We care about your privacy. As a responsible payment solutions service, secure processing of your personal information is of utmost importance to us. As such, we ensure that we process your personal information in keeping with laws and regulations that are aimed at protecting the integrity of your personal information.

Our Privacy Policy will assist you in understanding the manner in which your personal information is processed by us. Therefore it is necessary to read it carefully before you use our Payment System. You should not be using our Payment System if:

• you do not agree with any of the terms of our Privacy Policy stated below; or
• you do not have legal capacity to conclude legally binding contracts. We do not have any intention of collecting or processing personal information for individuals that do not have the legal capacity to conclude legally binding contracts. If we learn that we collected the personal information of a minor according to the jurisdiction, without first receiving a verifiable parental consent, we will take steps to delete the information as soon as possible.

By communicating electronically with us through the use of our Payment System, you confirm that you have read this Privacy Policy and that you consent to the manner in which we process your personal information as set out in this Privacy Policy.

In terms of our traditional method of payment, we collect the following information:

• Payment information - the name of the bank; bank account number; the cost of the good / service you are purchasing; and the seller of the goods /services you are purchasing.
• Device information - such as the IP address; and browser settings. In gaining device information we may use web traffic tools that permit us to analyse user activity.
• Information about how you interact with our Payment System.
• Geographical information.

In terms of our tokenised method of payment, we collect the following information:

• Payment information - the user name and password pertaining to your electronic banking profile, the name of the bank; bank account number; the cost of the good / service you are purchasing; and the seller of the goods /services you are purchasing.
• Device information - such as the IP address; language settings; browser settings; time zone settings; operating system; and platform and screen resolution. In gaining device information we may :
  • Recognise your device through cookies. Cookies are not harmful to your computer/device, nor are they able to be utilised to discover your identity. You are welcome to set your browser to notify you when you receive a cookie in order to allow you to decide if you want to accept the cookie or not, however, if you choose not to accept cookies from us, this may limit the full functionality of our tokenised payment method.
  • Use Web traffic tools that permit us to analyse user activity.
• Information about how you interact with our Payment System.
• Geographical information.

We provide more information below on how the personal information collected by us via the tokenised method of payment is processed and stored securely.

Reason we process your information	Legal basis for processing your information
To provide you with the full scope of our Payment System and appropriately automate your payment	Fulfil contractual obligations and pursue legitimate interests
For internal troubleshooting, data analysis, testing, research, and statistical purposes.	Pursue legitimate interests
To ensure that content is presented in the most effective manner for you and for your device.	Fulfill contractual obligations.
To carry out risk analysis, fraud prevention and risk management.	Comply with laws and pursue legitimate interests.
To improve our Payment System and for general business development purposes	Pursue legitimate interests.
To comply with applicable laws, such as anti-money laundering and regulatory requirements.	Comply with laws.

We process your data as needed to fulfil our contractual fulfilment towards you and as required by statutory retention periods or necessary to pursue our legitimate interests.

We undertake to collect and process your personal information in a reasonable manner, and in such a way that the processing is adequate, relevant and not excessive.

You may provide personal information to us when you use our traditional method of payment and our tokenised method of payment, as set out in item 3 above.

When you call /email us, we may monitor or record your calls / correspondence and details of the phone number(s) you use to make the calls / send the email. This information is used to better address your customer service needs.

Credit bureaus and similar providers:

Your personal information may be shared with credit bureaus, providers of identity lookups and fraud prevention agencies to comply with our regulatory obligations and to protect you and other customers from fraud.

Ozow group:

Your information may be shared with companies within the Ozow group.

Authorities:

Ozow may disclose necessary information to authorities, such as regulatory bodies, if we are required by law or you agreed to it (for instance, for anti-money laundry or counter-terrorism).

Divestments:

Ozow may transfer any personal information we hold about you to any entity involved in a re-organisation of Ozow (where such re-organisation may be by way of a merger, sale, dissolution, disposal of all or part of our assets or similar event).

Merchants of the Ozow group:

As part of our tokenised method of payment, your personal information will only be shared with Ozow merchants to the extent necessary to process your payment by way of tokenisation in a secure manner.

We strive to process your data within South Africa. The data may however in certain situations be transferred to, and processed in, a destination outside of South Africa by an Ozow group company, partner, supplier or subcontractor where the data privacy laws, regulations and standards, may not be equivalent to the laws in your country of residence.

We might transfer your personal information to places outside of South Africa and store it there, where our suppliers might process it. If that happens, we require our suppliers to apply the same security standards as when we process your information in South Africa.

Your consent to this privacy policy followed by your submission of personal information to us, represents your agreement to such transfer.

Ozow will ensure all reasonable contractual, legal, technical, and organisational measures are taken to adequately secure your personal information.

The time periods for which we keep your personal information may vary according to the use or purpose attached to the information. Unless there is a specific legal requirement requiring us to keep your information, however, we will not keep it for longer than necessary for the purpose for which the information was collected or for which it is to be processed.

We are committed to implementing leading data security safeguards.

We have specialised security teams who constantly review and improve our measures to protect your personal information from unauthorised access, accidental loss, disclosure or destruction, and ensure that your personal information is only utilised and stored by us solely in an authorised manner.

Ozow has taken due cognisance of the Payment Card Industry Data security standard (PCI DSS), this being a set of security standards designed to ensure that all companies that accept, process, store or transmit credit card information maintain a secure environment. Given that Ozow does not effect credit card payments, PCI DSS certification is not strictly required. However, Ozow has taken an extremely cautious approach to security by being PCI DSS Level 1 compliant, ensuring that it maintains the same security features as industry players that actually effect credit card payments.

Ozow has an EV SSLCertificate issued by Thawte under which traffic is encrypted between users and servers so as protect against interception of your sensitive data.

In addition, the internet banking second factor authentication still applies to you when making a payment using the Payment System, further preventing any fraudulent interception when payment is being made

As regards the tokenised method of payment, Ozow ensures secure storage of user login credentials by storing encrypted fragments of the login details in multiple locations, one of which is stored by an external party (either the merchant or yourself) which is required to initiate the payment. Without all of the fragments, it would be impossible to reconstruct the login details. Ozow also requires you to create an Ozow PIN which, if entered incorrectly 3 times, will cause Ozow to delete all encrypted data it has regarding your login details. Ozow’s tokenised payment method has been audited by reputable cyber security firms in South Africa. It also should be noted that Ozow has ensured that merchants that have access to our tokenised method of payment have confirmed that they implement security standards in the storage of your personal information in accordance with applicable legislation and leading data security safeguards.

Your legal rights pertaining to your personal information will always be respected by us.

In the event that you would like – (i) access to your personal information; (ii) to correct or amend your personal information; (iii) to request the deletion of your personal information; (iv) to object to the processing of your personal information; or (v) to have your personal information deleted, you may contact us using one of the following methods:

Email: support@Ozow.com

Written request: 30 Melrose Boulevard, Mezzanine Level, Off MO213, Melrose Arch, Melrose North, Johannesburg, Gauteng, South Africa, 2196.

Telephone request: 011 054 4744

Upon the provision by you of adequate documentation that we deem sufficient to support your identity, we will inform you of the changes that we are legally capable of making to your personal information, as permitted by applicable legal and ethical reporting standards imposed on us.

Our Payment System is not intended for use by anyone under the age of 18 ("Children").

We do not knowingly collect personally identifiable information from anyone under the age of 18. If you are a parent or guardian and you are aware that your Children have provided us with personal information, please contact us. If we become aware that we have collected personal information from Children without verification of parental consent, we take steps to remove that information from our Platforms or Products.

Our Website as well as Merchant Websites may contain hyperlinks to websites that are not operated by us. These hyperlinks are provided for your reference and convenience only and do not imply that we endorse these websites, nor can we confirm the adequacy of the privacy policies of the third parties that operate such websites.

Ensure that you have gained the necessary comfort regarding the legality of such websites, together with their privacy policies prior to your use of such websites.

We may update our privacy policy from time to time. Any changes to this privacy policy will be posted on our Website.

You are advised to visit our Website periodically and review our privacy policy. Changes to our privacy policy are effective from when they are posted on our Website.

Any queries regarding this Privacy Policy or any aspects of our Payment System may be made by emailing legal@ozow.com or sending a written letter to the address set out in Item 7 above. We will store any correspondence from you at our offices.

This Privacy Policy and all disputes and claims arising from it shall be governed by and construed in accordance with South African law.