Privacy & Data Protection Policy

1. Information We Collect

We collect personal and financial information strictly necessary to evaluate and originate your South African mortgage application, including:

• Identity & Contact Details: Full legal name, passport or national ID number, residential address, email address, and telephone numbers.
• Financial & Employment Data: Payslips, employment contracts, multi-currency bank statements, tax residency details, assets and liabilities schedules, and credit bureau history.
• Transaction & Technical Data: Payment confirmation references, IP address, browser metadata, and session cookies necessary for platform security and fraud prevention.

2. Purpose & Lawful Basis for Processing

Your personal information is processed exclusively for explicit, lawful purposes consented to by you or required by South African statute:

• Conducting statutory affordability assessments under the National Credit Act No. 34 of 2005 (NCA);
• Performing customer due diligence, identity verification, and anti-money laundering (AML/KYC) screening under FICA;
• Submitting home loan applications to accredited South African financial institutions and coordinating property transfer and bond registration with admitted conveyancing attorneys;
• Processing lawful administrative or verification fee payments via authorized payment gateways.

3. Payment Data & PCI-DSS Security

All online card and electronic payments are processed through Paystack, a PCI-DSS Level 1 certified payment processor utilizing 3D Secure authentication and 256-bit SSL/TLS encryption. Zim Home Loans (Pty) Ltd does not capture, store, or retain your raw credit/debit card numbers, CVV codes, or online banking credentials on our servers.

4. Third-Party Disclosures & Cross-Border Transfers

We never sell, rent, or trade your personal information. We only share relevant application data with authorized third parties under strict confidentiality agreements: registered South African credit bureaus (e.g., TransUnion, Experian), commercial bank home loan divisions, South African Reserve Bank (SARB) Authorized Dealers for non-resident exchange control endorsement, and High Court admitted conveyancers. Where diaspora applicants reside outside South Africa, cross-border data transfers are executed in accordance with Section 72 of POPIA.

5. Technical & Organizational Security Safeguards

In compliance with Section 19 of POPIA, we implement bank-grade security controls including AES-256 encryption at rest, TLS 1.3 encryption in transit, role-based access control (RBAC), and continuous audit logging to prevent loss, damage, or unauthorized access to your personal records.

6. Your Rights as a Data Subject & Information Officer Contact

Under POPIA, you have the right to request access to your personal information, request correction or deletion of inaccurate records, withdraw consent, or object to processing. You also have the right to lodge a complaint with the Information Regulator (South Africa) (enquiries@inforegulator.org.za).