Privacy Policy & PAIA Manual

The personal information we collect

Personal information refers to any information that identifies You or specifically relates to You. Personal information that We may process under this Notice includes:

• Your name and surname / company name and registration number;
• financial history (e.g. income, expenses, obligations, assets and liabilities or buying, investing, lending,
• marital status (married, single, divorced); national origin; age; language; birth; education;
• identifying number (e.g. an account number, identity number or passport number);
• email address; physical address (e.g. residential address, work address or physical location); telephone number; and
• insurance, banking and money management behaviour or goals and needs based on, amongst others, account transactions);

A juristic person (a company, trust or association for example) may also have personal information protected in law and may be processed in terms of this Notice.

We may process personal information relating to the juristic person’s directors, officers, employees, shareholders, members, representatives, guarantors, sureties, spouses of sureties, other security providers and other persons (“Related Persons”).

In the event of You providing personal information of a Related Person, You warrant that the Related Person is aware that they are sharing their personal information with the Us, and that the related person has consented to it.

We will process the personal information of Related Persons as stated in this Notice; thus, references to You in this Notice will include related persons with the necessary amendments.

The purpose for which personal information is being collected

We collect personal information to:

• Assess and process Your applications to use Our Funding Solutions;
• Conduct affordability assessments, credit assessments and credit scoring;
• To facilitate account creation and the logon process
• manage and maintain Your account;
• To verify your identity where required; 
• Communicate with You and carry out instructions and requests;
• Respond to enquiries and complaints;
• Enforcing any agreement if You are in breach of the agreement;
• Disclose and obtain personal information from credit bureaux regarding Your credit history;
• Comply with Our record-keeping obligations;
• Conduct market and behavioural research;
• Run customer satisfaction surveys, promotional and other competitions;
• Comply with Our legal and regulatory obligations; and
• any other related purposes.

The supply of personal information by You to Us is voluntary and not mandatory.

If You do not provide Us with the personal information that We require, We cannot provide any Solution to You.

Legal basis for processing your data

We process Your personal information for these purposes for Our legitimate business interests and in order to allow You to enter Our Platform and/or to enter into a contract with You, with Your consent, and in order to comply with our legal obligations.  

This Privacy Policy is governed by the laws of the Republic of South Africa. You agree to submit the personal and exclusive jurisdiction of the courts located within South Africa.

Sources we use to collect personal information

We collect personal information from the following sources:

• directly from You;
• from public sources (such as company registers, online search engines, deed registries, public posts on social media);
• from technology, such as a customer’s access and use including both assisted and unassisted interactions; and
• from third parties that the We interact with to conduct Our business (such as partners, online partners, credit bureaux, regulators and government departments or service providers).

How long do we keep your personal information

We keep Your personal information for as long as:

• the law requires Us to keep it;
• a contract between Us requires Us to keep it;
• you have consented to Us keeping it;
• we are required to keep it to achieve the purposes listed in this Notice;
• we require it for statistical or research purposes;
• we require it for lawful business purposes.

We may keep Your personal information even if You no longer have a relationship with Us and despite Your request for Us to delete or destroy Your personal information if the law permits or requires Us to keep this information. 

Use of personal information for marketing purposes

We will use Your personal information to market other solutions to You.

You can at any stage request Us to stop sending marketing communications to You.

Use of personal information to make automated decisions

An automated decision is made when Your personal information is analysed without human intervention in that decision-making process.

An example of automated decision making is the approval or declining of an application when You apply for one of Our Funding Solutions.

You have the right to query any such decisions made, and We may provide reasons for the decisions as far as is reasonably possible

How do we store your personal information

We take all reasonable and appropriate measures to ensure that Your Personal Information is safeguarded and secure. 

We have reasonable standards of technology and operational security in place to attempt to prevent loss or misuse of any Personal Information. 

Any of our authorised employees who are responsible for the maintenance of any special Personal Information submitted by You are requested to maintain the confidentiality of such information unless You have consented to disclosure.

Whenever We employ third parties to assist Us, We will bind them to our privacy policies as far as they may be required to have access to Your personal information to perform such services. 

Our Website may contain links to or from other sites. We try to link to sites that share our high standards and respect for privacy, We are however not responsible for the content or the security or privacy practices employed by other sites. 

The transmission of information via the internet is not completely secure, however, and we cannot guarantee the security of the information You transmit to Our Website or Platform.

Transmission of your information to ourwebsite is at your own risk.

Once We have received your information, We will use strict procedures and security features to prevent unauthorised access.

We will keep your personal information for only a reasonable amount of time, to enable Us to use it for the purposes described in this policy and under applicable law.

How your information is used and disclosed

We may use the information (including personal information) We hold about You in these ways:

• to ensure that content from Our Website is presented in the most effective manner for You and for your computer;
• in aggregate and de-identified form, for internal business purposes such as generating statistics and developing Our strategic and marketing plans;
• to determine how You interact with the Website and the Platform and based on this information to market Our Solutions to You;
• to allow You to participate in interactive features of Our Platform when You choose to do so;
• to carry out any contracts that We conclude with You;
• to respond to any queries You make;
• to notify You about changes to Our Solutions;
• To monitor user activity such as keyword searches or new postings, and more effectively manage traffic on Our Website;
• to provide customer services and create and manage user accounts; and
• to assist You with technical difficulties.

Also, we may share with third-party service providers certain information, such as your browser capabilities or operating system, that we have collected to understand better which advertisements and services may interest you.

We may block users in certain countries from using Our Website. 

We will not disclose personal information to anyone outside Our company or Our third parties service providers without Your permission unless:

• We are compelled to do so by law or in terms of a court order;
• it is in the public interest to do so;
• it is necessary to protect Our rights.

We may retain certain personal information for as long as required to fulfil Our business objective and as permitted by law, even after your account is terminated.

Right to access and rectify personal information

You have the right to access Your Data through Our Platform or other customer support channels. 

You may make changes to or correct inaccurate personal information that You provide Us. It is Your responsibility to ensure all information provided is accurate. 

Any requests for changes or corrections will be actioned as soon as reasonably possible.  

Right to objection

You may object on reasonable grounds to the processing of Your personal information where the processing is in Your legitimate interest, Our legitimate interest or in the legitimate interest of another party.

You must inform Us of Your objection in the prescribed manner.

We will not be able to give effect to Your objection if:

• the processing of Your personal information was and is permitted by law;
• You provided consent to the processing, and the Our processing was conducted in line with Your consent; or
• the processing is necessary to conclude or perform under a contract with You.

Right to withdraw consent / Right to be forgotten

Where You have provided Your consent for processing your personal information, including any consent in respect of Related Persons, You may withdraw Your consent and request Your personal information to be deleted If You withdraw Your consent, We may not be able to provide the Funding Solutions to You. We will action your request as soon as reasonably possible and to the extent permitted by law. 

Right to complain

You have the right to file a complaint with the Information Regulator about an alleged infringement of the protection of Your personal information.

The contact details of the Information Regulator are provided below.

JD House, 27 Stiemens Street

Braamfontein

Johannesburg

2001

P.O Box 31533

Braamfontein

Johannesburg

2017

Tel no. +27 (0)10 023 5200

Website: https://inforegulator.org.za/

Privacy policy changes

This policy is reviewed regularly and any changes will be posted clearly on Our website. 

We reserve the right to change, modify, add or remove portions of these terms at any time.  

Data protection officer / Information officer

Our appointed Data Protection Officer, Neil Welman can be contacted at neil@lulalend.co.za 

PAIA Manual

General

All requests for access to records in terms of PAIA must be in writing in terms of this PAIA Manual and must be addressed at the contact details below.

You can find a copy of this PAIA Manual on Our Website – https://lula.co.za/privacy-policy.

We can amend this PAIA Manual from time to time by publishing updates on Our Website.

Contact details

Contact person: Neil Welman

Postal address: 3rd Floor Pier Place, Heerengracht Street, Cape Town, 8000

Physical address: 3rd Floor Pier Place, Heerengracht Street, Cape Town, 8000

Phone number: 087 943 2381

Email: neil@lulalend.co.za

Guides

The South African Human Rights Commission (SAHRC) has compiled the guide contemplated in Section 10 of PAIA, which contains such information as may reasonably be required by a person who wishes to exercise any right contemplated in PAIA.

Copies of PAIA and POPIA, the relevant regulations and guides to these acts, can be obtained from the SAHRC or the information regulator and queries should be directed to:

The South African Human Rights Commission: 

PAIA Unit 

Braampark Forum 3 

33 Hoofd Street 

Braamfontein 

Phone number: +27 (11) 877 3608 

Fax number: +27 (11) 484 0582 

E-mail: PAIA@sahrc.org.za 

Website: http://www.sahrc.org.za

Records available without having to request access under PAIA:

• any promotional material for public viewing; and
• information relating to Our Solutions.
• Employees do not need to use the PAIA process to obtain the following records:

• records provided by a third party relating to employees;
• conditions of employment and other employee-related contractual and quasi-legal records;
• internal evaluation records and other internal records; 
• correspondence relating to employees; and
• training schedules and material.

Records that you can only access after requesting the records under PAIA

Customer records

• records provided by a customer to a third party acting for or on behalf of Us;
• records provided by a third party; and
• records generated by Us relating to Our customers, including transactional records.

Private records

• Financial records
• Operational records
• Databases
• Information technology
• Internal and external correspondence
• Statutory records
• Internal policies and procedures

Legislation that applies to us that require record retention include:

• Basic Conditions of Employment Act, 75 of 1997
• Companies Act, 71 of 2008
• Employment Equity Act, 55 of 1998
• Financial Intelligence Centre Act, 38 of 2001
• Income Tax Act, 58 of 1962
• Insurance Act, 18 2017
• Labour Relations Act, 66 of 1995
• Unemployment Insurance Act, 30 of 1966
• Value-Added Tax Act, 58 of 1962

An excerpt of the relevant legislation setting out a description of the records of the group will be provided on request.

POPI

If You want to find out more about the following aspects relating to the processing of personal information, You can access Our Privacy Policy:

• the purpose of the processing personal information;
• a description of the categories of data subjects and of the information or categories of information relating thereto;
• the recipients or categories of recipients to whom the personal information may be supplied;
• planned transborder flows of personal information; and
• a general description allowing a preliminary assessment of the suitability of the information security measures to be implemented by Us to ensure the confidentiality, integrity and availability of the information which is to be processed.

How to get access to records

There are two different types of requesters:

Personal requesters

Personal requester is a requester who is seeking access to a record that relates to their personal information.

Other requesters

Other requester is a requester who is seeking access to a record that relates to third parties. 

The requester must fulfil the prerequisite requirements for access in terms of PAIA before We will consider a request for access to records.

If a public body lodges a request, the public body must be acting in the public interest and provide details of the public interest that it is seeking to protect.

Request procedure

The following procedural requirements serve as guidelines for requestors:

• The requester must comply with all the procedural requirements in PAIA relating to the request for access to a record.
• The requester must complete the prescribed form and submit the form to Our information officer.
• The prescribed form must be completed with sufficient detail to at least enable the information officer to identify–

1. the record or records requested;
2. proof of identity of the requester;
3. which form of access is required, if the request is granted; and
4. postal address or email address of the requester.

• The requester must state that the information is required in order to exercise or protect a right, and clearly indicate what the nature of the right is to be exercised or protected. In addition, the requester must clearly specify why the record is necessary to exercise or protect such right.
• If a request is made on behalf of another person the requester must state this and submit proof of the capacity the requester is requesting to the reasonable satisfaction of Our information officer.

We will process the request within 30 days from when the request is received and the fee is paid.

We can refuse to provide access to any record if there is a legal obligation on Us to protect information contained in the record.

If You are dissatisfied with Our refusal to grant access, You may, within 30 days of notification of the decision, apply to a competent court for relief.

Third-party records

Where a requester has requested access to information of a third-party, the third-party concerned  must be given 21 days:

• to make representations to refuse access; or 
• to give written consent for the disclosure of the record to the requester.

We will inform both the Requester and the third party if We provide access as requested in the prescribed manner.

Records not found

If all reasonable steps have been taken to find a record and such record cannot be found or the record does not exist, then We will notify the requester, by way of an affidavit or affirmation, that it is not possible to give access to the requested record.

The affidavit or affirmation will provide a full account of all the steps taken to find the record or determine its existence, including details of all communications by Us with every person who conducted the search.

The above notice will be regarded as a decision to refuse a request for access to the record concerned for purposes of PAIA.