of POPIA. Our retention schedule distinguishes record categories and the relevant event from which a period runs. A recommended industry period, an internal schedule or a general wish to retain information does not independently justify unnecessary retention. Where an applicable legal obligation, lawful contractual requirement, consent or a properly assessed need for a claim justifies retention, we limit the records and access to that purpose. When retention is no longer justified, we securely delete or effectively de-identify the information. Platform account closure, the proposed 30-day export period, backups and any statutory record-keeping arrangement are addressed specifically in the Core Privacy Policy.
ACCESS BY OTHERS AND CROSS BORDER TRANSFER
Persons acting under our authority must respect confidentiality and authorised processing limits. Operators are bound by written agreements addressing instructions, confidentiality, section 19 security measures and immediate notification to FICME of suspected unauthorised access or acquisition. We take reasonable steps to oversee the relevant safeguards. Independent responsible parties, including some professionals and authorities, process under their own applicable duties; disclosure to a regulator is not conditional on that regulator signing our commercial confidentiality agreement.
Where we transfer personal information outside South Africa, including through hosting, backups or remote support, we establish an applicable ground under section 72 of POPIA before transfer. Where we rely on the recipient’s law, binding corporate rules or binding agreement, the protection must be adequate and substantially similar to POPIA, including restrictions on onward transfers. We give the information about intended transfers and the level of protection required by section 18 through this notice and applicable supplementary notices. Details of relevant locations, recipient categories and safeguards are available from privacy@ficme.app. Transfers of children’s or special personal information are also assessed against section 57(1)(d).
No method of transmission or storage is perfectly secure. This does not exclude our obligations under POPIA. Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we notify the Information Regulator and affected data subjects as required by section 22 of POPIA, as soon as reasonably possible after discovery and subject to its statutory qualifications and exceptions. There is no additional materiality threshold. Notifications include the information required by law to assist affected data subjects to take protective measures.
YOUR RIGHTS
You as a Data Subject have certain rights, which are detailed below:
Access: after appropriate identity verification, you may obtain free confirmation of whether we hold your personal information and request access to the record or a description, including relevant recipient information. Any fee for providing access must be legally permitted, reasonable and disclosed before the service is provided. The PAIA Manual explains applicable access procedures and lawful refusal grounds; contact the Information Officer if assistance is needed.
Correction: you may request correction or deletion of information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained. Requests under section 24 and the applicable Regulations are free of charge. We take the action required by law and communicate the outcome within the applicable statutory timeframe.
Deletion or destruction: you may request deletion or destruction of information we are no longer authorised to retain under section 14, as well as relief on the grounds described above. POPIA does not create an unrestricted right to erase lawfully retained records. We explain any lawful refusal or limitation and restrict retained information to its justified purpose.
Objection and restriction: you may object on the grounds and in the circumstances in section 11(3), including applicable legitimate-interest processing, and object to direct marketing as provided by law. Where a valid objection requires processing to stop, we stop that processing. We restrict processing where section 14(6) requires it, including relevant disputes about accuracy, evidential preservation or verification of an objection. There is no blanket veto over every processing activity supported by a legal obligation.
Withdrawal of consent: where processing relies on consent, you may withdraw it at any time through the relevant controls or by contacting us. Withdrawal does not affect processing lawfully undertaken before withdrawal. We stop future consent-based processing as soon as reasonably practicable, explain any service consequences and identify any separate lawful basis for limited continued processing. Withdrawal does not itself recover copies already lawfully disclosed or override independent retention duties.
Copies and export assistance: POPIA provides access rights but does not establish a general standalone right to data portability equivalent to that under the GDPR. Where available, FICME may provide export or authorised transfer functionality as a service, subject to identity verification, security and third-party rights. Contact the Information Officer for assistance.
Requests and assistance: contact privacy@ficme.app or the Information Officer using the details below. Objections and correction/deletion requests may be submitted free of charge using a form substantially similar to the applicable Form 1 or Form 2, through reasonably accessible channels under the POPIA Regulations; assistance is available if you cannot use the website. Telephone requests or objections are recorded where the Regulations require it, and the recording or transcript is made available on request as required. We may request proportionate identity or authority evidence, act as soon as reasonably practicable and notify you in writing within the applicable statutory period. We explain any lawful refusal and the complaint route.
CHANGES TO THIS PRIVACY STATEMENT
We may update this notice to reflect lawful changes to our processing practices. We publish the revised version and its effective date and give appropriate direct notice of material changes by email, in the app or through another suitable channel. Where a change requires fresh consent or further notification, we obtain that consent or provide that notice before the affected processing begins.
CONTACT US
Any comments, questions or suggestions about this privacy notice or our handling of your Personal Information should be emailed to privacy@ficme.app. Alternatively, you can contact us at the following postal address or telephone numbers:
Information Officer Details:
Information Officer: Lorraine Oosthuysen
Physical Address: 3 Rose Street, Wellington, Western Cape, 7655
Postal Address: PO Box 899, Wellington, Western Cape, 7654
Telephone Number: +27 21 864 5180
Email address: privacy@ficme.app
Our telephone switchboard hours are 08:00–16:30 Monday to Thursday and 08:00–15:30 on Fridays, South African Standard Time (SAST, UTC+2), excluding public holidays. Written requests may be sent to privacy@ficme.app at any time.
PROCESSING PERSONAL INFORMATION
Where you are authorised to process another person’s information in your work with or for FICME, you must maintain confidentiality, act within the scope of your authority and process it only for the identified lawful purpose. These duties do not make every data subject an employee or operator of FICME.
Employees and persons acting under FICME’s authority must follow applicable internal information-security and processing procedures, this Statement and the Core Privacy Policy where relevant, and promptly report suspected unauthorised processing or security incidents. These requirements do not replace FICME’s own accountability or the separate responsibilities of an independent responsible party.
COMPLAINTS
Should you wish to discuss a complaint, please feel free to contact us using the details provided above.
We handle complaints confidentially to the extent reasonably possible, while allowing the disclosures necessary to investigate, respond and comply with legal or regulatory requirements.
You may complain directly to the Information Regulator about alleged interference with your personal information without first exhausting FICME’s internal complaint process. Current submission procedures and forms are available at https://inforegulator.org.za/complaints/. Contact details include:
POPIAComplaints@inforegulator.org.za;
telephone: 010 023 5200;
website: https://inforegulator.org.za/.
ACKNOWLEDGEMENT AND CONSENT WHERE REQUIRED
This Statement informs you about processing and does not itself obtain blanket consent. When you provide information or acknowledge receipt of this Statement:
You acknowledge that you understand why your Personal Information needs to be processed;
You accept the terms which will apply to such processing, including the terms applicable to the transfer of such Personal Information cross border;
Where consent is required for any processing as reflected in this Processing notice, you agree that we may process this particular Personal Information;
You confirm that you have shared this Processing Notice with employees, contractors, subcontractors, representatives, directors, shareholders or other relevant party and have received from them the required consent to provide us with their respective Personal Information for processing as provided for and described under this Processing Notice, and where consent is required for any processing as reflected in this Processing notice, such persons have agreed that we may process this particular personal information.
Furthermore, should any of the Personal Information concern or pertain to a legal entity whom you represent, you confirm that you have the necessary authority to act on behalf of such legal entity and that you have the right to provide the Personal Information and / or the required permissions in respect of the processing of that Organization or entities’ Personal Information.
CONSEQUENCES OF YOU WITHHOLDING CONSENT OR PERSONAL INFORMATION
We identify mandatory and optional information when collecting it and explain the actual consequences of non-provision. Withholding information genuinely necessary for a service, legal obligation or relationship may prevent the relevant activity. Refusing optional marketing, tracking or another unrelated consent does not by itself prevent access to a service for which that processing is unnecessary. Where processing relies on another lawful ground, we do not present consent as compulsory.
PERMISSION TO PROCESS OTHER THIRD PARTY PROVIDED INFORMATION
16.1 Where you submit personal information about yourself or another person or organisation, you represent, warrant and undertake that:
• you have authority to submit it and, where applicable, to act for the organisation concerned;
• the collection, disclosure and submission of such personal information to FICME complies with the Protection of Personal Information Act, 4 of 2013 ("POPIA"), the Financial Intelligence Centre Act, 38 of 2001 ("FICA"), and all other applicable laws;
• where required by law, you have obtained all necessary consents, permissions, authorisations and approvals from the relevant data subject or from any person lawfully authorised to act on behalf of such data subject, prior to submitting the personal information to FICME;
• where you submit personal information in your capacity as a director, trustee, member, partner, shareholder, beneficial owner, authorised representative, employee, administrator, agent or any other authorised person acting on behalf of a company, trust, partnership, association, legal arrangement or other organisation, you have the necessary authority to do so and to disclose the personal information of the relevant data subjects to FICME;
• all personal information submitted to FICME is, to the best of your knowledge, complete, accurate and up to date at the time of submission, and you undertake to update such information where it becomes inaccurate or incomplete; and
• you shall, upon reasonable request by FICME, provide such documentary proof of the relevant authority, consent or other lawful basis for the disclosure and processing of the personal information as FICME may reasonably require in order to comply with its legal and regulatory obligations.
16.2 You acknowledge and agree that FICME is entitled to rely upon the warranties, representations and undertakings contained in this clause and shall not be obliged to verify your authority or the existence of any consent or other lawful basis before processing the personal information submitted through the FICME platform.
16.3 You indemnify and hold harmless FICME, its directors, officers, employees and agents against any loss, damage, liability, claim, administrative fine, penalty, cost or expense (including reasonable legal costs) arising from or relating to any breach of the warranties, representations or undertakings contained in this clause, or from any unauthorised or unlawful submission or disclosure of personal information by you.