Privacy Policy

1. Commitment to Privacy & Statutory Scope

Potla is committed to safeguarding your privacy in full compliance with the Protection of Personal Information Act 4 of 2013 ("POPIA") and the Electronic Communications and Transactions Act 25 of 2002 ("ECTA"). This Privacy Policy explains how we collect, process, safeguard, and retain personal information when you use our Progressive Web App.

2. Personal Information We Collect

To provide seamless digital pocket operations and satisfy South African statutory KYC requirements, we process the following categories of personal information:

• Contact & Account Data: South African mobile phone number and optional email address.
• Identity & Regulatory Data: Full legal name, South African National ID number, date of birth, and identity documentation required under FICA.
• Transactional Records: Real-time transfer records, amounts, sender/recipient phone numbers, timestamps, and payment references.
• Technical Telemetry: Device operating system, browser user-agent, IP address, and PWA installation state for fraud prevention and security telemetry.

3. Purpose and Legal Basis for Processing

We process your personal information strictly for legitimate operational and compliance purposes, including:

• Authenticating your session via passwordless SMS OTP.
• Facilitating instant wallet-to-wallet P2P transfers and processing bank payouts.
• Preventing fraud, identity theft, unauthorized account access, and money laundering.
• Fulfilling mandatory compliance reporting to the Financial Intelligence Centre (FIC) and South African Reserve Bank (SARB).

4. Data Security & Cryptographic Safeguards

Potla deploys multi-layered defense mechanisms. All sensitive credentials, tokens, and identity numbers are cryptographically hashed and encrypted at rest. Communications between your mobile device and our backend servers are strictly enforced over TLS 1.3 with automated certificate rotation. Authentication tokens are persisted in secure, SameSite cookies with strict session lifetimes.

5. Third-Party Service Providers & Data Sharing

We do not disclose personal information to external entities except as strictly necessary to fulfill your financial requests:

• Payment Processors: Paystack South Africa (Pty) Ltd for processing PCI-DSS compliant card top-ups.
• Telecom Gateways: South African mobile network operators (Vodacom, MTN, Telkom, Cell C) to deliver time-sensitive authentication SMS codes.
• Law Enforcement & Regulators: When legally compelled under subpoena, court order, or statutory FICA directives.

6. Data Retention Policy

Under Section 22 of FICA, financial institutions and digital value operators are legally obligated to retain customer identification data and transactional ledgers for a minimum statutory period of five (5) years following the conclusion of a transaction or closure of an account. Non-financial telemetry is purged on a rolling 90-day cycle.

7. Your Statutory Rights Under POPIA

Under Sections 23 to 25 of POPIA, you have the right to:

• Request confirmation of whether we hold personal information about you.
• Request a copy of your personal transaction and identification records.
• Request the correction or updating of incorrect, outdated, or misleading records.
• Lodge a complaint with the South African Information Regulator if you believe your personal information has been processed unlawfully.

8. Contact Our Information Officer

To exercise any of your data rights or to submit an inquiry regarding our data handling practices, please contact our appointed Information Officer at support@potla.app.