Lula strives to uphold the Constitution of the Republic of South Africa, 1996 (“the Constitution”), and is dedicated to protecting and respecting the rights enshrined in the Bill of Rights.
Section 32 of the Constitution grants all citizens the right to access information necessary for the protection or exercise of their rights.
This Manual has been compiled by Lula, a private body as defined in the Promotion of Access to Information Act (2 of 2002) (“the Act”), in compliance with the requirements of Section 51 of the Act as well as Section 17 of the Protection of Personal Information Act (4 of 2013) (“POPIA”).
The Act gives effect to the constitutional right to information, and both the Act and POPIA mandate private bodies to document all their processing operations.
Definitions
The following definitions apply in this manual:
“Act” means the Promotion of Access to Information Act (2 of 2000), together with all relevant regulations;
“Data Subject” means the person to whom personal information relates.
“Information Regulator” means the regulator established in terms of the Protection of Personal Information Act (4 of 2013) (“POPIA”):
“Manual” means this Manual, which is available on our website.
“Personal Information / PI” means information relating to an identifiable, living, natural person and where it is applicable, an identifiable, existing juristic person; as defined in POPIA.
“Record” means any recorded information held by Lula regardless of form or medium and whether or not it was created by Lula.
“Requester” means any person, including, but not limited to, a public body or an official thereof, or any person acting on behalf of such a person requesting access to a record of Lula.
Purpose
This manual provides an outline of the types of records and PI held by Lula and sets out the procedure to request access to this information, the requirement to meet such requests, as well as the grounds for which Lula may refuse or partially refuse such requests.
Additionally, this manual explains how to access, correct and object to the processing of PI held by Lula in terms of Sections 11 and 23 – 25 of POPIA.
Contact details of information officer and deputy information officer:
| Address: | 3rd Floor Pier Place, Heerengracht Street, Cape Town, 8000 |
| Telephone: | 087 250 0014 |
| Email: | popreg@lulalend.co.za |
| Information Officer:
Deputy Information Officer: |
Andrew Keggie
Chief Information Officer popreg@lulalend.co.za Eduan Coetzee Head of Data Engineering popreg@lulalend.co.za |
| Privacy statement | https://lula.co.za/privacy-policy/ |
Guide on how to use the Act
The Information Regulator has updated and made available the guide that was compiled by the South African Human Rights Commission that contains information as may reasonably be required by a person who wishes to exercise any right contemplated in the Act and POPIA.
A copy of the guide is available on the following link. A copy of the guide available in all official languages can be obtained from the Information Regulator who may be contacted at:
| Address: | JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 0001
P.O Box 31533, Braamfontein, Johannesburg, 2017 |
| Telephone: | 010 023 5200 |
| Email: | General queries:
enquiries@inforegulator.org.za |
Categories of records automatically available
All records regarding the advancing of funds (including funding applications), terms and conditions, customer records, and statements of accounts are available to a Requester with a Lula account without having to request these records in terms of the Act.
Additionally, all records regarding the opening and managing of transactional bank accounts, terms and conditions, customer records and statements of accounts are available to a Requester with a Lula Bank account.
These records may be requested by contacting Lula on the following details: support@lula.co.za, as well as by accessing their user profile on the relevant product portal once they have logged in. Lula may require receipt of positive proof of identification from the Requester during this process.
Records available in accordance with any other legislation
Lula keeps information or documents in accordance with legislation listed in Annexure A, as amended or replaced from time to time and it should be noted that this is not an exhaustive list.
Request for access to records
1. Who may submit a request?
Any person who requires access to a record for the exercise or protection of any rights may submit a request for information from a private body, provided that:-
- the request is submitted as per the procedure set out in this manual; and
- there are no grounds for refusal of access to record;
2. Procedure to request access to records that are not automatically available:
A completed copy of the prescribed form (Form 2 available here) must be provided to Lula via email sent to: popreg@lulalend.co.za
The form should include all information necessary for the Information Officer to identify the Requester and locate the records being requested.
Grounds for refusal of access:
The circumstances under which a request for access to records may/must be refused by Lula is set out in Chapter 4 of the Act and includes the following:
(a) mandatory protection of privacy of a third party who is natural person;
(b) mandatory protection of commercial information of a third party;
(c) mandatory protection of certain confidential information of a third party;
(d) mandatory protection of safety of individuals, and protection of property;
(e) mandatory protection of records privileged from production in legal proceedings;
(f) commercial information of Lula;
(g) mandatory protection of research information of a third party, and protection of research information of Lula.
Outcome of request:
The request will be processed within thirty (30) calendar days of receipt of the request by Lula, unless the request is of such a nature that an extension of the 30 day limit is necessary. Lula will notify the Requester should such an extension be required.
The Information Officer / Deputy Information Officer will provide the Requester with written notice, as per Form 3 available here, of the outcome of the request made.
Should the request be granted, this notification will include any fees payable or, where applicable, any deposit that will have to be paid in order for the required records to be retrieved / reproduced.
If the request is refused, the Requester will be informed in writing, as outlined in Annexure C, with the notification detailing the reasons for the refusal.
Fees:
Lula may require payment of the required fees before any access to the records will be provided or reproduction of records, should the request for access be granted.
If, in the sole discretion of the Information Officer / Deputy Information Officer, Lula requires more than six hours to search for, and prepare, the requested records, the written notification of the outcome of the request will include the payment of a deposit as a portion of the access fee.
The full list of the fees payable may also be found on Form 3 available here.
Protection of personal information:
| Category of Data Subject | Main types of Personal Information processed |
| Customers and visitors | Name, contact information, identification
information, employment information, banking details, credit information, Lula website preferences, marketing preferences, information related to entitled being represented and any other information required to carry out a legal duty or contractual obligation. |
| Employees | The same categories as customers but includes other information relating to the employment and
possible employment relationship with Lula, and any other information required to carry out a legal duty or contractual obligation. |
| Service providers and third
parties |
Name or company information, contact
information, banking details and any other information required to carry out a legal duty or contractual obligation. |
Lula may process PI for the following purposes:
- Onboarding of customers and processing of applications for business funding, banking accounts, and other financial products or services we offer;
- Performing any duties in terms of any agreement concluded with our customers and their businesses;
- Conducting creditworthiness assessments and manage credit risk for our customer’s business;
- Managing customers’ accounts which includes various correspondences addressed to such customers;
- Conducting market research, statistical analysis and making strategic business decisions;
- Recovering debt owed to us;
- To enforce our terms and conditions, agreements, or other legal rights;
- Marketing any products or offerings to customers which may be of interest to them;
- Ensuring that the legitimate interests of Lula or the Data Subject concerned are protected;
- Managing our relationship with Lula employees, service providers and third parties for operational reasons.
Categories of recipients of PI
Instances in which Lula may share your PI with third parties may be due to regulatory / legal obligations, business obligations or service providers in order to provide you with products or services. This will include the following:
- Credit Bureaus;
- Law enforcement, regulatory authorities, and/or other government bodies;
- Regulatory bodies (such as the Financial Intelligence Centre (FIC), the South African Reserve Bank (SARB), the Financial Sector Conduct Authority (FSCA), the South African Revenue Service (SARS)), law enforcement agencies, courts, tribunals, or other governmental bodies when required to do so by law, court order, or other legal process, or if we believe in good faith that such disclosure is necessary to comply with a legal obligation, protect our rights or property, or ensure the safety of our customers or the public;
- Debt Collection Agencies;
- Service providers, contractors and third parties as required for Lula’s business to function;
Cross-border transfer of your PI:
In order to provide our products and services, your personal information may be transferred to and processed in countries outside of South Africa, including where our third-party service providers operate.
Lula is committed to ensuring any such international transfer complies with POPIA and that the countries where your information is transferred has adequate data protection laws and/or that the transfer is in terms of an agreement which provides for an adequate level of protection.
Technical and organisational security to keep your PI secure:
Lula is committed to protecting its customer’s PI by implementing appropriate, reasonable technical and organisational measures to prevent its loss, damage, unauthorised destruction, or unlawful access.
These include technological, physical, and procedural safeguards designed to secure your data and Lula’s security practices are regularly reviewed and updated to address evolving risks.
Rights of Data Subject
To object to the processing of personal information in terms of section 11 (3) of POPIA or
to request the correction or deletion of personal information or the destruction or deletion
of a record of personal information in line with section 24(1) of POPIA, a data subject can follow the process set out above under “Request for Access” and complete the relevant forms that may be found here and here respectively .
For any further details, please refer to Lula’s Privacy Statement which is available on our website.
Availability of this manual:
A copy of this manual can be obtained from Lula’s website as well as being available at our offices at reception, Floor 2, Pier Place, Heerengracht Street, Foreshore, Cape Town, 8000.
Annexure A – list of laws
| Administration of Estates Act, No. 66 of 1965 | Financial Sector Regulation Act No. 9 of 2017 |
| Arbitration Act No. 42 of 1965 | Intellectual Property Laws Amendments Act No. 38 of 1997 |
| Banks Act No. 94 of 1990 | Labour Relations Act No. 66 of 1995 |
| Basic Conditions of Employment No.75 of 1997 | National Credit Act No. 34 of 2005 |
| Broad Based Black Economic Empowerment Act
No. 53 of 2003 |
Occupational Health & Safety Act No. 85 of 1993 |
| Companies Act No. 61 of 1973 | Prevention and Combating of Corrupt Activities
Act No. 12 of 2004 |
| Companies Act No. 71 of 2008 | Promotion of Access to Information Act No. 2 of 2000 |
| Compensation for Occupational Injuries and
Diseases Act No.130 of 1993 |
Protected Disclosures Act No. 26 of 2000 |
| Competition Act No. 89 of 1998 | Protection of Businesses Act No. 99 of 1978 |
| Consumer Protection Act No. 68 of 2008 | Protection of Personal Information Act No. 4 of
2013 |
| Copyright Act No. 98 of 1978 | Regulation of Interception of Communications
and Provision of Communication Related Information Act No. 70 of 2002 (as amended) |
| Criminal Procedure Act No. 51 of 1977 | SA Reserve Bank Act No. 90 of 1989 |
| Currency and Exchanges Act No. 9 of 1933 | Securities Services Act No. 36 of 2004 |
| Debt Collectors Act No. 114 of 1998 | Securities Transfer Tax Act no.25 of 2007 |
| Employment Equity Act No. 55 of 1998 | Skills Development Levies Act No. 9 of 1999 |
| Electronic Communications and Transactions Act
No. 25 of 2002 |
Skills Development Act No. 97 of 1998 |
| Financial Advisory and Intermediary Services Act
No. 37 of 2003 |
Standards Act No. 29 of 1993 |
| Financial Intelligence Centre Act No. 38 of 2001 |