This policy describes what personal information AfriLegacy AI collects, why we collect it, the legal basis for processing it, who it can reach, how long we keep it and the rights you have over it. It is written to satisfy the Protection of Personal Information Act (POPIA) expectations that apply to a South African financial platform, in language a client can actually follow.
"Personal information" means any information that can identify you, directly or with other data we hold. "Processing" covers everything done with that information: collecting, storing, reading, sharing and deleting it. "We" or "the platform" means AfriLegacy AI; "you" means a visitor to this website or a registered client. The responsible party for the processing described here is the platform operator, AfriLegacy AI, reachable at [email protected].
Account and contact data: first name, surname, email address and telephone number, collected through the registration form. Identity verification data: copies of your identity document and proof of address and, where required, a selfie or liveness capture, collected for KYC purposes. Transaction data: deposits, withdrawals, trading activity and balances. Content data: the messages you send us. Each category is collected for the purposes in section 04 and nothing else.
When you use the site and platform we receive technical data: IP address, browser type, device type, referring pages, and the times and routes of your visits. We use it to keep the service secure, to diagnose faults and to understand, in aggregate, how the product is used. Usage data is not used to build advertising profiles of you.
We process your information to: create and operate your account; verify your identity under our AML / KYC policy; execute and record deposits, withdrawals and trading activity; communicate with you about your account, including security alerts and the manager calls you request; comply with legal obligations that apply to financial services; and improve the platform where the analysis is done on aggregated data.
Contract: registration and the services you sign up for cannot be delivered without the relevant data. Legal obligation: identity verification, record keeping and reporting duties under applicable South African law. Legitimate interest: fraud prevention, service security and product improvement, pursued in ways that respect your rights. Consent: marketing messages are sent only where you agreed to receive them, and that agreement can be withdrawn at any time through the unsubscribe link or by email. Security obligations mean we cannot delete identity records on request while a legal retention period still runs.
The site uses a small number of cookies and similar technologies: strictly necessary ones that keep your session working and remember your choices, and functional ones that carry your selected language and currency display. Analytics and marketing cookies are used only where you accept them in the cookie banner. You can withdraw that acceptance at any time; strictly necessary cookies continue to function because without them the site cannot operate.
Contact and enquiry data: kept while your enquiry is open and briefly after, then deleted or archived. Account and transaction data: kept for the life of the account and for the statutory period applicable to financial records after closure. KYC records: retained for the period South African anti-money laundering law requires for due diligence documentation. Marketing consent records: kept until withdrawal plus a short evidentiary period. After each period, data is deleted or irreversibly anonymised.
Your information can be processed by: the licensed entities that execute transactions on the platform; affiliated companies involved in providing the service under equivalent protection obligations; IT and hosting providers that run our systems; identity verification providers that perform automated document and liveness checks; payment processors for deposits and withdrawals in rand; and regulators, competent authorities or courts where a lawful request applies. Disclosure is limited to what each recipient needs. We do not sell personal information.
Where a provider or affiliate processes data outside South Africa, the transfer takes place only under safeguards that keep the protection of your information materially equivalent: contractual data protection terms and, where relevant, the recipient's participation in a recognised framework. The categories of recipients and countries involved are available on request.
Personal information is protected by the technical and organisational measures described on our Security page: encryption in transit and at rest, role-based access control, audit logging of access, and staff trained on confidentiality. No system is perfect, so we also maintain an incident process; where a breach affecting your rights occurs and notification is required, you will be told what happened and what to do.
You may request access to the personal information we hold about you; correction of inaccurate details; deletion of data we no longer have a legal basis to keep; restriction of processing while a dispute about accuracy is resolved; objection to processing based on legitimate interest; and withdrawal of marketing consent at any time. Requests go to [email protected] and are answered within a reasonable period as POPIA expects. We may ask what we need to verify your identity before acting, to protect your account.
Providers working for us process data only on our instructions and under written data protection terms. Analytics on the site reports aggregate usage patterns; where it can identify individuals, it is loaded only with your cookie acceptance. We review providers periodically, and access is removed when a service ends.
If you see AfriLegacy AI advertising elsewhere on the internet, it may be delivered through advertising partners that measure ad performance. These partners work with cookie-based signals and honour the opt-out mechanisms in your browser or device settings. We do not transfer your identity documents, transaction data or contact details to advertising partners.
Our pages link to resources we do not operate, such as exchange information or payment method descriptions. This policy does not cover those sites: their own policies govern what happens there. Please read them before submitting information.
The platform is not directed at persons under eighteen. We do not knowingly collect personal information from children; if we learn that a registration belongs to a minor, the account is closed and the data deleted. If you believe a child has submitted information to us, write to [email protected] so it can be handled immediately.
This policy can change as the service or applicable law develops. The current version is always published on this page, and where a change materially affects how your information is used, we announce it through the platform's usual channels before it takes effect. Continuing to use the service after a change takes effect means the updated policy applies.
Questions about this policy, your data or your rights go to [email protected], handled by Client Support & Compliance during Monday to Friday, 08:00–18:00 SAST (excluding public holidays). Postal enquiries can be sent to Sandton business district, Johannesburg, South Africa.