Skip to content
Request Consultation
Privacy and website data

Privacy Policy

Website privacy, cookie and similar-technology information for Impact Settlement Capital (Pty) Ltd.

Impact Settlement Capital (Pty) Ltd Registration No. 2020/819526/07 Privacy and cookie disclosures in one page
Cookie and consent information Privacy contact
1. Introduction

Introduction

This Policy sets out how Impact Settlement Capital (Pty) Ltd ("the Company") collects, uses, protects and discloses personal information, in accordance with the Protection of Personal Information Act, 4 of 2013 (POPIA) and, where relevant, the Financial Advisory and Intermediary Services Act, 37 of 2002.

The Company respects the privacy of the persons whose information it holds and is committed to processing personal information lawfully, transparently, and only for the purposes described in this Policy.

2. Definitions

Definitions

"Consent" means a voluntary, specific and informed expression of will by which permission is given for the processing of personal information.

"Data Subject" means the natural or juristic person to whom personal information relates, including a Client or a person who supplies the Company with goods or services.

"De-Identify" means to delete any information that identifies a Data Subject, or that could reasonably be used, whether alone or linked to other information, to identify the Data Subject.

"Direct Marketing" means approaching a Data Subject, in person, by mail or by electronic communication, to promote or offer goods or services, or to request a donation.

"Filing System" means any structured set of personal information, whether centralised, decentralised or dispersed, that is accessible according to specific criteria, including cloud-based infrastructure managed by the Company's Operators.

"Information Officer" means the person responsible for the Company's compliance with POPIA, assisted by any Deputy Information Officer, whose details are set out in Section 15.

"Operator" means a person who processes personal information for the Company under a contract, mandate or service level agreement, without coming under the Company's direct authority.

"Personal Information" means information relating to an identifiable, living natural person and, where applicable, an identifiable existing juristic person, including identity and contact details, financial information, and any Unique Identifier.

"POPIA" means the Protection of Personal Information Act, 4 of 2013.

"Processing" means any operation performed on personal information, whether or not by automatic means, including its collection, recording, storage, use, dissemination, merging, restriction, degradation, erasure or destruction.

"Record" means any recorded information, regardless of form or medium, including writing, electronic data, software, and photographs.

"Re-Identify" means to reconstruct information that has been De-Identified so that it once again identifies, or could reasonably be used to identify, the Data Subject.

"Unique Identifier" means an identifier assigned by the Company to a Data Subject, such as an account or client profile number.

3. Scope of Application

Scope of Application

This Policy applies to the Company's Board of Directors, all branches, business units and divisions, all employees, and all contractors, suppliers and other persons acting on the Company's behalf.

4. Collection and Use of Information

Collection and Use of Information

The Company processes personal information necessary to conduct its business and meet its statutory duties, including:

  • name, surname, identity or passport number, and demographic information;
  • contact details, including email address, telephone number, and physical and postal address;
  • entity name, registration number and VAT number, where the Data Subject is a juristic person;
  • financial profile, banking details, and source of funds information required under applicable financial sector regulations;
  • verification data and documentation required under the Financial Intelligence Centre Act, 38 of 2001 (FICA); and
  • website enquiry information submitted through the Company's online consultation form, including first name, surname, organisation/company, email address, telephone or WhatsApp number, area of enquiry, and any further information voluntarily provided in the enquiry field, together with the record of consent given to respond to the enquiry and any separate, optional consent given to receive future news and service updates from the Company.

The Company may monitor and record telephonic communications, electronic messages, and video conferences with its representatives, for quality control, staff training, transaction verification, and statutory record-keeping purposes.

6. Purpose of Processing

Purpose of Processing

The Company processes personal information only for specified, lawful purposes connected to its business as an authorised financial services provider, including:

  • performing onboarding assessments, carrying out Client instructions, administering accounts, and providing financial advice and intermediary services under the FAIS Act;
  • meeting statutory obligations, including customer due diligence, identity verification, anti-money laundering assessments, and reporting under FICA, and maintaining audit trails required by the FSCA; and
  • protecting the Company's security infrastructure, preventing fraud, managing risk, and establishing or defending legal claims.
  • responding to enquiries submitted through the Company's website consultation form, and recording the consent given by a Data Subject for the Company to respond to that enquiry; and
  • where a Data Subject has given separate, voluntary consent, sending that Data Subject news and updates about the Company's services
7. Direct Marketing

Direct Marketing

The Company does not send unsolicited Direct Marketing communications. Where a Data Subject submits the Company's website consultation form, they are given the option to provide separate, voluntary consent to receive future news and service updates from the Company, in addition to and independent of their consent for the Company to respond to their enquiry. Direct Marketing communications are sent only to Data Subjects who have given this consent, and a Data Subject may withdraw that consent at any time, free of charge

8. Retention and Destruction of Records

Retention and Destruction of Records

In accordance with section 14 of POPIA, the Company does not retain personal information indefinitely. Records are destroyed, deleted or de-identified once the purpose for which they were collected has been fulfilled, subject to the statutory retention periods below.

  • Financial Intelligence Centre Act, 38 of 2001: customer due diligence documentation, identity verifications, transaction records, and source of funds information are retained for a minimum of seven (7) years from the date a transaction is concluded or the business relationship ends.
  • Companies Act, 71 of 2008: corporate records, financial statements, share registers and governance minutes are retained for the statutory period of seven (7) years.

Once the applicable retention period has expired, or the purpose for holding the information has ceased, the Company securely destroys the record, whether by permanent deletion from its systems and those of its Operators, or by secure shredding of physical documents.

9. Disclosure and Operator Accountability

Disclosure and Operator Accountability

The Company does not sell, rent or trade personal information to any third party.

The Company may share personal information with its Operators, including third-party service providers, cloud infrastructure hosts, and compliance software vendors, who process information on its behalf under a written agreement.

In accordance with section 21 of POPIA, every such Operator is contractually bound to implement adequate technical and organisational security measures, and is prohibited from using or disclosing personal information for any purpose other than that instructed by the Company.

10. Cross-Border Transfers

Cross-Border Transfers

The Company may, from time to time, transfer personal information to Operators or cloud infrastructure providers located outside South Africa. Any such transfer complies with Chapter 9 of POPIA, including by confirming that the recipient is subject to a law, binding corporate rules, or agreement that provides an adequate level of protection effectively equivalent to that provided under POPIA.

11. Rights of the Data Subject

Rights of the Data Subject

On providing adequate proof of identity, a Data Subject may request that the Company:

  • confirm whether the Company holds personal information about them, and provide a record of it, including the identity of any Operators with access to it;
  • correct or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained;
  • delete a record the Company is no longer authorised to retain under Section 8;
  • object, on reasonable grounds and free of charge, to the processing of their personal information, including processing for Direct Marketing; and
  • object to a decision that has legal or similarly significant effect on them, and that is based solely on the automated processing of their personal information.

A request to exercise any of these rights must be submitted to the Information Officer at the contact details in Section 15. To protect the security of its records, the Company reserves the right to verify the identity and authority of the requesting party before acting on a request.

A Data Subject who remains dissatisfied is entitled to lodge a complaint with the Information Regulator:

12. Security Compromises and Breach Notification

Security Compromises and Breach Notification

The Company applies industry-standard encryption, firewalls and access controls to safeguard personal information, although no security measure can eliminate risk entirely.

Where the Company knows or reasonably suspects that personal information has been accessed or acquired by an unauthorised person, it will activate its incident response process.

In accordance with section 22 of POPIA, the Company will notify the Information Regulator, via the Regulator's eServices portal, and the affected Data Subjects, as soon as reasonably possible after the compromise is discovered. The notification will describe the nature of the compromise, the risks arising from it, the identity of the unauthorised person if known, and the steps taken to mitigate it.

13. Children's Information

Children's Information

The Company does not knowingly process the personal information of a child. Where information relating to a minor is provided to the Company, this is done only through, and with the consent of, a competent person as defined in POPIA.

14. Changes to this Policy

Changes to this Policy

The Company may update this Policy from time to time. The version published on the Company's website is the version in force, and the Document Version Control table on the cover of this Policy reflects the date it was last updated.

15. Contact Us

Contact Us

Information Officer Ryan Aufrichtig
Telephone +27 83 255 3014
Physical Address
107A Forrest Road, Atholl, Sandton, Johannesburg, 2196
16. Disciplinary Action

Disciplinary Action

Compliance with this Policy is a condition of employment and of any contractual mandate with the Company. Any employee, contractor or representative who wilfully or negligently breaches this Policy, or fails to adhere to the processing requirements of POPIA, will be subject to disciplinary action, which may, depending on the severity of the breach, range from a written warning to summary dismissal, termination of a contractual mandate, and civil or criminal proceedings where applicable.