Our Privacy Policy

The X Quotient POPI and PAIA Policy

1. Overview of the Policy

This Privacy Policy sets out the principles and procedures that The X Quotient (Pty) Ltd (the Company) has adopted in terms of the Protection of Personal Information Act, No 4 of 2013 (“the POPI Act”), to protect the privacy of its employees, visitors, customers, agents and suppliers (Data Subject/s) whilst ensuring that the business strategy and objectives of the Company are satisfied.  

The Company is committed to treat all Personal Information carefully and responsibly whilst complying with the POPI Act, in terms of which, this notice may also apply on behalf of other third parties (such as authorised agents, suppliers and contractors), acting on the Company’s behalf when providing customers with solutions. If the Company processes Personal Information for another party under a contract or a mandate, however, the other party’s privacy policy or notice will apply.

The Data Subject, by accepting any agreement, contract, mandate or annexure with the Company or by utilising any solutions offered by the Company, agree that in order to:

• • conclude and fulfil contractual terms or obligations to a Data Subject
  • comply with obligations imposed by law;
  • to protect or pursue a Data Subject’s, the Company’s, or a third party’s legitimate interests, including offering solutions that best meet the Data Subject’s needs

the Data Subject’s Personal Information may be processed through systems and employees across companies in The X Quotient group and may be used for the purposes, in the manner, and with the appropriate controls as set out in this notice.

Where it is necessary to obtain consent for said processing, the Company will seek Data Subjects’ consent separately. Data Subjects should read the consent request carefully as it may limit their rights.

2. What is Personal Information?

Personal Information includes any information that lets the Company identify you, such as your name/s and surname combined with your physical address, contact details and/or passport/identity number.

In South Africa, Personal Information also refers to the Personal Information that uniquely identifies a legal entity, such as the trading name of a Company combined with the Company registration number.

Special Personal Information includes that which details your race or ethnic origin, religious and philosophical beliefs, political persuasion, trade union membership, health or sex life, biometric information or any criminal behaviour which relates to alleged criminal offences or proceedings.

3. Contact Details of the Information Officer

4. Reasons Why The X Quotient Processes Personal Information?

Definition – Processing of Personal Information

The term ‘processing’ includes collecting, using, altering, merging, linking, organising, disseminating, storing, retrieving, disclosing, erasing, archiving, destroying, disposing or otherwise dealing with Personal Information. 

The Company will only collect and process Personal Information for the reason it was provided, or to enable the Company to comply with the requirements of specific local or foreign laws governing the Company; or to comply with any regulations, directives, judgments or court orders, government sanctions or embargoes, reporting requirements under financial transactions legislation, and demands of any authority, regulator, tribunal, enforcement agency or exchange body, or to fulfil its HR obligations to its employees, or to protect the Data Subject’s or the Company’s legitimate interests.

The Company collects and processes Data Subjects’ Personal Information at the start of, and for the duration of their relationship with the Company, and may also process Data Subjects’ Personal Information when their relationship with the Company has ended. 

The General Purposes for which The X Quotient collects and processes Personal Information include, but are not limited to:

• • If it is necessary to do so in terms of a contract (written or implicit)
  • To comply with legislative and/or regulatory requirements 
  • To create a record of the Data Subject on the Company’s systems
  • To verify the Data Subject’s identity and physical address, and contact details for security purposes 
  • To create a record of all related parties of the Data Subject such as shareholders, company directors and senior managers
  • To communicate with Data Subjects and carry out their instructions and requests
  • To open, manage and maintain bank accounts at the Company’s nominated bankers on behalf of Data Subjects
  • To assess and process applications for Company products and/or services, conduct affordability assessments, credit risk assessments and credit scoring; and assess the Company’s lending and insurance risks
  • To disclose and obtain Personal Information from credit bureaux regarding a Data Subject’s credit history
  • To enable the provision and receipt of products and/or services
  • Any purpose related to the prevention of financial crime, the detection and prevention of fraud, crime, money laundering or other malpractice
  • To perfect security provided for credit facilities and collect on any agreement when a Data Subject is in default or breach of the terms and conditions of the agreement, such as tracing a Data Subject, or to institute legal proceedings against a Data Subject
  • To generally protect and enforce the Company’s rights and remedies in the law
  • For applicants for employment at the Company, applicant screening and background checks are performed 
  •  For Company employees (including contractors), an employment record is created on a system to enable monitoring, communication and the payment of and deductions from employees’ salaries
  • For suppliers to the Company, Personal Information is processed for due diligence, risk assessment, administrative and payment purposes
  • To develop, implement, monitor and improve the Company’s credit models and credit tools and business processes, policies and systems, and any other legitimate research purposes
  • To meet record-keeping obligations and manage business continuity and emergencies 
  • For other legitimate purposes relating to the Company’s business

5. When and Why does The X Quotient process Special Personal Information

The Company will not process a Data Subject’s special Personal Information unless:

• • The Data Subject has consented to the Company processing it (in circumstances where the Company is legally obliged to obtain the Data Subject’s consent)
  • It is necessary to exercise or defend a right or obligation in law
  • It is necessary to comply with an international legal obligation of public interest
  • It is for certain historical, research or statistical purposes that would not adversely affect the Data Subject’s privacy
  • The Data Subject has deliberately made the Personal Information public

6. From whom does The X Quotient collect Personal Information?

The Company collects information about Data Subjects:

• • Directly from customers, suppliers, agents, individuals and Juristic entities
  • Based on Data Subjects’ use of the Company’s electronic channels as applicable
  • Based on how Data Subjects engage or interact with the Company, such as on social media, and through emails, letters, telephone calls and survey
  • Based on a Data Subjects’ relationship with the Company
  • From public sources (such as newspapers, Company registers, online search engines, deed registries, public posts on social media)
  • Based on Data Subjects’ engagement with the Company’s advertising, marketing and public messaging

The Company will only collect Personal Information from other sources where it is legally entitled or obliged to do so, and Data Subjects are entitled to request which sources the Company used in the process of collecting their Personal Information.

7. Third Parties from whom The X Quotient may collect Personal Information

The third parties (which may include parties the Company engages with as independent responsible parties, joint responsible parties or operators) from whom the Company may collect Data Subjects’ Personal Information include, but are not limited to, the following:

• • The Data Subject’s spouse, dependants, partners, employer, joint applicant or account holder and other similar sources
  • The Data Subject’s bankers whom the Data Subject has authorised to share their Personal Information
  • Any other people the Data Subjects has authorised to share their Personal Information
  • Attorneys, tracing agents, debt collectors and other persons that assist with the enforcement of agreements
  • Payment processing services providers, merchants, banks and other persons that assist with the processing of Data Subjects’ payment instructions
  • Insurers, brokers, other financial institutions or other organisations that assist with insurance and assurance underwriting
  • Law enforcement and fraud prevention agencies, and other persons tasked with the prevention and prosecution of crime
  • Regulatory authorities, industry ombudsmen, government departments, and local and international tax authorities
  • Courts of law or tribunals
  • Qualification information providers
  • Trustees, executors or curators appointed by a court of law
  • The Company’s suppliers, service providers, agents and subcontractors, used to offer and provide solutions to Data Subjects
  • The Company’s joint venture partners
  • Social media platforms, and online search engine providers
  • The Company may obtain Data Subjects’ Personal Information from Credit Bureaux for any one or more of the following reasons:
    • If the Data Subject requested the Company to do so, or agreed that it may do so
    • To verify a Data Subject’s identity
    • To obtain or verify a Data Subject’s employment details
    • To obtain and verify a Data Subject’s marital status
    • To obtain, verify, or update a Data Subject’s contact or address details
    • To obtain a credit report about a Data Subject, which includes their credit history and credit score, when the Data Subject applies for a credit agreement
    • To determine a Data Subject’s credit risk
    • For debt recovery
    • To trace a Data Subject’s whereabouts
    • To conduct research, statistical analysis or system testing
    • To determine the source(s) of a Data Subject’s income
    • To build credit scorecards which are used to evaluate credit applications
    • To assess an application for insurance cover

8. When, how, and with whom The X Quotient shares Personal Information

The Company will not share Data Subject’s Personal Information with third parties who do not need it, or where the Company is not legally permitted to do so. When the Company decides to transfer Personal Information to third parties, it will only provide it to organisations that have data privacy policies equivalent to the Company’s, or subject to appropriate contractual obligations, or to those who are subject to laws relating to the processing of Personal Information that are similar to those that apply to the Company.

8.1 Reasons why The X Quotient may share Personal Information with third parties

• • If the Data Subject has consented to this
  • If it is necessary to conclude or perform under a contract the Company has with the Data Subject
  • If the law requires it
  • If it is necessary to protect or pursue the Data Subject’s, the Company’s or a third party’s legitimate interest

The X Quotient may disclose Personal Information to the following parties if it has a right or duty to do so:

• • The Company’s employees, subject to access control limitations, as required by their employment conditions
  • Law enforcement, fraud prevention agencies, courts of law and other persons tasked with the prevention and prosecution of crime
  • Regulatory authorities, industry ombudsmen, governmental departments, local and international tax authorities and other persons the law requires the Company to share Data Subjects’ Personal Information with
  • The Company’s service providers, suppliers, agents and subcontractors, and other persons used to offer and provide solutions to Data Subjects such as:
    • Agents, suppliers, service providers and sub-contractors
    • Banks and payment processing services providers
    • Attorneys, tracing agents and debt collectors
  • Any connected companies, subsidiary companies, associates, cessionary, delegates, assignees, affiliates or successors in title and/or appointed third parties (such as its authorised agents, partners, contractors and suppliers) for any of the purposes identified in this notice
  • The Data Subject’s spouse, dependants, partners, employer, joint applicant or account holder and other similar sources
  • Parties the Data Subject has authorised to obtain their Personal Information, such as a person that makes a travel booking on the Data Subject’s behalf, or a medical practitioner for insurance purposes
  • Attorneys, tracing agents, debt collectors and other persons that assist with the enforcement of agreements
  • Payment processing services providers, merchants, banks and other persons that assist with the processing of Data Subjects’ payment instructions
  • Insurers, brokers, other financial institutions or other organisations that assist with insurance and assurance underwriting
  • Qualification information providers
  • Trustees, executors or curators appointed by a court of law
  • Persons to whom the Company have ceded its rights or delegated its obligations to under agreements, such as where a business is sold
  • The general public, where Data Subjects submit content to Company social media sites such as the Company’s facebook page
  • The Company’s joint venture partners with which it has concluded business agreement

Credit Bureaux

The Company will share a Data Subject’s Personal Information with the credit bureaux for, among others, any one or more of the following reasons:

• • To report the application for a credit agreement
  • To report the opening of a credit agreement
  • To report the termination of a credit agreement
  • To report payment behaviour on a credit agreement
  • To report non-compliance with a credit agreement, such as not paying in full or on time

9. How The X Quotient uses Personal Information for Marketing Purposes

The Company may use Personal Information to market its products and services to Data Subjects electronically via email, SMS, Social Media or other electronic channels. Data Subjects can request the Company to stop sending marketing communications at any time using the Opt Out option or sending an email to admin@thexquotient.com

10. How The X Quotient Secures Personal Information

The Company takes appropriate and reasonable technical and organisational steps to protect Personal Information in line with industry standards. These security measures (including physical, technological and procedural safeguards) are appropriate and reasonable and include the following:

• • keeping Company computer and network systems secure (by monitoring access and usage)
  • storing Company physical and electronic records securely
  • controlling the access to Company buildings, systems and/or records
  • safely destroying or deleting records
  • investigating and reacting to security incidents

11. How Long does The X Quotient Keep Personal Information?

The Companies Act, No 71 of 2008, has a general requirement, in respect of any information that a company is required to keep (whether in terms of the Companies Act or any other legislation), to retain such information for a period of at least seven years.

The Company will therefore keep personal information of the Data subject for as long as a contractual relationship exists between the Company and the Data Subject and for seven years after the termination of the contractual relationship between the parties or for a longer period if;

• • A contract (written or implicit) requires the Company to do so
  • The Data Subject has consented to the Company keeping it.
  • It is required for statistical, historical or research purposes
  • It is required for lawful Company business purposes

12. The X Quotient Website and Social Media pages

Using the Company’s website and/or its social media pages signifies acceptance of this Privacy Policy. If Data Subjects do not agree to this Policy, please do not make use of the Company site and/or social media pages. Please note that Personal Information gathered in online forms and subscription requests on the website and any Personal Information which is placed on Company social media pages is used to personally identify users that make use of these services. Website usage information may be collected using “cookies” which allows the Company to collect standard internet visitor usage information.

This Personal Information will not be used for anything other than that which is stated in any terms and conditions of use for these services. None of the Personal Information will be sold or made available to anyone outside of the Company who are not covered by this policy.

13. Communication Preferences 

The Company will adhere to Data Subjects’ communication preferences whenever possible can, but we may need to send Data Subjects important communications via a channel that is not their preference. The Company will only do so in cases where it deems the information to be important and relevant for the Data Subject.

14. Rights and Duties of Data Subjects regarding their Personal Information in the possession of The X Quotient

Data Subjects must provide the Company with proof of identity when enforcing the rights below.

Data Subjects warrant that when they provide the Company with Personal Information of their spouse, dependants or any other person, they have permission from them to share their Personal Information with the Company. The Company will process the Personal Information of the Data Subject’s spouse, dependent or any other person which the Data Subject has shared with it as stated in this notice.

14.1 Right to Access

Data Subjects have the right to request access to the Personal Information the Company has about them by contacting the Company. This includes requesting:

• • Confirmation that the Company holds the Data Subject’s Personal Information
  • A copy or description of the record containing the Data Subject’s Personal Information
  • The identity or categories of third parties who have had access to the Data Subject’s Personal Information

The Company will attend to requests for access to Personal Information within a reasonable time. Data Subjects may be required to pay a reasonable fee to receive copies or descriptions of records, or information about, third parties. The Company will inform Data Subjects of the fee before attending to their request. Please refer to our PAIA manual for the process to access your Personal Information

Data Subjects should note that the law may limit their right to access information.

14.2 Right to Correction, Deletion or Destruction

Data Subjects must inform the Company when their Personal Information changes, as soon as possible after the change. Data Subjects have the right to request the Company to correct, delete or destroy the Personal Information it has about them if it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, obtained unlawfully, or if the Company is no longer authorised to keep it. Data Subjects must inform the Company of their request in the prescribed form. The Company will take reasonable steps to determine if the Personal Information is correct and make any correction needed. It may take a reasonable time for the change to reflect on the Company’s platform/systems. The Company may request documents from the Data Subject to verify the change in Personal Information.

A specific agreement that a Data Subject has entered into with the Company may determine how the Data Subject must change their Personal Information provided at the time when they entered into the specific agreement. Data Subjects must adhere to these requirements.

If the law requires the Company to keep the Personal Information, it will not be deleted or destroyed upon the Data Subject’s request. 

The deletion or destruction of certain Personal Information may lead to the termination of a Data Subject’s business relationship with the Company.

14.3 Right to Objection

Data Subjects may object on reasonable grounds to the processing of their Personal Information where the processing is in their legitimate interest, the Company’s legitimate interest or in the legitimate interest of another party.

Data Subjects must inform the Company of their objection in the prescribed form. 

The Company will not be able to give effect to the Data Subject’s objection if the processing of their Personal Information was and is permitted by law, the Data Subject has provided consent to the processing and the Company’s processing was conducted in line with their consent; or the processing is necessary to conclude or perform under a contract with the Data Subject. The Company will also not be able to give effect to a Data Subject’s objection if the objection is not based upon reasonable grounds and substantiated with appropriate evidence.

The Company will provide Data Subjects with feedback regarding their objections.

14.4 Right to Withdraw Consent

Where a Data Subject has provided their consent for the processing of their Personal Information, the Data Subject may withdraw their consent. If they withdraw their consent, the Company will explain the consequences to the Data Subject. If a Data Subject withdraws their consent, the Company may not be able to provide certain solutions to the Data Subject. The Company will inform the Data Subject if this is the case. The Company may proceed to process Data Subject’s Personal Information, even if they have withdrawn their consent, if the law permits or requires it. It may take a reasonable time for the change to reflect on the Company’s systems. During this time, the Company may still process the Data Subject’s Personal Information.

14.5 Right to Complain

Data Subjects have a right to file a complaint with the Company or any regulator with jurisdiction about an alleged contravention of the protection of their Personal Information. The Company will address Data Subjects’ complaints as far as possible. 

If you believe the Company is using your Personal Information unlawfully, please inform the Company first on pieter@thexquotient.com or +27 12 433 6592.

Alternatively, if the Company cannot address your concerns to your satisfaction, you may lodge a complaint to the Information Regulator (South Africa) with the following contact details:

• • Website: https://www.justice.gov.za/inforeg/index.html.
  • Address: SALU Building, 316 Thabo Sehume Street, Pretoria.
  • Contact number: 012 406 4818.
  • Fax number: 086 500 3351.
  • Email: inforeg@justice.gov.za.

15. Updating of and Agreeing to this Privacy Policy

The Company may change this Privacy Policy from time to time if the law or its business practices require such change. If you do not agree with this Privacy Policy, please do not provide the Company with any Personal Information and please refrain from continuing to use its products or services.