CurrenC Group Privacy Policy

Last updated: 13 October 2026

1. Who we are and what this notice covers

1.1 This Privacy Policy explains how CurrenC Group Pty LTD (registration number 2019/458158/07, FSP No. 53709) ("we", "us", "our") collects, uses, shares and protects personal information when you use our website at www.currenc.co.za (the "Site"), our web application at app.currenc.co.za (the "Portal"), our applications, and our payment and foreign exchange services (the "Services"), or when you deal with us in any other way.

1.2 We are the responsible party under the Protection of Personal Information Act 4 of 2013 ("POPIA"). Our Information Officer is Pierre van Helden, who can be reached at info@currenc.co.za or at 42 Montrose Avenue, Oranjezicht, Cape Town, 8000.

1.3 Our Services are provided to businesses. This notice therefore applies to the people connected with our business customers (directors, owners, employees and authorised users), to the recipients of payments our customers make, and to visitors to the Site. Under POPIA, personal information includes information about identifiable individuals and about identifiable juristic persons (companies).

2. Personal information we collect

2.1 Information you give us.

(a) Account and business details: business name, registration number, address, industry, contact details, website, and the names, titles and contact details of your users.

(b) Identity and verification information: for directors, beneficial owners and authorised users: name, ID or passport number, date of birth, nationality, residential address, photographs, proof of address, and company documents.

(c) Financial information: bank account and mobile money details, source of funds and wealth, tax numbers, expected transaction volumes, and supporting documents such as invoices and contracts.

(d) Transaction information: amounts, currencies, purpose of payment, and the details of recipients, including their name, bank account or wallet number, address and country.

(e) Communications: your messages to us by email, through the Portal, or on channels such as WhatsApp, and notes of calls.

2.2 Information about other people. You may give us personal information about other people, such as recipients, directors and employees. You must be allowed to give it to us, and you must tell them about this notice where the law requires.

2.3 Information we collect automatically. When you use the Site or Portal we collect device and technical information such as IP address, browser type, operating system, pages visited, time spent, referring website, and approximate location. See section 10 on cookies.

2.4 Information from other sources. We receive information from identity verification and screening providers, sanctions and politically exposed person lists, credit bureaus and fraud databases, public registers, our banking and payment partners, and the businesses that introduce you to us.

2.5 Special personal information and children. We do not intend to collect special personal information (such as health or religious beliefs) or information about children. If our verification process uses biometric information (for example a selfie to match an ID photo), we will tell you and use it only for verification. The Services are not for anyone under 18.

3. Why we use your information

3.1 We use personal information, and rely on the following grounds that POPIA allows, as follows:

3.2 We will not use your personal information for a different purpose that is not compatible with these, unless the law allows it or you consent.

3.3 Automated decisions. We use automated tools to screen customers and transactions for risk, fraud and sanctions. A decision to block or delay a transaction may be based partly on that screening. You can ask us to have a person review a decision (see section 12).

4. Who we share information with

4.1 We share personal information only as needed, with:

(a) Banks, authorised dealers, payment institutions and mobile money operators that process and settle payments, including those in the destination country;

(b) Liquidity and foreign exchange providers;

(c) Identity verification, screening, fraud and credit service providers;

(d) Technology service providers that act on our behalf, such as hosting, database, authentication, communications, analytics and customer support providers;

(e) Professional advisers, auditors and insurers;

(f) Regulators, law enforcement, the Financial Intelligence Centre, tax authorities, courts and other public bodies, where the law requires or permits it;

(g) Related companies, and a buyer or investor if our business is restructured, sold or financed, who will be bound to protect your information; and

(h) Other people with your consent or at your instruction.

4.2 Where a provider processes information for us as an operator, we require a written agreement that obliges it to keep the information secure and use it only for our instructions.

4.3 We do not sell personal information.

5. Transfers outside South Africa

5.1 Cross border payments mean that recipient and transaction information must be sent to banks and partners in other countries. We also use service providers whose systems may be located outside South Africa.

5.2 Where we transfer personal information to a person in another country, we do so only where POPIA allows: where the recipient is subject to law, binding corporate rules or an agreement that gives a similar level of protection, where it is necessary to perform our agreement with you or at your request, or where you consent.

6. How we protect information

6.1 We take reasonable technical and organisational steps to protect personal information against loss, damage, unauthorised access and unlawful processing, including access controls, encryption in transit, monitoring, and staff confidentiality obligations. No system is completely secure, and we cannot guarantee absolute security.

6.2 If we believe personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and affected people as POPIA requires.

7. How long we keep information

7.1 We keep personal information only for as long as we need it for the purposes above, and as the law requires. For example:

(a) Identity, verification and transaction records are kept for at least 5 years after the end of the business relationship or the transaction, as required by FICA and related laws;

(b) Accounting and tax records are kept for the period the law requires, generally at least 5 years;

(c) Marketing information is kept until you opt out or we no longer need it;

(d) Technical and usage data is kept only for as long as needed for security and analysis.

7.2 When we no longer need information, we delete it, de identify it, or destroy it securely, unless the law requires us to keep it.

8. Your information about others

8.1 If you give us information about directors, owners, employees or recipients, you confirm that you have the right to do so and that the information is accurate. We may ask you to confirm this when you register.

9. Marketing

9.1 We will only send you direct marketing by electronic means as POPIA allows: with your consent, or to existing customers about similar services with a clear way to opt out. You can opt out at any time using the link in a message or by contacting us. We will still send you service and legal messages that you need.

10. Cookies and similar technologies

10.1 The Site and Portal use cookies and similar technologies, which are small files stored on your device. We use:

(a) Strictly necessary cookies, which are needed for sign in, security and basic functions. These cannot be switched off.

(b) Analytics cookies, which tell us how the Site is used, so we can improve it.

10.2 Where required, we ask for your consent before setting non essential cookies. You can change your cookie settings in your browser, although blocking some cookies may stop parts of the Site working.

10.3 Some third party features on the Site, such as embedded content or social media widgets, may set their own cookies. Their privacy notices apply to them.

11. Third party websites

11.1 The Site may link to other websites. We are not responsible for their privacy practices. Read their notices before you give them information.

12. Your rights

12.1 Under POPIA, and subject to the law, you have the right to:

(a) know whether we hold personal information about you and access it;

(b) ask us to correct information that is inaccurate, out of date or incomplete;

(c) ask us to delete or destroy information we are no longer authorised to keep;

(d) object to the processing of your information on reasonable grounds, and to direct marketing;

(e) withdraw consent where we process information based on your consent, without affecting processing done before you withdrew it;

(f) not be subject to a decision based only on automated processing that has a legal effect on you, and ask for human review; and

(g) complain to the Information Regulator.

12.2 To use these rights, contact our Information Officer at info@currenc.co.za. We may need to verify your identity first. We cannot always do what you ask, for example where we are required by law to keep information, and if so we will explain why. You can also make a request under our PAIA Manual, available on the Site.

12.3 Complaints. If you are unhappy with how we handle your information, please contact us first so we can try to resolve it. You may also lodge a complaint with the Information Regulator (South Africa) (inforegulator.org.za).

13. People outside South Africa

13.1 If you are in another country, the privacy laws of that country may give you additional rights.

14. Changes to this notice

14.1 We may update this notice from time to time. We will post the updated notice on the Site with a new "last updated" date and, for material changes, tell you by email or on the Portal.

15. Contact us

Information Officer: Pierre van Helden CurrenC Group Pty LTD Address: 42 Montrose Avenue, Oranjezicht, Cape Town, 8000 Email: info@currenc.co.za