This policy explains how BluCross Capital (Pty) Ltd collects, uses, stores, shares and protects your personal information. It is drafted in compliance with the Protection of Personal Information Act 4 of 2013 (POPIA) and all applicable South African legislation.
BluCross Capital (Pty) Ltd ("BluCross Capital", "we", "us" or "our") is a registered South African company operating as a short-term credit provider and financial services provider.
As a responsible party under POPIA, BluCross Capital determines the purpose and means of processing your personal information. We are committed to processing your information lawfully, fairly, transparently and in a manner that respects your right to privacy as guaranteed under section 14 of the Constitution of the Republic of South Africa, 1996.
This Privacy Policy applies to:
This policy does not cover the privacy practices of third-party websites or services that may be linked from our website. We encourage you to read the privacy policies of any third-party sites you visit.
We collect only the information that is necessary for the purposes described in this policy. The categories of personal information we collect include:
| Category | Examples | Why We Need It |
|---|---|---|
| Identity Information | Full name, ID number, date of birth, nationality, gender | Identity verification, FICA compliance, NCA requirements |
| Contact Information | Phone number, email address, physical address, postal address | Communication, correspondence, account management |
| Financial Information | Income details, employment information, bank account number, bank statements, credit history | Affordability assessment (NCA s.81), credit checks, disbursement |
| Employment Information | Employer name, payslip details, employment type, salary pay date | Creditworthiness assessment, responsible lending |
| Account Information | Username, password (encrypted), login history, branch preference, application history | Account management, security, service delivery |
| Document Information | Bank statement PDFs, ID document copies, supporting documents | Application verification, NCA compliance, fraud prevention |
| Technical Information | IP address, browser type, device information, pages visited, time and date of access | Website security, analytics, fraud prevention, service improvement |
| Communication Records | Emails, WhatsApp messages, call logs, support requests | Record-keeping, dispute resolution, service quality |
We do not intentionally collect special personal information (race, religion, health, biometrics, political views, sexual orientation) unless strictly required by law or with your explicit consent.
Under POPIA Chapter 3, we may only process your personal information if at least one of the following conditions (lawful bases) applies:
| POPIA Condition | How It Applies to Us |
|---|---|
| Consent (s.11(1)(a)) | By creating an account and submitting a loan application, you consent to the processing of your personal information as described in this policy. You may withdraw consent, subject to legal and contractual limitations. |
| Contractual Necessity (s.11(1)(b)) | Processing is necessary to enter into or perform a credit agreement with you — including identity verification, affordability assessment and disbursement. |
| Legal Obligation (s.11(1)(c)) | We are required by law to process certain information — e.g., FICA (FIC Act 38 of 2001), NCA affordability assessment (s.81), NCR registration requirements, SARS compliance. |
| Legitimate Interest (s.11(1)(f)) | We have a legitimate business interest in processing information for fraud prevention, debt recovery, security, and improving our services — provided this does not override your rights. |
| Vital Interest (s.11(1)(d)) | In rare circumstances where processing is necessary to protect your vital interests or those of another person. |
We process your personal information only for the specific, explicitly defined purposes listed below. We will not process your information for any other purpose without your prior consent:
We do not sell your personal information to third parties. We may share your information only in the following circumstances:
| Recipient | Purpose | Legal Basis |
|---|---|---|
| Registered Credit Bureaux (e.g. TransUnion, Experian, XDS) | Credit checks, affordability assessment, reporting of payment behaviour | NCA s.70 obligation; contractual necessity |
| Financial Intelligence Centre (FIC) | Suspicious transaction reporting, cash transaction reporting, FICA compliance | FIC Act 38 of 2001 — legal obligation |
| National Credit Regulator (NCR) | Regulatory reporting, compliance submissions | NCA 34 of 2005 — legal obligation |
| South African Revenue Service (SARS) | Tax compliance, mandatory reporting | Income Tax Act — legal obligation |
| Banking Institutions | Disbursing loan funds, debit order processing | Contractual necessity |
| Debt Collectors / Attorneys | Recovery of overdue loan amounts | Legitimate interest; contractual terms |
| IT Service Providers & Operators | Cloud hosting, website management, cybersecurity | Operator agreement (POPIA s.20–22); legitimate interest |
| Courts & Law Enforcement | Compliance with court orders, subpoenas, or lawful directives | Legal obligation |
All third parties who process your information on our behalf are required to comply with POPIA and are bound by appropriate operator agreements or data sharing agreements.
We retain your personal information only for as long as is necessary for the purpose it was collected, or as required by law. Our retention schedule is as follows:
| Information Type | Retention Period | Reason |
|---|---|---|
| Loan application records | 5 years after agreement end | NCA requirement; SARS compliance |
| Identity documents (FICA) | 5 years after business relationship ends | FIC Act s.22 requirement |
| Financial statements & bank records | 5 years | NCA, Companies Act, SARS |
| Credit bureau report records | 5 years | NCA; legitimate interest |
| Active client accounts | Duration of relationship + 5 years | Contractual; regulatory |
| Communication records | 3 years | Dispute resolution; audit trail |
| Website access logs | 12 months | Security; fraud prevention |
| Marketing preferences | Until you opt out or 3 years inactive | POPIA s.69; CPA compliance |
After the retention period expires, your personal information will be destroyed or de-identified in a secure manner, unless retention is required for legal proceedings or regulatory investigations.
As required by POPIA section 19, we take reasonable technical and organisational measures to secure your personal information against loss, damage, unauthorised access, disclosure, interference or destruction.
Under POPIA sections 5, 23, 24 and 68–73, you have the following rights in relation to your personal information:
To exercise any of these rights, submit a written request to our Information Officer at admin@blucrosscapital.com. We will respond within 30 days as required by POPIA.
Our website uses cookies and similar tracking technologies to improve your experience. Cookies are small text files stored on your device by your browser.
| Cookie Type | Purpose | Duration |
|---|---|---|
| Essential / Session | Required for login sessions, form submissions, security (CSRF tokens) | Session (deleted on close) |
| Functional | Remembering your branch preference, language and display settings | Up to 12 months |
| Analytics | Understanding how visitors use our website (page views, navigation paths) | Up to 24 months |
| Security | Detecting suspicious activity, fraud prevention, bot protection | Session / 30 days |
You can control or disable cookies through your browser settings. Note that disabling essential cookies may prevent you from logging in or using certain features of our website. We do not use tracking cookies for advertising or share your browsing data with advertising networks.
Under POPIA section 69 and the Consumer Protection Act (CPA), you have the right to opt out of direct marketing communications at any time.
In limited circumstances, your personal information may be transferred to or processed in countries outside South Africa — for example, if we use cloud-based infrastructure hosted internationally.
We comply with POPIA section 72, which requires that cross-border transfers may only occur if:
We take reasonable steps to ensure any third-party international processors are bound by appropriate data protection agreements.
As required by POPIA section 55, we have appointed an Information Officer responsible for ensuring compliance with POPIA. You may direct any privacy-related queries, requests or complaints to:
If you are dissatisfied with our response to a privacy complaint, or believe we are processing your information in violation of POPIA, you have the right to lodge a complaint with the Information Regulator of South Africa.
We encourage you to contact us first before escalating to the Regulator. We are committed to resolving all privacy concerns promptly and fairly.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. When we make material changes, we will:
Your continued use of our services after any updated policy has been published constitutes your acceptance of the updated terms, to the extent permitted by law.
For any privacy-related queries, requests to exercise your POPIA rights, or general questions about this policy, please contact us:
NCR Registered
FSP · FIC · PCC 25