Privacy Policy

1. Purpose and scope

Zak Pay (Pty) Ltd (“Zak Pay”, “we”, “us” or “our”) respects your privacy and is committed to processing personal information lawfully, reasonably and transparently. This Privacy Policy explains how personal information is collected, used, disclosed, stored, protected and deleted when you use the Zak Pay mobile application, our website, hosted payment pages, payment links, invoices, QR payment functionality, merchant onboarding and support services (collectively, the “Services”).

This policy is intended to comply with the Protection of Personal Information Act 4 of 2013 (“POPIA”), applicable South African data-protection requirements, and the privacy-disclosure requirements applicable to distribution of the Zak Pay app through major app stores.

2. Our role and EFT Corporation

Zak Pay (Pty) Ltd is appointed as the non-exclusive wholesale reseller of acquiring services under a Merchant Acquiring Reseller Agreement (LMR2540) dated 15 July 2026 (the “Reseller Agreement”) with EFT Corp Technologies (Pty) Ltd (registration number 2017/471522/07) and EFT Payment Solutions (Pty) Ltd (registration number 2013/099677/07) (collectively, “EFT Corporation”), of 1st Floor, Golfers Corner, Design Quarter, Fourways, South Africa. Under the Reseller Agreement, Zak Pay purchases the acquiring services from EFT Corporation on a wholesale basis and on-sells those services to merchants (“Merchants”) in its own right.

EFT Corporation is a licensed System Operator under the National Payment System Act 78 of 1998 (“NPS Act”) and operates as a Sponsored Payment Facilitator under sponsorship arrangements with Standard Bank of South Africa Limited and Nedbank Limited (each an Acquiring Bank). EFT Corporation trades, inter alia, as “Scan to Pay” and is the regulated provider of the acquiring services made available through the Zak Pay app, website, hosted payment pages, payment links, invoices and QR payment functionality (the “Platform”). Zak Pay does not represent itself as a payment facilitator, acquirer, licensed payment institution or other regulated payment entity in connection with the Platform.

For Merchant data and Cardholder Data processed through EFT Corporation’s Platform, EFT Corporation is the responsible party for POPIA purposes and Zak Pay acts as an operator when processing that information on EFT Corporation’s behalf and in accordance with its instructions. For purposes of the Financial Intelligence Centre Act 38 of 2001, as amended by the Financial Intelligence Centre Amendment Act 1 of 2017 (“FICA”), EFT Corporation is the accountable institution in respect of the Merchant relationships established through the Platform; Zak Pay is not an accountable institution in its own right under FICA and performs customer due diligence, FICA screening and ongoing monitoring on EFT Corporation’s behalf and in accordance with EFT Corporation’s instructions and compliance programme. Zak Pay may also act as a responsible party for personal information it determines the purpose and means of processing for itself, for example information relating to its own website enquiries, app administration, direct support, security, corporate records and permitted communications.

EFT Corporation’s activities as a System Operator and Sponsored Payment Facilitator are subject to oversight by the South African Reserve Bank (“SARB”) under the NPS Act and, where applicable, the Financial Sector Conduct Authority (“FSCA”).

3. Personal information we may collect

Depending on how you use the Services, we may collect or process:

• Identity and KYC/KYB information: full name, identity or passport information, date of birth where required, photographs/selfies, company registration information, directors and beneficial owners, and supporting verification documents.
• Contact and account information: mobile number, email address, business/trading name, account/profile identifiers, login and authentication information, employee/team-account information and communication preferences.
• Business and banking information: business activity, registration records, proof of business bank account, bank-account details required for settlement or verification, and information required for AVS or related verification.
• Transaction and payment information: transaction amount, date/time, merchant reference, payment method, transaction status, refunds, reversals, chargebacks, settlement and reconciliation information. Zak Pay does not intend to store full card security codes (CVV/CVC) after authorisation.
• Customer information entered by a merchant: information required to create or deliver invoices, payment links, receipts or related payment communications, such as customer name, email address, reference or description.
• Device, app and technical information: device and app identifiers, operating system, IP address, security and authentication events, diagnostics, crash information, logs, session information and app usage/analytics information generated by the Services or integrated service providers.
• Support and communications: enquiries, complaints, support messages, call or correspondence records and information you provide when interacting with us.
• Compliance and risk information: FICA/KYC screening results, sanctions or fraud indicators, MATCH/VMSS screening information (the Mastercard Alert to Control High-risk Merchants list and the Visa Merchant Screening Service) where applicable, suspicious-activity indicators and information required by EFT Corporation, the Acquiring Banks, the Card Schemes (Visa International Service Association and Mastercard International Incorporated) or competent authorities.

4. How we collect information

We may collect personal information:

• directly from you when you register, onboard, transact, contact support or use the Services;
• from your business, authorised representatives, directors, beneficial owners or employees;
• through the Zak Pay app, website, hosted pages, APIs and integrated systems;
• from EFT Corporation and other payment, banking, identity-verification, fraud-prevention or compliance providers where permitted;
• from public or official records and verification sources where necessary for KYC/KYB, FICA, fraud prevention or legal compliance.

5. Why we process personal information

We process personal information only where there is a lawful basis and for legitimate, specific purposes, including to:

• create and administer accounts and merchant profiles;
• verify identity, business information and bank-account information;
• perform merchant onboarding, due diligence, fraud prevention, sanctions screening and ongoing compliance monitoring;
• enable QR payments, payment links, invoices, hosted checkout, transaction notifications, receipts, refunds, reversals, settlements and reconciliation;
• provide customer and merchant support and resolve complaints or disputes;
• secure the Services, authenticate users, detect abuse and investigate suspected fraud or security incidents;
• comply with POPIA, FICA, the NPS Act, the Cybercrimes Act 19 of 2020, applicable Card Scheme rules, lawful regulatory requirements and contractual obligations relating to the payment services, including under the Reseller Agreement;
• maintain records for accounting, audit, risk, legal, regulatory and dispute-resolution purposes;
• improve the reliability and performance of the Zak Pay app and Services using permitted operational analytics; and
• send service communications and, where legally permitted and required consent has been obtained, marketing communications.

6. Sharing of personal information

We do not sell personal information. We may disclose or make personal information available only where reasonably necessary for the purposes described in this policy, subject to contractual, legal and security safeguards.

• EFT Corporation (EFT Corp Technologies (Pty) Ltd and EFT Payment Solutions (Pty) Ltd), which provides the acquiring/payment platform and receives Merchant, transaction, settlement, onboarding, fraud, compliance and payment information required to provide and regulate the acquiring services.
• The Acquiring Banks (Standard Bank of South Africa Limited and Nedbank Limited), the Card Schemes (Visa International Service Association and Mastercard International Incorporated), payment networks and payment-method providers where required to authorise, process, settle, reconcile, refund or dispute a transaction.
• Identity, KYC/KYB, bank-verification, fraud-prevention, sanctions-screening and compliance providers used in the onboarding and monitoring process.
• Cloud hosting, authentication, analytics, messaging, customer-support and software service providers that process information for Zak Pay under appropriate contractual and security controls.
• Professional advisers, auditors, insurers and service providers where reasonably required for lawful business operations.
• Regulators, law-enforcement bodies, courts, the Financial Intelligence Centre or other competent authorities where disclosure is required or permitted by law.
• A purchaser, investor or successor in a lawful corporate transaction, subject to appropriate confidentiality and data-protection safeguards.

7. Payment card information

Payment-card processing is performed through payment infrastructure and providers configured for the Services, including the Card Schemes (Visa International Service Association and Mastercard International Incorporated) and the Acquiring Banks. Zak Pay limits its handling of Cardholder Data and Sensitive Authentication Data (as those terms are defined in the Reseller Agreement) to the minimum necessary for its role. Zak Pay will not store CVV/CVC security codes after transaction authorisation. Payment-card environments are subject to applicable PCI DSS requirements published by the PCI Security Standards Council.

8. Biometrics and device permissions

Where the app offers biometric login or biometric confirmation, the biometric template used by Face ID, Touch ID or an Android biometric service is generally controlled by your device and operating system. Zak Pay uses the device’s authentication result to confirm access or an action and does not require your raw fingerprint or facial biometric template to be uploaded to Zak Pay for device biometric authentication. Separate identity-verification selfies or facial images collected during KYC may be processed by authorised verification providers for identity verification and fraud-prevention purposes.

The app may request access to device features such as the camera when required to scan or capture KYC documents, selfies or QR codes. Permissions should be requested only when needed for the relevant feature and can be managed through your device settings, subject to the functionality that requires them.

9. Security

Zak Pay applies reasonable and appropriate technical and organisational safeguards designed to protect personal information against loss, damage, unauthorised destruction, unlawful access, disclosure or processing, consistent with the Cybercrimes Act 19 of 2020. Measures may include access controls, authentication, encryption in transit, secure development practices, logging and monitoring, least-privilege access, vendor controls, backups and incident-response procedures. No system can guarantee absolute security.

10. Data retention and deletion

We retain personal information only for as long as necessary for the purpose for which it was collected or subsequently processed, or for a longer period where retention is required or permitted by law, payment-network rules, fraud/chargeback requirements, regulatory obligations, audit requirements, litigation holds or contractual obligations.

When information is no longer required and retention is not otherwise authorised, it will be deleted, destroyed or de-identified in a manner intended to prevent reconstruction. Some Merchant, transaction, onboarding and compliance records are controlled or retained by EFT Corporation in accordance with its regulatory responsibilities.

11. Account deletion

You may request deletion of your Zak Pay account through the account-management functionality made available in the app or by contacting legal@zakpay.co.za. Account closure may be subject to operational conditions, including settlement of outstanding balances, open disputes, refunds, chargebacks or legal/regulatory holds. Closing the app account does not require deletion of records that Zak Pay, EFT Corporation or another regulated participant must retain by law or applicable payment rules. Where deletion cannot lawfully occur, processing will be restricted to the permitted retention purpose.

Step-by-step instructions are available on our account deletion page.

12. Your rights under POPIA

Subject to POPIA and applicable limitations, you may:

• ask whether we hold personal information about you and request access to it;
• request correction or deletion of information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;
• object, on reasonable grounds where applicable, to certain processing of your personal information;
• withdraw consent where processing is based on consent, without affecting processing already lawfully carried out;
• object to direct marketing and unsubscribe from marketing communications;
• be notified of collection and of qualifying security compromises as required by POPIA; and
• lodge a complaint with the Information Regulator (South Africa) or pursue other remedies available under law.

We may need to verify your identity before actioning a privacy request. Where the relevant information is controlled by EFT Corporation or another responsible party, we may refer or transmit your request to that party as appropriate.

13. Cross-border processing

Some technology or service providers may process information outside South Africa. Where personal information is transferred to a foreign country, Zak Pay will take reasonable steps to ensure the transfer is permitted under POPIA, including the requirements applicable to transborder information flows, and that appropriate protection or contractual safeguards apply.

14. Children

The Zak Pay merchant Services are not intended for persons under 18 years of age. We do not knowingly onboard a minor as a merchant account holder. If we learn that personal information of a child has been collected contrary to applicable requirements, we will take appropriate steps in accordance with POPIA and applicable law.

15. Direct marketing

Zak Pay may send operational and transactional communications necessary to provide the Services. Marketing by electronic communication will be conducted only where permitted by POPIA and other applicable law. You may opt out of marketing at any time using the mechanism provided in the communication or by contacting us.

16. Security compromises

If Zak Pay becomes aware of an actual or reasonably suspected security compromise affecting personal information processed under the EFT Corporation arrangement, Zak Pay’s internal procedure requires prompt containment, preservation of relevant evidence and notification to EFT Corporation within the contractual timeframe. Where Zak Pay is the responsible party, notifications to affected data subjects and the Information Regulator will be made when and as required by POPIA.

17. Third-party services and links

The Services may link or redirect to payment pages, banks, wallets or other third-party services. Their processing of personal information may be governed by their own privacy notices. Zak Pay is not responsible for independent processing by third parties acting as separate responsible parties.

18. Changes to this policy

We may update this Privacy Policy when our Services, providers, legal requirements or data practices change. The updated version will state its effective date and will be made available through the app and/or Zak Pay website. Material changes may also be communicated through appropriate in-app or account channels.

19. Contact and complaints

Privacy enquiries, requests or complaints may be sent to Zak Pay at legal@zakpay.co.za. You may also lodge a POPIA complaint with the Information Regulator (South Africa).

20. Regulatory and service-provider disclosure

EFT Corp Technologies (Pty) Ltd (registration number 2017/471522/07) and EFT Payment Solutions (Pty) Ltd (registration number 2013/099677/07) (collectively, “EFT Corporation”), of 1st Floor, Golfers Corner, Design Quarter, Fourways, South Africa, provide the regulated acquiring services underlying relevant Zak Pay payment functionality pursuant to the Merchant Acquiring Reseller Agreement (LMR2540) dated 15 July 2026. EFT Corporation is a licensed System Operator under the NPS Act and a Sponsored Payment Facilitator under sponsorship arrangements with Standard Bank of South Africa Limited and Nedbank Limited. This Privacy Policy does not alter the separate legal and regulatory responsibilities of EFT Corporation, the Acquiring Banks, the Card Schemes or other payment participants.

Reference basis

This policy has been prepared with reference to POPIA, FICA, the NPS Act, the Cybercrimes Act 19 of 2020, the Merchant Acquiring Reseller Agreement (LMR2540) dated 15 July 2026 between EFT Corp Technologies (Pty) Ltd, EFT Payment Solutions (Pty) Ltd and Zak Pay (Pty) Ltd, and current Apple App Store and Google Play privacy-policy disclosure requirements. It should be reviewed whenever Zak Pay adds a new SDK, payment method, analytics provider, identity provider, jurisdiction or category of personal information, or when the Merchant Acquiring Reseller Agreement is amended or renewed.

Effective date: 17 September 2026. Zak Pay (Pty) Ltd, registration number 2021/326472/07. A PDF version of this policy is also available.