Privacy Policy

1. Who is the responsible party

Deal Match (Pty) Ltd is the responsible party for the Personal Information processed through the Platform. Our Information Officer is registered with the Information Regulator and can be reached at paul@dealmatch.africa.

Where a Partner receives your information and decides independently how to use it, that Partner becomes a responsible party in its own right and its own privacy policy applies to that processing.

2. Information we collect from you

Depending on how you use the Platform, we may collect:

• Identity data: full name, identity or passport number where required by a credit provider, date of birth, nationality and marital status.
• Contact data: email address, mobile number, physical and postal address, and preferred contact times.
• Requirement data: vehicle make, model, derivative, budget, monthly instalment range, province, mileage limits, colour and feature preferences.
• Financial data: gross and net income, employment status and employer, existing credit commitments, deposit available, and current finance details where you request refinance.
• Trade-in data: your current vehicle's details, mileage, condition, photographs, service history and outstanding settlement information.
• Insurance data: current insurer, premium, claims and cover preferences where you request insurance assistance.
• Account data: login identifiers, hashed passwords, tracking tokens and communication preferences.
• Communication data: messages, call notes, form submissions and support correspondence.
• Technical data: IP address, device type, browser, operating system, referring URL, pages viewed, session duration and approximate location derived from IP.

3. Information we collect from other sources

We may receive information about you from Partners (for example, the outcome of an application), from credit bureaux where you have authorised a Partner to perform a check, from fraud prevention services, from publicly available sources, and from analytics and advertising providers.

4. Special personal information and children

We do not deliberately collect special personal information as defined in section 26 of POPIA, such as health, biometric, religious or political information. Do not submit such information unless a Partner lawfully requires it and you consent.

The Platform is not intended for children under 18. We do not knowingly process the Personal Information of a child. If we learn that we have, we will delete it unless a law requires retention.

5. Why we process your information and on what lawful basis

• To provide the matching service you requested — performance of a contract or steps taken at your request (section 11(1)(b) of POPIA).
• To transmit your Requirement to Partners — your consent, given expressly on the form (section 11(1)(a)).
• To verify identity, prevent fraud and secure the Platform — our legitimate interests and legal obligation (sections 11(1)(d) and 11(1)(f)).
• To comply with tax, FICA, consumer protection and record-keeping law — legal obligation (section 11(1)(c)).
• To improve the Platform, measure performance and develop features — legitimate interests, using aggregated or de-identified data wherever possible.
• To send direct marketing — consent, or an existing customer relationship in respect of similar services, subject to section 69 of POPIA and section 45 of ECTA.

6. Who we share your information with

We share Personal Information only as described below and only to the extent necessary:

• Dealerships and dealer groups, so they can respond to your vehicle requirement.
• Registered credit providers and finance houses, where you have asked for finance or refinance.
• Licensed insurers, FSP-registered brokers and warranty providers, where you have asked for insurance assistance.
• Service providers that operate under written contract as operators, including hosting, email delivery, analytics, customer support and security providers.
• Professional advisers, auditors and insurers, under duties of confidentiality.
• Law enforcement, regulators or courts, where we are legally obliged or where necessary to establish, exercise or defend a legal claim.
• An acquirer, in the event of a merger, sale of business or restructure, subject to equivalent protection.

7. We do not sell your information

We do not sell your Personal Information. Partners pay us for the service of being matched with relevant requirements; they do not purchase databases, bulk contact lists or profiles from us.

8. Cross-border transfers

Some of our service providers host or process data outside South Africa. Where information is transferred across borders, we do so only in terms of section 72 of POPIA — that is, where the recipient is subject to a law, binding corporate rules or a binding agreement providing an adequate level of protection, or where you have consented, or where the transfer is necessary to perform the contract with you.

9. Cookies and similar technologies

We use strictly necessary cookies to operate the site, preference cookies to remember your choices, and analytics cookies to understand usage. Where required, we obtain consent before setting non-essential cookies.

You can control cookies through your browser settings. Blocking strictly necessary cookies may prevent parts of the Platform from working.

10. How long we keep your information

When a retention period expires, we delete, destroy or de-identify the information in a manner that prevents its reconstruction.

• Unmatched or withdrawn requirements: up to 12 months from submission.
• Matched requirements and related correspondence: up to 5 years from the last interaction, to handle disputes and comply with consumer protection record-keeping norms.
• Financial and tax records: 5 years, as required by tax legislation.
• Marketing preferences and opt-out records: retained indefinitely so that we can honour your opt-out.
• Technical logs and security records: typically 12 months.

11. How we protect your information

We apply appropriate, reasonable technical and organisational measures as required by section 19 of POPIA, including encryption in transit, access controls on a least-privilege basis, hashed credentials, logging and monitoring, vendor due diligence, and staff confidentiality obligations.

No system is perfectly secure. If a security compromise affects your Personal Information, we will notify you and the Information Regulator as soon as reasonably possible in terms of section 22 of POPIA.

12. Your rights

To exercise any right, email paul@dealmatch.africa. We may ask for proof of identity. Access requests are handled under the Promotion of Access to Information Act 2 of 2000 and a prescribed fee may apply.

• To be told what Personal Information we hold about you and to receive a copy of it.
• To ask us to correct, update or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained.
• To object, on reasonable grounds, to processing based on legitimate interests.
• To withdraw consent at any time, without affecting processing already carried out lawfully.
• To opt out of direct marketing at any time and free of charge.
• To not be subject to a decision based solely on automated processing that has legal consequences for you.
• To lodge a complaint with the Information Regulator.

13. Consequences of not providing information

Some information is required to provide the service. If you do not provide it, we may be unable to match your requirement, and Partners may be unable to quote or to assess an application.

14. Complaints to the Information Regulator

• Information Regulator (South Africa)
• JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
• Email: complaints.IR@justice.gov.za
• General enquiries: inforeg@justice.gov.za

15. Changes to this policy

We may update this Privacy Policy from time to time. The version published on the Platform is the operative version, and the date of last update appears at the top of this page. Material changes will be brought to your attention.

16. Lawful basis for each processing activity

POPIA requires that every processing activity rests on a lawful justification in section 11. For clarity, we record the basis on which we rely:

• Matching your requirement to Partners: your consent, given when you submit a requirement and tick the consent statement.
• Contacting you about that requirement: performance of the arrangement between you and us, and our legitimate interest in delivering the service you asked for.
• Verifying dealership and partner credentials: our legitimate interest in protecting buyers from unverified traders, and compliance with law.
• Fraud prevention, security monitoring and abuse investigation: compliance with a legal obligation and our legitimate interests.
• Keeping accounting, tax and company records: compliance with obligations under the Companies Act, the Tax Administration Act and the Financial Intelligence Centre Act.
• Sending you optional updates, market insights or new-stock alerts: your separate, revocable consent.

17. Special personal information and children

We do not seek special personal information as defined in section 26 of POPIA — such as information on your religious beliefs, race, ethnic origin, trade union membership, political persuasion, health, sex life or biometric information — and you should not submit it to us. Where a Partner requires health information for an insurance underwriting decision, that information is collected by the Partner directly, under its own privacy notice and authorisation.

Criminal-behaviour information is processed only where a Partner's affordability, fraud or FICA screening lawfully requires it, and only with the authorisation contemplated in POPIA.

The Platform is not directed at children. We do not knowingly process the personal information of a child under 18 without the prior consent of a competent person, as required by section 35 of POPIA. If you believe a child's information has been submitted to us, contact us and we will delete it unless we are lawfully required to retain it.

18. Cookies, analytics and tracking technologies

We use strictly necessary cookies to keep you signed in, remember your form progress and protect against cross-site request forgery. These cannot be switched off without breaking the Platform.

We may also use performance and analytics cookies to understand which pages are used, where users abandon a form and how quickly pages load. Where we use a third-party analytics provider, that provider processes information as our operator under a written agreement, and we configure it to limit the collection of identifiers where practicable.

You can block or delete cookies through your browser settings. Doing so may prevent the Platform from functioning correctly. Where we deploy non-essential cookies, we ask for your consent before doing so and you may withdraw it at any time.

We do not sell information gathered through cookies, and we do not use it to build advertising profiles about you for sale to third parties.

19. Operators and third-party processors

We appoint operators — service providers who process personal information on our behalf and on our instruction — for hosting, email delivery, error monitoring, analytics, customer support and document storage. Each operator is bound by a written agreement that requires it to process information only for the purposes we specify, to maintain appropriate security safeguards, to notify us immediately of any compromise, and to return or delete information at the end of the engagement.

Operators are not permitted to use your information for their own purposes, to market to you, or to disclose it onward except as we direct or as the law requires.

20. Cross-border transfers

Some of our operators host infrastructure outside the Republic of South Africa. Where personal information is transferred across a border, we do so only in the circumstances permitted by section 72 of POPIA: where the recipient is subject to a law, binding corporate rules or binding agreement providing an adequate level of protection; where you have consented; where the transfer is necessary for the performance of the arrangement between us; or where the transfer benefits you and consent is not reasonably practicable to obtain.

In practice this means contractual data-protection terms with each offshore provider, and a preference for providers offering South African or regional data residency where that is available.

21. Information security measures

We take appropriate, reasonable technical and organisational measures to prevent loss of, damage to, or unauthorised destruction of personal information, and unlawful access to or processing of it, as required by section 19 of POPIA.

• encryption of data in transit using current TLS, and encryption at rest for stored records;
• role-based access control, with access granted on a least-privilege and need-to-know basis;
• multi-factor authentication on administrative and portal accounts;
• logging and monitoring of administrative access and unusual activity;
• regular patching of dependencies and periodic review of our security posture;
• confidentiality undertakings and privacy training for personnel with access to personal information;
• backup and recovery procedures, with restoration testing.

22. Security compromise notification

If we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible after discovering the compromise, unless a public body responsible for detecting or investigating offences directs us to delay notification.

Our notification will describe the possible consequences of the compromise, the measures we intend to take or have taken to address it, what you can do to mitigate the possible adverse effects, and the identity of the unauthorised person if known.

23. Retention schedule

We retain personal information only for as long as necessary for the purpose for which it was collected, or for as long as the law requires or permits:

• Requirements that produced no match or engagement: up to 12 months, so that we can respond if you return.
• Requirements that produced a match: up to 5 years from the date of the last interaction, for dispute, audit and commission-reconciliation purposes.
• Consent records and audit logs: at least 5 years, as evidence of the lawful basis on which we processed your information.
• Accounting and tax records: at least 5 years from the end of the relevant tax period, as required by the Tax Administration Act.
• Marketing preferences and opt-out records: retained indefinitely in a suppression list so that we do not contact you again in error.
• Support correspondence: up to 3 years from closure of the query.

24. Automated decision-making and profiling

Deal Match does not make decisions about you based solely on automated processing that has legal consequences for you. Our matching logic ranks Partners by province, brand coverage, stock type and responsiveness in order to route your requirement sensibly; a human at the Partner decides whether and how to quote.

Credit-scoring and insurance-underwriting decisions are made by the relevant Partner. Where a Partner declines an application, you are entitled under section 62 of the National Credit Act to be given the dominant reason for that decision by that Partner, and you may challenge it directly with them.

25. Direct marketing

We will only send you electronic direct marketing where you have consented, or where you are an existing customer and the marketing relates to similar products or services and you have not opted out. Every marketing message identifies the sender and contains a free, straightforward means of opting out.

In line with section 69 of POPIA, if you have previously refused marketing, we will not approach you again to request consent.

26. Your rights and how to exercise them

You have the right to be notified that we are collecting your information, to request access to it, to request correction or deletion, to object to processing, to withdraw consent, to opt out of direct marketing, to complain to the Information Regulator, and to institute civil proceedings. Email us with "POPIA request" in the subject line and describe what you want.

We may require proof of identity before acting on a request, to protect you from someone else obtaining your information. Access requests are processed under the Promotion of Access to Information Act 2 of 2000, using the prescribed form, and a prescribed fee may apply. We aim to respond within 30 days.

Where you withdraw consent, we will stop the affected processing, but Partners you have already been introduced to remain independently responsible for information they hold, and you should also address them directly.

27. Consequences of not providing information

Providing your information is voluntary. However, certain fields are necessary for the service to function: without a contact number and email we cannot send you offers, without a province we cannot route your brief, and without income and expense information a lender cannot conduct the affordability assessment required by section 81 of the National Credit Act. If you decline to provide those fields, we may be unable to match you.