This policy explains what we do with your personal information when you use finpandas.com/za. It is written to meet the Protection of Personal Information Act 4 of 2013 (POPIA).
Who is responsible
The responsible party is GCORP FZCO, registration number 14994, Dubai Silicon Oasis, Dubai, United Arab Emirates, trading as Finpandas. You can reach our information officer at privacy@finpandas.com.
What we collect
| Category | Examples |
|---|---|
| Identity | First name, surname, South African ID number, and the date of birth and gender your ID number contains |
| Contact | Mobile number, email address, province, city, postal code |
| Financial | Take-home and gross monthly income, employment status, how often you are paid, payday, bank, account type |
| Application | Amount requested, term requested, what the loan is for |
| Technical | IP address, browser and device information, pages viewed, referring website, campaign identifiers such as UTM tags and click IDs |
Your ID number is special in one respect: it encodes your date of birth and gender, and we derive both from it rather than asking you separately. We do not display it back to anyone and we do not use it for any purpose other than your application.
Why we use it, and on what basis
- To match you with credit providers. This is the service you asked for, and it is why the form exists. We rely on your consent and on the performance of our service to you.
- To prevent fraud and abuse. We validate ID and mobile numbers and check for duplicate or automated submissions. This is our legitimate interest, and it protects you as much as it protects us.
- To measure our marketing. We record which campaign brought you to the site so we know what to keep paying for.
- To meet legal obligations where they apply to us.
Messages we send you
When you apply, we may contact you about that application by SMS, WhatsApp or email — to send you the link to the provider you were matched with, or to tell you what happened to it. These are part of the service you asked for, not marketing for unrelated products.
You can stop them at any time: reply STOP to any SMS, use the unsubscribe link in any email, or write to privacy@finpandas.com. We act on it immediately, and it does not affect an application already with a provider.
Who we share it with
We share your application with the credit providers on our panel so they can assess it. Once we do, that provider becomes a responsible party in its own right and its own privacy policy applies to what it does next. We will only ever share your application with providers, not sell it on to unrelated marketing lists.
We also use service providers who help us operate — hosting, email and SMS delivery, analytics and advertising measurement. They act on our instructions and may not use your information for their own purposes.
Cross-border transfer
Finpandas is operated from the United Arab Emirates, and some of our service providers are outside South Africa. Where your information leaves South Africa we do so on the basis permitted by section 72 of POPIA, and we require recipients to protect it on terms comparable to this policy.
How long we keep it
We keep application data for as long as we need it to run and account for the introduction, and generally no longer than five years after your last interaction with us, unless the law requires us to keep it longer. Technical and marketing logs are kept for a shorter period. After that we delete or de-identify it.
Your rights under POPIA
- Ask what personal information we hold about you, and get a copy.
- Ask us to correct or delete information that is wrong, misleading, excessive or out of date.
- Withdraw your consent, though we may not be able to continue matching you if you do.
- Object to processing based on our legitimate interests.
- Complain to the Information Regulator (South Africa), Email: complaints.IR@justice.gov.za.
To exercise any of these, email privacy@finpandas.com. We respond within 30 days and may ask you to verify your identity first — precisely because the information is sensitive.
Security
The site is served over an encrypted connection, access to application data is restricted to the people who need it, and we do not display full ID numbers back to anyone. No system is perfect, but we take this seriously and will notify you and the Regulator if a breach affects you.
Children
The service is not for anyone under 18 and we do not knowingly collect information from children.
Changes
If we change this policy we will publish the new version here and update the date at the top.