Privacy and Cookie Policy

Version 2.0. Updated 13 October 2026.

1. Purpose and Scope
This Privacy and Cookie Policy explains how TappiPay (Pty) Ltd (registration number 2025/473765/07) collects, uses, shares, protects and retains personal information in connection with its website, mobile application, payment services, merchant onboarding and relationships with Sales Agents, Team Leaders and Sales Managers (collectively, Contractors). It also explains the use of cookies and similar technologies. This Policy should be read together with the TappiPay Standard Terms and Conditions and, where applicable, a separate Merchant or Contractor Agreement.

2. Responsible Party and Contact
TappiPay (Pty) Ltd is the responsible party for personal information for which it determines the purposes and means of processing, in accordance with the Protection of Personal Information Act (POPIA).

Registered Address: 21A Westlake Lifestyle Centre, Westlake Drive, Tokai, 7945, South Africa.

Information Officer: Sean Maloney

Email Address: compliance@tappipay.co.za

All privacy, personal information protection and information-access enquiries may be directed to the Information Officer at the email address above.

3. Information we Collect
Depending on the service and the person concerned, we may process: names, contact details and account credentials; South African identity numbers, passport details, refugee or asylum documentation and other identity records; business registration and beneficial-ownership information; authorised-representative details; bank account details and verification outcomes; payment request, transaction, settlement and refund-related records; merchant business information, risk and screening results; Contractor appointment, training, performance and commission records; support correspondence and complaints; and technical security information such as device, access and authentication logs. We collect only information reasonably necessary for lawful purposes.

4. How Information is Obtained
Information may be supplied directly by Customers, Merchants, Contractors or authorised representatives; generated through use of the Platform; or received from banks, payment-system participants, identity and bank-account verification providers, screening providers and other authorised sources. Where information is collected from another source, TappiPay will provide required notices or rely on an applicable lawful exception.

5. Purposes of Processing
We process personal information to assess applications and onboard Merchants and Contractors; verify identity, authority, beneficial ownership and bank accounts; facilitate PayShap Request-to-Pay and other supported payment services; administer transactions, settlement, fees and Contractor commissions; secure the Platform; detect, prevent and investigate fraud and financial crime; comply with applicable legal and Sponsor Bank requirements; maintain records; respond to enquiries and complaints; and manage contractual relationships. TappiPay does not sell personal information to third parties.

6. Lawful Grounds for Processing
Depending on the circumstances, processing may be necessary to enter into or perform an agreement, comply with a legal obligation, protect a legitimate interest of TappiPay or another person, or be based on consent where required by law. We will seek specific consent when applicable and allow its withdrawal where the law permits. Withdrawal does not invalidate earlier lawful processing or override legal recordkeeping duties.

7. Financial Crime Screening and Monitoring
TappiPay undertakes risk-based identity verification, sanctions and politically exposed person screening, adverse-media checks where appropriate, transaction monitoring and fraud-prevention reviews in line with its role and Sponsor Bank arrangements. Relevant information may be escalated to Sponsor Banks or competent authorities as required or permitted by law. This Policy does not imply that TappiPay independently holds every statutory reporting duty applicable to its banking partners.

8. Sharing and Service Providers
We may share relevant information, subject to lawful safeguards, with Sponsor Banks, payment-system and system-operator partners, settlement and bank-account verification providers, identity and sanctions screening providers, hosting, technology, security and support service providers, professional advisers and regulators or law-enforcement bodies where authorised or required. Providers acting for TappiPay must be subject to appropriate confidentiality and security obligations. We share only information reasonably necessary for the relevant purpose.

9. Cross-Border Transfers and Data Hosting
TappiPay stores personal information using secure cloud-based infrastructure hosted in South Africa. Where authorised service providers require access to personal information from outside South Africa, TappiPay will ensure that any cross-border processing or transfer complies with the Protection of Personal Information Act (POPIA), including appropriate safeguards and contractual protections where required.

10. Security and Incidents
TappiPay uses reasonable technical and organisational measures appropriate to the nature and risk of the information, including access controls, authentication, secure systems, monitoring and staff or Contractor obligations. No system can be guaranteed completely secure. Suspected unauthorised access, disclosure or loss should be reported promptly to compliance@tappipay.co.za. TappiPay will assess incidents and make notifications where required by POPIA and applicable arrangements.

11. Retention and Deletion
Information is retained only as long as reasonably necessary for the purpose collected, or as required or permitted by applicable law, contractual obligations, disputes, fraud-prevention needs and Sponsor Bank arrangements. Different record categories may have different retention periods. When retention is no longer justified, information will be securely deleted, destroyed or de-identified as appropriate. Requests for deletion remain subject to lawful retention obligations.

12. Your Rights
Subject to POPIA and other applicable law, individuals may ask whether TappiPay holds their personal information, request access, request correction or deletion of inaccurate or unlawfully held information, object to certain processing, and withdraw consent where processing depends on consent. Requests may require identity verification and may be limited by legal exceptions. Contact compliance@tappipay.co.za to exercise these rights.

13. Communications and Direct Marketing
TappiPay may send necessary service, security, transaction, contractual and compliance communications. Any electronic direct marketing will be conducted only where permitted by applicable law, including consent and opt-out requirements. Operational messages necessary to provide the service may continue even if optional marketing communications are declined.

14. Cookies and Similar Technologies
TappiPay may use cookies, similar technologies and authorised third-party services to support the operation, functionality, security and improvement of its website, mobile application and payment services.

These technologies may collect or process limited technical and device-related information where necessary for the provision of services, in accordance with applicable data protection laws.

TappiPay does not use personal information for targeted advertising without an appropriate lawful basis. Where consent is required for non-essential technologies, TappiPay will obtain such consent in accordance with applicable law.

15. Children and Third-Party Information
The Platform is intended for persons legally entitled to use the relevant services. If a person provides personal information about another individual, they must have authority or another lawful basis to do so. Where information relating to children is processed, TappiPay will comply with the applicable POPIA requirements and obtain any required authorisation.

16. PAIA Manual and Access to Records
TappiPay’s Promotion of Access to Information Act (PAIA) Manual is available separately on the TappiPay website. It describes how to request access to records and provides further information about the Information Officer and relevant procedures. Requests under PAIA may be subject to prescribed forms, fees and lawful grounds for refusal.

17. Complaints and Regulator
Privacy concerns or requests should first be sent to compliance@tappipay.co.za. Individuals may also lodge a complaint with the Information Regulator (South Africa), subject to applicable procedures. Further information is available from the Information Regulator’s official website: https://inforegulator.org.za.

18. Changes to this Policy
TappiPay may amend this Policy to reflect changes in its services, processing activities, technology or legal requirements. The current version and effective date will be displayed on the website or mobile application. Material changes will be communicated where appropriate, and consent will be sought where legally required.