Privacy Policy

Definitions

Personal information means any information relating to an identifiable person. Under POPIA we act as the responsible party, meaning we determine why and how your personal information is processed. An operator is a party that processes personal information on our behalf under our instructions, such as a hosting or verification provider. A data subject is you, the person the information is about.

Personal information we collect

The core categories are: your name, surname, email address, and phone number, collected through the registration and contact forms; identity details collected for verification, such as your ID document number and the document images themselves; address information for proof of residence; and transaction records generated when you fund, trade, or withdraw. Financial details such as card numbers are handled by payment providers and are not stored on our systems in full.

Usage data

When you visit the site we receive technical data: your IP address, browser type, device type, the pages visited, and the times of visits. This data keeps the service secure, helps diagnose faults, and supports the geo features such as displaying rand amounts. It is aggregated for analysis and is not used to build advertising profiles of you.

Cookies

The site uses a small number of cookies: strictly necessary cookies that keep your session working and remember your choices, functional cookies that carry preferences, and, where enabled, analytics cookies that count visits. You can refuse or delete cookies in your browser; strictly necessary cookies cannot be disabled without breaking core functions like login.

Responsible party and operators

Inves 21 is the responsible party for the personal information described in this policy. Processing that we do not perform ourselves is carried out by operators under written contracts that bind them to process only on our instructions and to apply security measures at least equivalent to ours. Operators never acquire the right to use your information for their own purposes.

Collection and use

We collect directly from you through forms, calls, and documents, and automatically through your use of the platform. We use the information to: open and verify your account, provide the services you registered for, communicate with you about your account, meet legal obligations including FIC Act record keeping and reporting, prevent fraud and secure the platform, and improve the service. Each purpose is pursued only with the information needed for it.

Lawful basis for processing under POPIA

Processing rests on the lawful bases recognised by POPIA: processing necessary to perform the contract with you (account opening and service delivery), processing required by law (identity verification, records, reporting), processing to protect your legitimate interests (fraud prevention), and processing for our legitimate interests in operating and securing the service. Where we send you marketing messages, we rely on your consent, and every marketing message explains how to withdraw it.

Retention of data

Account and identity records are kept for the periods required by South African law, including the record-keeping obligations of the FIC Act, and after that only as long as needed for legal defence. Transaction records are retained per statutory financial record requirements. Usage data that serves only analytics is aggregated or deleted within a short period. When retention ends, records are destroyed or de-identified securely.

Transfer of data

Some providers we rely on operate servers outside South Africa. Where personal information leaves the country, it is transferred only to parties bound by contractual protections consistent with POPIA's conditions for transfer, and only for the purposes described here. You may ask us which countries are involved for a given service by writing to the address at the end of this page.

Disclosure

We disclose personal information to: execution and custody intermediaries that need it to hold and move your assets, payment providers processing your deposits and withdrawals, verification providers checking your documents, IT providers hosting and securing the systems, affiliated companies involved in operating the service, and regulators, the FIC, or other authorities where the law requires or authorises it. We do not sell personal information, ever.

Security

Personal information is encrypted in transit and at rest, identity documents are stored separately from general account data, access follows a need-to-know basis, and the technical measures described on the Security page apply to this data as they do to everything else. No system is perfectly secure, and where a breach affecting your information occurs, affected clients are notified as POPIA requires.

Your rights as a data subject

POPIA gives you the right to: be notified what information is processed about you, access the personal information we hold, request the correction or deletion of inaccurate information, object to processing that rests on legitimate interests, withdraw consent for marketing at any time, and complain to the Information Regulator of South Africa if you believe your rights have been infringed. Requests are made to the contact address below; we respond within a reasonable period and may require proof of identity before acting, to protect your information from being released to the wrong person.

Service providers

The operators and service providers we use are chosen against security, availability, and data-protection criteria, are bound by written processing terms, and are reviewed periodically. The categories are listed in the Disclosure section above; the current list is available on request.

Analytics

We use analytics to understand which pages help users and where the service confuses them, in aggregate form. Analytics runs on first-party or privacy-configured tooling, and an analytics identifier is not combined with your identity data for profiling. Where a third-party analytics tool is enabled by the site operator, its presence is limited to counting and diagnostics.

Advertising and retargeting

The site itself does not run advertising retargeting on your personal information. If marketing messages are sent to registered clients, they are sent by us, on the basis of consent, with an unsubscribe route in every message, and never to people who have not registered or consented.

Links to third-party sites

Some pages link to external sites, for example payment providers or market references. Those sites have their own privacy practices, which we do not control and for which we are not responsible. Your use of them is governed by their policies, and it is worth reading them where you share information.

Children

The service is offered only to adults. We do not knowingly collect personal information from anyone under eighteen, and accounts are opened exclusively for adults whose identity is verified. If you believe a child's information has reached us, write to the address below and it will be deleted.

Changes and contact

This policy may be updated as the service or the law changes, and the current version is always published on this page. Material changes are announced to registered clients before they take effect. Questions, requests, and complaints about personal information go to Client Support and Compliance at [email protected], or by post to 2 Long Street, 4th Floor, Cape Town City Centre, Cape Town, 8001, South Africa. You also have the right to complain to the Information Regulator of South Africa.