Last updated: 8 October 2026
1. Purpose, scope, and responsible party
Payzar (Pty) Ltd (Reg No: K2025774819) (“Payzar”, “we”, “us”, or “our”) is the Responsible Party for personal information processed through our mobile application, web portal at www.payzarapp.co.za, and SaaS point-of-sale (POS) and business-management services. Our registered address is 07 Madanzhe Street, Golgotha, Thohoyandou, 0950, South Africa. This policy explains how we collect, use, disclose, and retain personal information in accordance with the Protection of Personal Information Act, 2013 (POPIA, Act No. 4 of 2013) and applicable obligations under the Financial Intelligence Centre Act, 2001 (FICA, Act No. 38 of 2001).
2. Personal Information We Process
Depending on the services used, information you provide, device permissions, and applicable verification requirements, we may process:
- Identification and contact information: Full legal name, South African identity or passport number, mobile number, email address, and residential, trading, or business address.
- Verification and potentially special personal information: Copies of identity documents and supporting documents such as utility bills, together with selfie liveness or facial verification information where these are required for identity checks. We handle this information only where permitted by law and with appropriate safeguards.
- Business, payment, and transaction information: POS and inventory records, transaction and virtual ledger logs, QR payment histories, and nominated bank account details needed for settlement.
- Technical and usage information: Device identifiers, IP address, mobile operating system details, service activity, and USSD session logs. Location or geolocation information is processed only where a feature requires it and the relevant device permission or other lawful basis applies.
3. Why We Process Information
In accordance with POPIA section 11, we process personal information where a lawful justification applies, including:
- Contractual necessity: to register and administer accounts, provide POS and business-management tools, support payment instructions, and facilitate settlement through payment partners.
- Legal obligations: to complete applicable FICA identity checks, maintain required records, and make disclosures or reports where required by law.
- Legitimate interests: to secure and maintain the platform, investigate suspected fraud or misuse, and protect users and services, where those interests are not overridden by your rights.
- Consent: where we request it for a particular optional use, such as promotional communications or a feature that requires a device permission. You may withdraw consent where processing is based on consent; withdrawal does not affect prior lawful processing.
We do not use consent as the basis for processing where another lawful justification applies. We do not make solely automated decisions with legal or similarly significant effects unless permitted by law and the applicable safeguards are in place.
4. Payment Service Providers and Other Operators
We do not sell personal information. We disclose it only as needed for the purposes described in this policy, under applicable legal requirements, or with an appropriate lawful basis. Payment-related information, including transaction data, dynamic QR payment instructions, and payout settlement information, may be processed through Ozow (Pty) Ltd for relevant payment services. Identity-verification vendors may process identity documents or liveness-check information when such checks are used. Financial institution, hosting, and other service-provider partners may also process information to provide the requested services and help secure the platform. These providers may act as Operators or in another legally appropriate capacity depending on the service and arrangement. We may disclose information to the Financial Intelligence Centre, SARS, SAPS, courts, or other authorities where required or permitted by law.
5. Retention of Records
We retain personal information only for as long as needed for its collection purpose, unless a longer period is required or permitted by law. When the purpose has ended, information is securely deleted, destroyed, or de-identified where appropriate, subject to applicable retention duties. Non-essential account preferences may be deleted on request where appropriate. Records required under FICA, including applicable customer-identification and transaction records under section 22, are retained for the statutory period (generally at least five years from the relevant event specified by FICA) and may be retained longer where the law requires it. Closing an account does not remove statutory retention obligations.
6. Security and Confidentiality
We apply appropriate technical and organisational safeguards to protect personal information against loss, unauthorised access, use, alteration, or disclosure, and limit access to people and service providers who need it for the purposes described in this policy or to meet legal obligations. Safeguards are reviewed and updated as appropriate; specific technologies may vary by system and service provider.
If there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, Payzar will notify the Information Regulator and affected data subjects as soon as reasonably possible, subject to lawful exceptions and directions, as required by POPIA section 22. Notifications will include information reasonably available about the incident and steps that affected persons can take.
7. Your Rights
Subject to applicable law, you may request confirmation of whether we hold personal information about you and request access to it; request correction or deletion of information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully; and object to processing on reasonable grounds or to direct marketing. You may also withdraw consent where consent is the basis for processing. We may need to retain information where required by FICA or another law, and we will explain any applicable limitation. You may lodge a complaint with the Information Regulator. To exercise these rights, contact the Information Officer using the details below.
8. Cookies
The website may use cookies and similar technologies needed for site functionality and, where enabled, to understand site usage. You can manage cookies through your browser settings; disabling some cookies may affect website functionality.
9. Information Officer
Information Officer: Ronewa Muthivhi
Email: support@payzarapp.co.za
Physical address: 07 Madanzhe Street, Golgotha, Thohoyandou, 0950, South Africa
10. Complaints to the Information Regulator
If you are not satisfied with our response to a privacy concern, you may lodge a complaint with the Information Regulator (South Africa):
Email: POPIAComplaints@inforegulator.org.za
General enquiries: enquiries@inforegulator.org.za
Physical address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001, South Africa
Website: inforegulator.org.za
11. Changes to This Policy
We may revise this policy when our services or legal obligations change. The latest version and its effective date will be published on this page.