BridgeFin Solutions (Pty) Ltd
Introduction
BridgeFin Solutions (Pty) Ltd (“BridgeFin”, “we”, “us” or “our”) respects the privacy, confidentiality and security of personal information entrusted to us.
This Privacy and Protection of Personal Information Policy (“Privacy Policy”) explains how BridgeFin collects, receives, uses, records, stores, accesses, shares, secures, retains, deletes and otherwise processes personal information in connection with:
- our website;
- the BridgeFin online portal and related digital services;
- the registration and onboarding of attorneys, law firms and authorised users;
- applications for bridging finance;
- seller bridging finance;
- estate agent commission bridging;
- property-transfer and conveyancing transactions;
- supporting documentation and FICA-related records;
- electronic agreements and signatures;
- funding, repayment and settlement processes;
- enquiries and communications;
- our relationships with professional service providers, operators and business partners; and
- our legal, regulatory, security and administrative obligations.
BridgeFin processes personal information in accordance with the Protection of Personal Information Act, 2013 (“POPIA”), the Promotion of Access to Information Act (“PAIA”), and other applicable South African legislation.
This Privacy Policy applies to natural persons and, where POPIA applies, identifiable existing juristic persons.
1. BRIDGEFIN AS RESPONSIBLE PARTY
For purposes of POPIA, BridgeFin will generally act as the responsible party in relation to personal information where BridgeFin determines the purpose of and means by which that personal information is processed.
In certain circumstances, another organisation involved in a transaction may separately act as a responsible party.
For example, a law firm, conveyancing practice, financial institution, estate agency, accounting service provider or other professional party may process personal information for its own lawful purposes and under its own privacy obligations.
Where a third party processes personal information solely on BridgeFin’s instructions, that party may act as an operator as contemplated in POPIA.
2. OUR PRIVACY PRINCIPLES
BridgeFin is committed to processing personal information in accordance with the principles of:
- accountability;
- lawfulness and fairness;
- minimality;
- transparency;
- purpose limitation;
- compatible further processing;
- information quality;
- confidentiality;
- appropriate security safeguards;
- responsible retention; and
- participation by data subjects.
BridgeFin will endeavour to collect only personal information that is adequate, relevant and reasonably necessary for the purpose for which it is processed.
3. WHO THIS POLICY APPLIES TO
This Privacy Policy may apply to personal information relating to:
- sellers of immovable property;
- purchasers where relevant to the underlying transaction;
- estate agents and property practitioners;
- attorneys;
- conveyancers;
- candidate attorneys;
- legal secretaries and paralegals;
- directors, partners and employees of law firms;
- authorised users of the BridgeFin portal;
- spouses or partners where relevant to a transaction;
- trustees, beneficiaries and representatives of trusts;
- directors, members, shareholders and authorised representatives of companies and other juristic persons;
- sureties, guarantors and representatives where applicable;
- clients applying for or benefiting from BridgeFin funding;
- persons making payments or receiving funds;
- website visitors;
- persons submitting enquiries;
- suppliers and professional service providers;
- representatives of banks, accountants, auditors and other professional advisers;
- persons whose information appears in supporting documents; and
- any other identifiable person whose personal information BridgeFin lawfully receives in connection with its business.
4. PERSONAL INFORMATION WE MAY PROCESS
Depending on the nature of the relationship or transaction, BridgeFin may process the following categories of personal information.
4.1 Identity information
This may include:
- full names;
- initials;
- identity details;
- passport or other identification information;
- date of birth where relevant;
- nationality or citizenship information where legally required;
- marital status;
- details relating to a spouse where relevant;
- photographs contained in identification documents;
- signatures; and
- information required to establish or verify identity.
4.2 Contact information
This may include:
- residential or business address;
- postal address;
- email address;
- telephone or mobile contact details;
- preferred method of communication; and
- details of authorised representatives or professional contacts.
4.3 Financial information
This may include:
- bank-account information;
- proof of banking details;
- income or financial information where relevant;
- outstanding financial obligations;
- amounts payable or receivable in a property transaction;
- settlement figures;
- finance amounts;
- repayment amounts;
- interest, fees and charges;
- payment history;
- transaction history;
- accounting information; and
- other financial information reasonably required to assess, administer or settle a BridgeFin transaction.
4.4 Credit and risk information
Where lawful, relevant and required, this may include:
- credit-related information;
- credit history;
- information obtained from authorised credit-information sources;
- risk indicators;
- affordability or financial-assessment information;
- fraud indicators;
- insolvency-related information;
- judgments or adverse information where lawfully obtained; and
- information relevant to the assessment of a finance application.
The fact that this Policy allows for such processing does not mean that BridgeFin necessarily obtains a credit-bureau report in every transaction.
5. PROPERTY AND CONVEYANCING INFORMATION
Because BridgeFin’s services are connected to property transactions, we may process information including:
- property descriptions;
- erf or sectional-title information;
- title-deed information;
- purchase prices;
- sale-agreement information;
- transfer information;
- conveyancing information;
- bond information;
- outstanding bond amounts;
- cancellation costs;
- estate agent commission;
- anticipated lodgement or registration information;
- municipal clearance information;
- rates and taxes information;
- levy information;
- compliance requirements;
- electrical compliance information;
- gas compliance information;
- electric-fence compliance information;
- transfer costs;
- other transaction-related expenses;
- undertakings;
- expected net proceeds; and
- information concerning the stage and progress of the property transfer.
6. INFORMATION RELATING TO LAW FIRMS AND PROFESSIONAL USERS
Where attorneys, conveyancers or their personnel use BridgeFin services or the BridgeFin portal, we may process:
- law-firm details;
- trading names;
- professional contact information;
- user roles;
- branch or office details;
- user permissions;
- internal firm references;
- BridgeFin user or subcodes;
- applications submitted;
- transaction activity;
- documents uploaded;
- approval activity;
- status changes;
- user login activity;
- communication history;
- access records;
- administrative actions; and
- audit trails relating to the user’s interaction with BridgeFin systems.
7. FICA, CUSTOMER DUE DILIGENCE AND COMPLIANCE INFORMATION
Where applicable to BridgeFin’s legal and compliance obligations, we may collect or process information required for customer due diligence, identity verification, risk assessment, record keeping and related compliance purposes.
This may include:
- identification documents;
- proof of address;
- company or entity documents;
- trust documents;
- details of directors, trustees, members, shareholders or beneficial owners;
- source-of-funds information where required;
- authority to act;
- mandates;
- resolutions;
- ownership information;
- tax-related information where lawfully required; and
- other documentation necessary to meet applicable compliance obligations.
The Financial Intelligence Centre framework includes obligations relating to customer due diligence, identification and verification, record keeping and risk-based compliance where an entity is subject to those requirements.
Nothing in this Privacy Policy should be interpreted as a representation regarding BridgeFin’s particular regulatory classification or registration status where such status has not separately been confirmed.
8. SPECIAL PERSONAL INFORMATION
Certain information processed by BridgeFin may constitute special personal information under POPIA.
This may include, where relevant:
- race or ethnic origin;
- health information;
- biometric information;
- criminal-behaviour information;
- religious or philosophical information;
- trade-union information; or
- other information falling within the categories protected by POPIA.
BridgeFin will process special personal information only where:
- permitted or required by law;
- necessary for the establishment, exercise or defence of a right or obligation in law;
- authorised under POPIA;
- consent has been obtained where appropriate; or
- another lawful basis permits the processing.
9. PERSONAL INFORMATION OF CHILDREN
BridgeFin’s services are not primarily directed at children.
However, personal information relating to a child may arise in a property, estate, trust, guardianship, inheritance or other transaction.
Where BridgeFin is required to process personal information of a child, it will do so only where legally permitted, including where:
- prior consent from a competent person has been obtained where required;
- processing is necessary for the establishment, exercise or defence of a right or obligation in law; or
- another authorisation under POPIA applies.
10. HOW WE COLLECT PERSONAL INFORMATION
BridgeFin may collect personal information directly from the data subject or indirectly from lawful sources.
Sources may include:
- the person concerned;
- an attorney;
- a conveyancing firm;
- an estate agent or property practitioner;
- an employer or authorised representative;
- a trustee, director, member or representative;
- a spouse or authorised third party;
- transaction documents;
- property-transfer records;
- agreements;
- supporting documentation;
- government or statutory records where lawful;
- publicly available sources;
- professional advisers;
- banks or payment providers;
- compliance or identity-verification providers;
- authorised credit-information providers where applicable;
- electronic-signature providers;
- accounting platforms;
- security and fraud-prevention services; and
- other sources permitted by law.
Where BridgeFin receives personal information from an attorney or another professional intermediary, BridgeFin may reasonably rely on that party having a lawful basis to disclose the information to BridgeFin, subject to BridgeFin’s own obligations under POPIA.
11. WHEN INFORMATION IS PROVIDED BY AN ATTORNEY OR LAW FIRM
BridgeFin’s business model places attorneys and conveyancing practices at an important point in the transaction process.
A participating attorney or law firm may provide BridgeFin with information relating to its client, a seller, estate agent, property transaction or another relevant person.
The attorney or law firm remains responsible for complying with its own obligations under POPIA, including:
- processing information lawfully;
- informing its clients about relevant processing;
- obtaining any consent required by law;
- ensuring information supplied is accurate;
- maintaining appropriate security; and
- ensuring that it is authorised to disclose information to BridgeFin.
BridgeFin will separately remain responsible for the lawful processing it undertakes for BridgeFin’s own purposes.
12. WHY WE PROCESS PERSONAL INFORMATION
BridgeFin may process personal information for purposes including:
- responding to enquiries;
- registering legal practices;
- creating or administering user accounts;
- verifying users and representatives;
- onboarding firms;
- assessing eligibility for BridgeFin services;
- receiving and evaluating applications;
- assessing the underlying property transaction;
- assessing risk;
- verifying information;
- requesting additional information;
- processing seller bridging applications;
- processing estate agent commission bridging applications;
- determining applicable terms;
- calculating finance amounts;
- preparing quotations;
- preparing agreements;
- managing electronic signatures;
- making or administering funding;
- maintaining transaction records;
- monitoring active matters;
- calculating settlement amounts;
- receiving repayments;
- allocating payments;
- reconciling financial records;
- closing transactions;
- maintaining accounting records;
- detecting and preventing fraud;
- securing our systems;
- conducting audits;
- maintaining access logs and audit trails;
- complying with legal or regulatory obligations;
- dealing with complaints or disputes;
- establishing, exercising or defending legal rights;
- obtaining legal or professional advice;
- communicating with attorneys and clients;
- providing support;
- improving our services;
- managing our business operations;
- maintaining records;
- performing statistical or operational analysis using appropriately protected information; and
- carrying out activities reasonably incidental to BridgeFin’s legitimate business functions.
13. LAWFUL GROUNDS FOR PROCESSING
BridgeFin will process personal information only where lawful.
Depending on the circumstances, processing may be justified because:
- the data subject has consented;
- processing is necessary to carry out actions for the conclusion or performance of a contract;
- processing complies with an obligation imposed by law;
- processing protects a legitimate interest of the data subject;
- processing is necessary for pursuing the legitimate interests of BridgeFin or a third party to whom the information is supplied; or
- another lawful ground recognised by POPIA applies.
Consent will not be treated as the only lawful basis where another lawful ground applies.
Where processing relies on consent, that consent may be withdrawn, subject to any legal or contractual consequences and any lawful basis that permits continued processing.
14. MANDATORY AND VOLUNTARY INFORMATION
Some personal information is provided voluntarily.
Other information may be necessary because:
- BridgeFin cannot assess an application without it;
- it is required for a transaction;
- it is required to enter into or perform an agreement;
- it is required for identity verification;
- it is required by law;
- it is necessary for fraud or risk management; or
- BridgeFin cannot safely or lawfully provide the requested service without it.
Where required information is not supplied, BridgeFin may be unable to:
- process an application;
- approve or provide finance;
- enter into an agreement;
- make payment;
- provide portal access;
- complete verification;
- calculate settlement;
- close a transaction; or
- provide the requested service.
15. ACCURACY OF INFORMATION
BridgeFin will take reasonably practicable steps to ensure that personal information in its possession is complete, accurate, not misleading and updated where necessary.
Data subjects, attorneys and authorised users are responsible for providing accurate information and informing BridgeFin where relevant information changes.
BridgeFin may request supporting documentation to verify information.
16. USE OF THE BRIDGEFIN PORTAL
BridgeFin may provide authorised users with access to a secure online portal.
The portal may process information including:
- account details;
- login information;
- authentication information;
- law-firm associations;
- applications;
- supporting documents;
- transaction status;
- agreements;
- electronic-signature status;
- settlement information;
- notices;
- messages;
- activity records;
- timestamps;
- access history;
- security events; and
- user actions.
Users must keep their credentials confidential and must not permit unauthorised persons to use their account.
BridgeFin may suspend or restrict access where necessary to protect personal information, systems, users or transactions.
17. USER ACCESS AND ROLE-BASED PERMISSIONS
BridgeFin may use role-based access controls.
Different users may therefore have different access depending on:
- their firm;
- branch;
- professional role;
- internal function;
- matter allocation;
- authority level; and
- BridgeFin permissions.
BridgeFin may record and retain audit information regarding:
- logins;
- document uploads;
- application submissions;
- changes;
- approvals;
- status updates;
- settlement activity;
- user-management actions; and
- other material system events.
This information may be used for security, accountability, dispute resolution and compliance purposes.
18. DOCUMENT STORAGE
BridgeFin may receive and retain electronic documents including:
- identification documents;
- FICA documentation;
- agreements;
- mandates;
- financial documents;
- bank confirmations;
- compliance certificates;
- property-transfer records;
- commission documentation;
- settlement records; and
- supporting documents.
Sensitive documents will be subject to access controls and appropriate security measures.
BridgeFin may use secure third-party hosting or cloud-storage operators to store documents.
19. ELECTRONIC SIGNATURES
Where agreements or documents are signed electronically, BridgeFin may use an electronic-signature service provider.
Information processed in connection with electronic signatures may include:
- names;
- contact details;
- document contents;
- signature data;
- timestamps;
- authentication events;
- electronic audit trails; and
- information required to demonstrate the signing process.
The Electronic Communications and Transactions Act provides the broader South African legal framework for electronic communications and transactions.
Electronic-signature providers may act as operators or independent responsible parties depending on the service and processing concerned.
20. FINANCE ASSESSMENT, RISK ASSESSMENT AND PROFILING
BridgeFin may use personal information to assess:
- transaction viability;
- finance risk;
- repayment risk;
- fraud risk;
- document completeness;
- identity or verification issues;
- transaction status; and
- whether additional information is required.
BridgeFin may use rules, calculations, indicators, software or decision-support tools to assist staff.
Where POPIA restricts a decision from being based solely on automated processing and that decision has legal or substantial effects on a data subject, BridgeFin will apply the safeguards required by law, including human involvement where required.
21. ARTIFICIAL INTELLIGENCE AND ASSISTIVE TECHNOLOGIES
BridgeFin may use appropriately controlled digital or assistive technologies to support activities such as:
- document classification;
- workflow assistance;
- data extraction;
- administrative support;
- security monitoring;
- fraud detection;
- internal search;
- summarisation; or
- decision support.
Where personal information is processed through such technology:
- the processing must have a lawful purpose;
- access must be appropriately restricted;
- service providers must be subject to appropriate contractual and security requirements;
- sensitive information must not be used for unrelated purposes; and
- material financial or legal decisions will not be delegated solely to automated processing where prohibited by law.
22. ACCOUNTING AND FINANCIAL SYSTEMS
BridgeFin may transfer transaction-related information to accounting or financial-management systems for purposes such as:
- customer creation;
- transaction recording;
- payment allocation;
- account reconciliation;
- fee and interest allocation;
- audit;
- reporting; and
- statutory record keeping.
Only information reasonably required for the accounting purpose should be transferred.
23. BANKING AND PAYMENTS
Where BridgeFin makes or receives payments, information may be processed by:
- BridgeFin;
- attorneys;
- attorney trust accounts;
- banks;
- payment providers;
- accounting systems; and
- other parties necessary to effect or reconcile payment.
BridgeFin will process banking information only for lawful transaction, verification, accounting, security or compliance purposes.
24. SHARING PERSONAL INFORMATION
BridgeFin does not sell personal information.
BridgeFin may disclose personal information where reasonably necessary to:
- attorneys and conveyancing practices;
- authorised representatives;
- banks;
- payment providers;
- auditors;
- accountants;
- legal advisers;
- e-signature providers;
- hosting providers;
- cloud-storage providers;
- information-technology providers;
- cyber-security providers;
- email or communication providers;
- identity or verification providers;
- compliance service providers;
- authorised credit-information providers, where applicable;
- fraud-prevention providers;
- debt-recovery or collection service providers where lawful;
- regulators;
- courts;
- tribunals;
- law-enforcement agencies;
- statutory bodies;
- government authorities;
- professional advisers; or
- another party where disclosure is required or authorised by law.
BridgeFin may also disclose information where necessary for:
- performance of an agreement;
- protection of rights;
- legal proceedings;
- fraud prevention;
- security;
- corporate restructuring; or
- another legitimate and lawful business purpose.
25. OPERATORS AND SERVICE PROVIDERS
Where an operator processes personal information for BridgeFin, BridgeFin will seek to ensure that appropriate contractual arrangements are in place requiring the operator to:
- process information only as authorised;
- preserve confidentiality;
- implement appropriate security measures;
- assist with security incidents where relevant; and
- comply with applicable data-protection obligations.
POPIA specifically places security obligations on operators processing personal information under the authority of a responsible party.
26. INTERNATIONAL OR CROSS-BORDER PROCESSING
Some technology, cloud, email, security, software or professional service providers may process or store information outside South Africa.
Where personal information is transferred to another country, BridgeFin will take reasonable steps to ensure that the transfer is lawful under POPIA.
This may include relying on:
- adequate data-protection laws;
- binding agreements;
- contractual safeguards;
- consent where appropriate;
- contractual necessity; or
- another lawful basis permitted by POPIA.
BridgeFin will not knowingly transfer personal information across borders contrary to applicable law.
27. SECURITY OF PERSONAL INFORMATION
BridgeFin recognises that the information processed in property and financial transactions may be highly sensitive.
BridgeFin will implement reasonable and appropriate technical and organisational safeguards designed to protect personal information against:
- loss;
- damage;
- unauthorised destruction;
- unlawful access;
- unauthorised use;
- alteration;
- disclosure; and
- other unlawful processing.
Safeguards may include, where appropriate:
- access controls;
- role-based permissions;
- unique user accounts;
- multi-factor authentication;
- secure passwords;
- encryption;
- protected connections;
- secure document storage;
- private file access;
- network protection;
- firewall controls;
- anti-malware controls;
- logging;
- audit trails;
- vulnerability management;
- system updates;
- backups;
- monitoring;
- incident-response processes;
- employee confidentiality requirements;
- service-provider security requirements; and
- periodic access or security reviews.
No electronic system can be guaranteed to be entirely free of risk.
BridgeFin will therefore continually assess and improve safeguards appropriate to the sensitivity of the information and the risks presented by its processing.
28. SECURITY COMPROMISES AND DATA BREACHES
If BridgeFin has reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, BridgeFin will deal with the incident in accordance with POPIA.
Where required, BridgeFin will notify:
- the Information Regulator; and
- affected data subjects.
A notification may include information reasonably necessary to enable affected persons to take protective measures.
The Information Regulator’s guidance specifically addresses notification of affected data subjects, incident details, categories of compromised personal information, consequences and protective measures.
BridgeFin may delay notification where lawfully directed to do so by an appropriate authority.
29. RETENTION OF PERSONAL INFORMATION
BridgeFin will not retain personal information for longer than reasonably necessary unless:
- retention is required or authorised by law;
- BridgeFin reasonably requires the record for lawful purposes;
- retention is required by an agreement;
- the data subject has consented where legally appropriate; or
- another lawful basis exists.
Because BridgeFin operates in a financial and property-transaction environment, certain records may need to be retained for statutory, accounting, compliance, legal, audit, fraud-prevention or dispute-resolution purposes after a transaction has been completed.
Retention periods may therefore differ depending on:
- the type of record;
- the nature of the transaction;
- statutory requirements;
- legal risk;
- regulatory obligations; and
- legitimate business requirements.
Once information is no longer lawfully required, it will be deleted, destroyed, de-identified or otherwise dealt with in accordance with applicable law.
30. RESTRICTION OF PROCESSING
BridgeFin may restrict processing of personal information where appropriate, including where:
- accuracy is contested;
- information must be retained as evidence;
- processing is unlawful but deletion is opposed;
- information is no longer required for its original purpose but must be retained for legal purposes; or
- an objection to processing is under consideration.
Restricted information will not be further processed except where permitted by law.
31. DE-IDENTIFIED AND AGGREGATED INFORMATION
BridgeFin may use information that has been appropriately de-identified or aggregated for purposes such as:
- business analysis;
- service improvement;
- operational reporting;
- trend analysis;
- capacity planning;
- security;
- product development; and
- statistical purposes.
BridgeFin will take reasonable measures to prevent de-identified information from being re-identified where re-identification is prohibited.
32. WEBSITE INFORMATION
When a person visits the BridgeFin website, technical information may automatically be processed, including:
- internet protocol information;
- device information;
- browser type;
- operating system;
- pages viewed;
- referring pages;
- date and time of access;
- interaction information;
- general location information derived from network information;
- security logs; and
- cookie identifiers.
This information may be used to:
- operate the website;
- improve performance;
- understand usage;
- secure the website;
- detect abuse;
- troubleshoot errors; and
- improve user experience.
33. COOKIES AND SIMILAR TECHNOLOGIES
BridgeFin’s website may use cookies or similar technologies.
These may include:
Essential cookies
Necessary for:
- website functionality;
- login;
- security;
- session management; and
- portal operation.
Preference cookies
Used to remember selected preferences.
Analytics cookies
Used to understand website traffic, performance and visitor interaction.
Security cookies
Used to detect abuse, fraud or suspicious activity.
Marketing cookies
Where used, these will be subject to applicable consent and direct-marketing requirements.
Where required, users will be given an opportunity to manage non-essential cookies through the website’s cookie-consent mechanism.
Users may also manage cookies through their browser settings, although disabling essential cookies may affect website functionality.
34. WEBSITE ANALYTICS
BridgeFin may use analytics services to understand how visitors interact with its website.
Analytics providers may receive technical or usage information.
Where required by applicable law, non-essential analytics will be subject to user consent.
BridgeFin will seek to configure analytics in a privacy-conscious manner appropriate to its website and legal obligations.
35. FORMS AND WEBSITE ENQUIRIES
Where a visitor submits an enquiry or registration form, BridgeFin may collect information such as:
- name;
- firm or business;
- email address;
- telephone details;
- nature of enquiry;
- transaction information voluntarily supplied; and
- message content.
Visitors should not submit unnecessary sensitive information through ordinary public contact forms.
Sensitive client, identity, financial or FICA information should be supplied only through an approved secure BridgeFin channel when requested.
36. EMAIL AND OTHER COMMUNICATIONS
BridgeFin may retain communications exchanged with:
- applicants;
- attorneys;
- law firms;
- clients;
- estate agents;
- professional advisers;
- suppliers; and
- other parties.
Communications may be retained where necessary to:
- respond to requests;
- administer transactions;
- demonstrate instructions;
- resolve disputes;
- comply with law;
- maintain an audit trail; or
- protect legitimate interests.
37. CONFIDENTIAL INFORMATION SHOULD NOT BE SENT IN UNSECURED CHANNELS
BridgeFin may instruct users not to transmit confidential client, FICA or financial information through insecure or inappropriate communication channels.
Where the BridgeFin portal or another approved secure method is available, sensitive documents should be submitted through that channel.
38. DIRECT MARKETING
BridgeFin may communicate information about its services to attorneys, professional contacts, clients or other persons where permitted by law.
Unsolicited electronic direct marketing will be conducted in accordance with POPIA.
Where prior consent is required, BridgeFin will seek such consent before sending the communication.
Where the law permits communication with an existing customer without fresh consent, BridgeFin will comply with the applicable statutory requirements.
Every direct-marketing communication will provide an appropriate means to opt out or object.
A person may object to direct marketing at any time.
The Information Regulator has issued specific guidance regarding direct marketing under POPIA, including electronic direct marketing under section 69.
39. SOCIAL MEDIA
If a person interacts with BridgeFin through a third-party social-media platform, that platform may separately process the person’s information under its own privacy terms.
BridgeFin may process information received through social media for purposes such as:
- responding to enquiries;
- managing professional relationships;
- reputation management; and
- communicating BridgeFin information.
Users should not submit confidential financial, identification or transaction information through public social-media channels.
40. THIRD-PARTY WEBSITES
BridgeFin’s website may contain links to websites or services operated by third parties.
BridgeFin does not control the privacy or security practices of independent third-party websites.
Users should review the relevant privacy terms before submitting personal information to such third parties.
41. BUSINESS RESTRUCTURING
If BridgeFin undergoes a lawful merger, acquisition, restructuring, sale, transfer, financing transaction or similar corporate event, personal information may be disclosed to appropriate advisers or counterparties where lawful and subject to appropriate confidentiality and data-protection safeguards.
Any subsequent processing must remain lawful under POPIA.
42. FRAUD PREVENTION AND INVESTIGATIONS
BridgeFin may process or disclose personal information where necessary to:
- prevent fraud;
- investigate suspicious conduct;
- secure accounts;
- protect funds;
- protect BridgeFin or another person;
- investigate unauthorised system activity;
- enforce agreements; or
- comply with lawful requests from competent authorities.
43. LEGAL CLAIMS AND DISPUTES
BridgeFin may process and retain personal information where reasonably necessary to:
- establish a legal claim;
- exercise legal rights;
- defend proceedings;
- manage complaints;
- resolve disputes;
- recover amounts due;
- respond to regulatory enquiries; or
- obtain professional legal advice.
44. DATA SUBJECT RIGHTS
Subject to applicable law and any lawful limitations, a data subject may have the right to:
- know whether BridgeFin holds personal information about them;
- request access to their personal information;
- request a description of the information held;
- request information about recipients or categories of recipients;
- request correction of inaccurate information;
- request deletion or destruction where legally appropriate;
- object to processing on grounds recognised by POPIA;
- withdraw consent where processing relies on consent;
- object to direct marketing;
- request restriction where applicable;
- complain about unlawful processing;
- lodge a complaint with the Information Regulator; and
- challenge certain decisions based solely on automated processing where POPIA applies.
The Information Regulator provides prescribed forms for objections and requests for correction or deletion.
45. REQUESTING ACCESS TO PERSONAL INFORMATION
A data subject may contact BridgeFin to request confirmation of whether BridgeFin holds personal information about them.
Subject to POPIA and PAIA, BridgeFin may require:
- sufficient information to verify identity;
- details necessary to locate the relevant record; and
- compliance with any prescribed access procedure.
BridgeFin may refuse or restrict access only where permitted by law.
46. CORRECTION OR DELETION
A data subject may request that BridgeFin correct or delete personal information that is:
- inaccurate;
- irrelevant;
- excessive;
- out of date;
- incomplete;
- misleading; or
- unlawfully obtained.
BridgeFin will consider the request in accordance with applicable law.
BridgeFin may be required to retain information despite a deletion request where a statutory, legal, contractual or other lawful retention requirement applies.
47. OBJECTION TO PROCESSING
A data subject may object to processing where POPIA provides a right of objection.
BridgeFin will consider the nature of the objection and applicable lawful grounds.
An objection does not necessarily require BridgeFin to delete information that must lawfully be retained or processed.
48. WITHDRAWAL OF CONSENT
Where BridgeFin relies on consent, the data subject may withdraw that consent.
Withdrawal will not:
- invalidate lawful processing that occurred before withdrawal; or
- prevent BridgeFin from continuing processing where another lawful ground applies.
Withdrawal may affect BridgeFin’s ability to provide a service where the relevant information is necessary for that service.
49. AUTOMATED DECISION-MAKING RIGHTS
Where BridgeFin uses automated processing in a manner regulated by POPIA, BridgeFin will respect applicable rights concerning decisions that have legal or substantial effects.
Where required, data subjects may request appropriate information or human reconsideration as provided by law.
50. COMPLAINTS
A data subject who believes that BridgeFin has processed personal information unlawfully may first raise the matter with BridgeFin.
BridgeFin will endeavour to investigate legitimate privacy complaints.
A data subject also has the right to lodge a complaint with the Information Regulator of South Africa.
Current complaint procedures and prescribed forms are available through the Information Regulator’s official website.
51. PAIA AND ACCESS TO RECORDS
Requests for access to records may also be governed by PAIA.
BridgeFin will maintain a PAIA Manual where required and make it available in accordance with applicable law.
The Information Regulator confirms that private bodies are required to compile and make a PAIA Manual available, including information concerning the records held and procedures for requesting access.
The BridgeFin PAIA Manual should be read together with this Privacy Policy.
52. INFORMATION OFFICER
BridgeFin will maintain an Information Officer structure as required by POPIA and PAIA.
The Information Officer is responsible for matters including:
- encouraging compliance with POPIA;
- dealing with data-subject requests;
- supporting PAIA compliance;
- cooperating with the Information Regulator;
- maintaining appropriate compliance measures;
- supporting privacy impact assessments;
- overseeing internal privacy processes; and
- promoting privacy awareness.
The Information Regulator requires public and private bodies to register their Information Officers before those officers take up their POPIA duties.
53. PRIVACY IMPACT AND RISK ASSESSMENT
BridgeFin may conduct privacy and information-security impact assessments when introducing:
- new technology;
- new processing activities;
- new integrations;
- material changes to finance workflows;
- high-risk processing;
- new categories of personal information; or
- new service providers.
The purpose is to identify and mitigate privacy and security risks before or during implementation.
54. EMPLOYEE AND AUTHORISED-PERSON ACCESS
Personal information may only be accessed by BridgeFin personnel or authorised persons who reasonably require access for their duties.
BridgeFin may apply measures such as:
- confidentiality obligations;
- access limitations;
- role-based permissions;
- staff training;
- monitoring; and
- disciplinary or contractual controls.
Access should follow the principle of least privilege where reasonably practicable.
55. RECORDS OF PROCESSING AND ACCOUNTABILITY
BridgeFin may maintain records concerning its processing activities and privacy compliance.
This may include:
- information categories;
- processing purposes;
- systems used;
- recipients;
- service providers;
- security controls;
- retention practices;
- incidents;
- requests;
- complaints;
- risk assessments;
- policies; and
- audit records.
56. CHANGES TO THIS PRIVACY POLICY
BridgeFin may update this Privacy Policy from time to time to reflect:
- changes in law;
- regulatory guidance;
- changes to BridgeFin services;
- changes to technology;
- new processing activities;
- new service providers; or
- improvements to BridgeFin’s privacy practices.
The latest version will be made available on the BridgeFin website.
Where a change materially affects how personal information is processed, BridgeFin may provide additional notice where appropriate.
57. INTERPRETATION
If any provision of this Privacy Policy conflicts with a mandatory provision of applicable law, the applicable law will prevail.
If any provision is found to be invalid or unenforceable, the remaining provisions will continue to apply to the extent permitted by law.
Headings are included for convenience and do not limit the interpretation of this Policy.
58. GOVERNING LAW
This Privacy Policy and BridgeFin’s processing of personal information are governed by the laws of the Republic of South Africa.
59. CONTACT BRIDGEFIN REGARDING PRIVACY
Questions relating to:
- this Privacy Policy;
- access to personal information;
- correction or deletion;
- objections;
- withdrawal of consent;
- privacy complaints;
- data-subject rights;
- security concerns; or
- BridgeFin’s handling of personal information
may be directed to: