Privacy Policy

1. WHAT INFORMATION DO WE COLLECT?

Personal Information You Disclose to Us

In Short: We collect personal information that you voluntarily provide to us.

We collect personal information that you voluntarily provide when you register on our Services, express an interest in our products, participate in platform activities, or otherwise contact us. The personal information we collect depends on the context of your interaction with us and the features you use.

Personal Information Provided by You. The personal information we collect may include:

• Full name
• Email address
• Phone number
• Username and password (stored in encrypted form)

Sensitive Information. We do not process sensitive personal information.

Social Media Login Data. If you choose to register or log in using a social media account (such as Facebook or X), we will collect certain profile information from that provider. See Section 5 for details.

Application and Device Data

In Short: We automatically collect certain technical data when you use our app or website.

When you use the PayFast mobile application or website, we may automatically collect:

• Mobile device ID, model, and manufacturer
• Operating system version and configuration
• Internet Protocol (IP) address or proxy server
• Browser type and version
• App usage data and features accessed
• Mobile carrier and network information

This information is primarily needed to maintain the security and operation of our application, for troubleshooting, and for internal analytics and reporting purposes.

Push Notifications

We may request permission to send you push notifications about your account or platform activity. You may opt out at any time through your device settings.

All personal information you provide must be true, complete, and accurate. Please notify us promptly of any changes to your personal information.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to operate, improve, and secure our Services, and to comply with applicable law.

We process your personal information for the following purposes:

• To create and manage your account, and to authenticate your identity when you log in
• To facilitate and process gift card transactions on our platform
• To improve platform performance, features, and user experience
• To communicate with you, including sending transaction confirmations, service updates, and support responses
• To detect, investigate, and prevent fraudulent activity and protect the security of our platform and users
• To comply with applicable laws, regulations, and legal processes
• To protect the vital interests of our users and third parties where necessary
• To fulfill any other purpose with your consent, where required by law

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?

In Short: We only process your personal information when we have a valid legal basis to do so under applicable law.

We process your personal information only when necessary and only when we have a valid legal reason. Depending on your location, our legal bases may include:

Consent. We may process your information if you have given us clear permission for a specific purpose. You can withdraw your consent at any time by contacting us at support@mypayfast.com. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.

Contractual Necessity. We may process your information when necessary to fulfill our contractual obligations to you—for example, to provide the Services you have signed up for.

Legal Obligations. We may process your information when required to comply with applicable law, cooperate with law enforcement or regulatory agencies, or exercise our legal rights in litigation.

Legitimate Interests. We may process your information for our legitimate business interests, including fraud prevention, platform security, and improving our Services, provided those interests are not overridden by your rights.

Vital Interests. We may process your information when necessary to protect your safety or the safety of another person.

If you are located in the EU, UK, or Switzerland, the GDPR and UK GDPR apply to our processing of your personal information. You may contact your local data protection authority if you believe we are processing your data unlawfully.

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We may share your information in specific, limited situations described below. We do not sell your personal data.

We may share your personal information in the following circumstances:

• Service Providers. We may share your data with third-party vendors and service providers that perform services on our behalf—such as payment processing, hosting, analytics, customer support, and fraud detection. These providers are contractually bound to protect your data and may only use it to provide services to us.
• Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business by another company.
• Legal Requirements. We may disclose your personal information where required to do so by law, in response to a lawful request by a court, regulator, or government authority, or to protect our legal rights.
• Protection of Rights. We may disclose your information when we believe disclosure is necessary to investigate, prevent, or respond to potential violations of our Terms of Service, illegal activity, or situations involving a threat to the safety of any person.

We do not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes.

5. HOW DO WE HANDLE YOUR SOCIAL LOGINS?

In Short: If you log in using a social media account, we receive limited profile information from that provider.

Our Services allow you to register and log in using your existing social media account credentials, such as Facebook or X (formerly Twitter). If you choose to do this, we will receive certain profile information from your social media provider. The information we receive typically includes your name and email address, and may vary depending on the provider and your privacy settings.

We use this information solely to create or access your PayFast account and for no other purpose. We do not control how your social media provider collects, uses, or shares your data, and we are not responsible for their practices. We recommend reviewing the privacy policy of any social media platform you use to log in.

6. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We retain your information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer period is required or permitted by law.

We will only keep your personal information for as long as your account remains active or as needed to provide our Services. We may retain certain data for longer periods where required by law—for example, for tax, accounting, or compliance purposes.

When your personal information is no longer needed for any lawful purpose, we will either delete it permanently or anonymize it so it can no longer be associated with you. If deletion is not immediately possible (for example, because data is stored in backup archives), we will securely isolate the data and prevent any further processing until deletion is feasible.

7. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We implement appropriate technical and organizational security measures, but no system can be guaranteed to be 100% secure.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect your personal information from unauthorized access, loss, misuse, or alteration. These measures include encryption of data in transit and at rest, access controls, and regular security assessments.

However, no electronic transmission over the internet or information storage technology can be guaranteed to be completely secure. We cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to circumvent our security measures. Transmission of personal information to and from our Services is therefore at your own risk. We encourage you to access our Services only within a secure network environment and to use a strong, unique password for your account.

8. DO WE COLLECT INFORMATION FROM MINORS?

In Short: We do not knowingly collect data from or market to children under 18 years of age.

PayFast is not directed at or intended for users under the age of 18. We do not knowingly collect, solicit, or process personal information from anyone under 18 years of age. By using our Services, you represent that you are at least 18 years old.

If we learn that we have collected personal information from a user under 18, we will immediately deactivate that account and take prompt steps to delete the data from our records. If you believe we may have inadvertently collected information from a minor, please contact us at support@mypayfast.com.

9. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: Depending on your location, you may have rights to access, correct, restrict, or delete your personal data, and to withdraw consent.

Depending on where you are located, applicable data protection laws may grant you certain rights regarding your personal information. These may include:

• The right to access your personal data and receive a copy of it
• The right to correct or update inaccurate or incomplete personal data
• The right to request deletion of your personal data (subject to certain exceptions)
• The right to restrict or object to the processing of your personal data
• The right to data portability—to receive your data in a structured, commonly used format
• The right to withdraw consent at any time where processing is based on consent
• The right not to be subject to automated decision-making that significantly affects you

How to Exercise Your Rights

To exercise any of your privacy rights, log in to your account settings or contact us at support@mypayfast.com. We will respond to your request in accordance with applicable data protection law within a reasonable timeframe.

Account Information

You may review or update your account information at any time through your account settings. Upon a verified request to delete your account:

• We will deactivate and delete your account and associated data from our active systems
• We may retain certain information in our records where required by law, for fraud prevention, or to enforce our legal terms

EU, UK, and Swiss Residents

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (GDPR) or equivalent laws. If you believe we are unlawfully processing your personal data, you have the right to lodge a complaint with your local data protection authority.

10. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") feature that you can activate to signal your preference not to have your browsing activity monitored. At this time, there is no uniform technology standard for recognizing and implementing DNT signals, and we do not currently respond to DNT browser signals or other automated opt-out mechanisms.

If an industry standard for online tracking is adopted in the future that we are required to follow, we will update this Privacy Policy to reflect that practice.

11. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: Residents of certain US states may have additional rights regarding their personal information under state privacy laws.

If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, or Virginia, you may have additional rights under applicable state privacy laws.

Categories of Personal Information We Collect

In the past twelve (12) months, we have collected the following categories of personal information:

• Identifiers: such as name, email address, phone number, IP address, and account credentials — YES
• Personal information under California Customer Records statute: name and contact information — YES
• Protected classification characteristics: (e.g., race, gender, age) — NO
• Commercial information: (e.g., transaction history, purchase records) — NO
• Biometric information: — NO
• Internet/Network activity: (e.g., browsing history, ad interactions) — NO
• Precise geolocation data: — NO
• Audio, video, or electronic data: — NO
• Professional or employment-related information: — NO
• Education information: — NO
• Sensitive personal information: — NO

Your State Privacy Rights

Depending on the state in which you reside, your rights may include:

• Right to know whether we are processing your personal data
• Right to access your personal data and receive a copy
• Right to correct inaccuracies in your personal data
• Right to request deletion of your personal data
• Right to non-discrimination for exercising your privacy rights
• Right to opt out of the sale or sharing of your personal data (we do not sell personal data)
• Right to opt out of targeted advertising (we do not conduct targeted advertising)

How to Exercise Your Rights

To submit a rights request, contact us at support@mypayfast.com. We may need to verify your identity before processing your request. You may also designate an authorized agent to submit requests on your behalf, subject to verification requirements.

Appeals

If we decline your request, you may appeal our decision by emailing support@mypayfast.com. We will respond in writing with an explanation. If your appeal is denied, you may submit a complaint to your state attorney general.

California "Shine The Light" Law

Under California Civil Code Section 1798.83, California residents may request, once per year and free of charge, information about any personal information we disclosed to third parties for direct marketing purposes. We do not disclose personal information to third parties for direct marketing purposes.

12. DO OTHER REGIONS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: You may have additional rights based on the country or region in which you reside.

European Economic Area (EEA) and United Kingdom

If you are located in the EEA or UK, you have rights under the GDPR or UK GDPR, including the right to lodge a complaint with your Member State's data protection authority or the UK Information Commissioner's Office (ICO).

Republic of South Africa

If you are located in South Africa, you have rights under the Protection of Personal Information Act (POPIA), including the right to request access to or correction of your personal information. If you are unsatisfied with how we address your complaint, you may contact the Information Regulator (South Africa) at:

• General enquiries: enquiries@inforegulator.org.za
• POPIA complaints: POPIAComplaints@inforegulator.org.za

Ghana and Other African Jurisdictions

We operate under applicable data protection laws in the jurisdictions where we do business, including Ghana's Data Protection Act. If you reside in Ghana or another African country and have questions about your rights, please contact us at support@mypayfast.com and we will respond in accordance with local law.

Other Regions

Residents of other regions may also have rights under local data protection laws. Contact us at support@mypayfast.com to inquire about your rights and how we can assist you.

13. DO WE MAKE UPDATES TO THIS POLICY?

In Short: Yes. We will update this Privacy Policy as necessary to remain compliant with relevant laws and to reflect changes in our practices.

We may update this Privacy Policy from time to time. Any updated version will be indicated by a revised "Last updated" date at the top of this document. If we make material changes to this Privacy Policy, we may notify you by prominently posting a notice within the app or on our website, or by sending you a direct notification via email or push notification.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your personal information. Continued use of our Services after any update constitutes your acknowledgment of the revised policy.

14. HOW CAN YOU CONTACT US ABOUT THIS POLICY?

If you have questions, comments, or concerns about this Privacy Policy or our data practices, you may contact us using the following details:

PayFast
Email: support@mypayfast.com
Website: www.mypayfast.com

We aim to respond to all inquiries within a reasonable timeframe. If you believe your privacy rights have been violated, you also have the right to lodge a complaint with your local data protection authority.

15. HOW CAN YOU REVIEW, UPDATE, OR DELETE YOUR DATA?

Based on applicable laws in your country or state, you may have the right to request access to the personal information we hold about you, to correct inaccuracies, or to request deletion of your data. You may also have the right to withdraw consent to our processing of your information.

To exercise any of these rights, you can:

• Log in to your PayFast account and update your information in your account settings
• Request deletion of your account and associated data through the app
• Contact us directly at support@mypayfast.com with your request

We will process your request in accordance with applicable data protection laws. Please note that we may need to verify your identity before acting on your request, and certain information may be retained where required by law or for legitimate business purposes such as fraud prevention.