Privacy Policy

1. Introduction

This Privacy Policy describes how FinSight (the “Responsible Party”, “we”, “us”, or “our”) will process your Personal Information (PI) in the ordinary course of our business operations and through our financial analysis platforms (collectively referred to as our “Site/s”). By utilizing our services or any of our Sites, you are accepting and consenting to this Policy.

The right to privacy is protected under Section 14 of the Constitution of South Africa, which safeguards individuals from the unlawful collection, retention, sharing, and use of their personal information. FinSight is committed to adhering to the principles outlined in the Protection of Personal Information Act (POPIA) to honour and uphold this constitutional right. We are registered as a Responsible Party that processes personal information belonging to data subjects, including clients, employees, and service providers.

2. What Personal Information We Process

POPIA defines personal information as information relating to an identifiable, living, natural person and, where applicable, an identifiable, existing, juristic person. As a financial analysis tool, FinSight processes the following:

• General Personal Information: Names, contact details (email, physical/postal address, telephone numbers), bank account details, tax numbers, and VAT numbers.
• Juristic Entity Information: Financial data of the entity, information relating to ownership and management, and private/confidential correspondence.
• Platform & Device Data:
  • Log data: Unique device IDs, IP addresses, operating systems, and browser types.
  • Location information: Used to improve and customize features, depending on your device permissions.
  • Cookies: Functional cookies are used to remember user preferences (like usernames and settings) to improve our services. You can instruct your browser to refuse all cookies, though some features of our website may become unavailable.

3. Eight Conditions for Lawful Processing

FinSight adheres to the eight fundamental conditions for the lawful processing of personal information as required by POPIA:

• Accountability: We ensure all processing of personal information is conducted lawfully, responsibly, and ethically.
• Processing Limitation: Information collected must be relevant, adequate, and not excessive. We process PI only with consent, to perform a contract, to comply with legal obligations, or to protect legitimate interests.
• Purpose Specification: We only collect personal information for specific, clearly defined, and legitimate reasons related to our functions.
• Further Processing Limitation: Any further processing of PI must be compatible with the original purpose for which it was collected, or otherwise requires new consent or public interest justification.
• Information Quality: We take reasonably practicable steps to ensure that the personal information we handle is complete, accurate, not misleading, and kept up to date. Data subjects are also responsible for providing up-to-date information.
• Openness: We maintain documentation of all processing activities and take steps to notify data subjects when information is collected, outlining our name, the collection purpose, and whether the collection is voluntary.
• Security Safeguards: We implement appropriate, reasonable technical and organizational measures (such as firewalls, anti-virus programs, passwords, and encryption) to prevent the loss, damage, or unlawful access to personal information.
• Data Subject Participation: Data subjects have the right to access their information, request corrections, or object to the processing of their personal information.

4. Electronic Communications and Direct Marketing

• We will only send direct marketing messages (via email, SMS, etc.) if clear consent has been given.
• New Customers: We require explicit, active “opt-in” consent to send direct marketing.
• Existing Customers: We may market to existing customers provided they were given an initial opportunity to opt out and chose not to do so.
• You may opt out or refuse processing for direct marketing at any time.

5. Transborder Flow of Information

Personal information will not be sent to a third party in another country unless specific safeguards are in place. These safeguards include ensuring the foreign country has laws providing adequate protection, utilizing binding corporate rules, establishing a formal agreement guaranteeing protection, obtaining data subject consent, or when necessary to fulfill a contract.

6. Rights of Data Subjects

Under POPIA, you possess the following rights regarding your data:

• Right to be Notified: To be informed when your PI is collected or if it has been compromised in a data breach.
• Right of Access: To request confirmation of whether we hold your PI and obtain a record of it free of charge.
• Right to Correction/Deletion: To request the correction, destruction, or deletion of inaccurate, irrelevant, or unlawfully obtained PI.
• Right to Object: To object to the processing of your information or to refuse processing for direct marketing.
• Automated Decision-Making: The right not to be subject to decisions based solely on automated processing (like profiling) that carry significant consequences.
• Civil Proceedings: The right to sue a responsible party for damages resulting from interference with your personal information.

7. Information Officer and Complaints

FinSight’s Information Officer is responsible for ensuring compliance with POPIA, including the development and implementation of a compliance framework. In the event of an unauthorized data breach, the Information Officer will notify the Information Regulator and affected data subjects as soon as reasonably possible.

8. Penalties for Non-Compliance

Compliance is enforced by the Information Regulator. Non-compliance with this Policy can result in disciplinary action, administrative fines, or imprisonment depending on the severity of the breach.