What personal information we collect

We only collect what is necessary, relevant and lawful. We collect personal information needed to provide financial advice, intermediary services and support. This may include:

Basic information

• Name, surname, ID or passport number.

• Contact details (email, phone, address).

• Date of birth.

  
  

Financial information

• Income, premiums, banking details.

• Information required for suitability and affordability assessments.

Legal and compliance information

• FICA documentation.

• Identity verification results.

• Fraud‑prevention and risk checks.

Product and service information

• Quotes, applications, policy details.

• Correspondence, records of advice and disclosures.

Special personal information (when necessary)

• Health or medical information for underwriting or claims.

• Information about dependants and beneficiaries.

Website and digital information

• IP address, browser type, device information.

• Cookies and click‑through or usage data.

How we collect your information

We may collect your personal information:

• Directly from you;

• From your authorised financial adviser;

• From product providers when you apply for or service a product;

• Through our website or electronic channels;

• From public records or regulated industry databases (e.g., FICA verification tools).

Why we process your information

As an FSP, we must process personal information to:

• Provide financial advice;

• Perform affordability, suitability and needs‑analysis assessments;

• Verify your identity under FICA;

• Submit applications to product providers;

• Administer policies and assist with claims;

• Maintain records of advice (FAIS requirement);

• Communicate with you about your products or services;

• Comply with legal, regulatory and reporting obligations.

Processing is necessary to perform a contract, comply with the law, or provide financial services you request. If we cannot process certain information, we may not be able to offer advice or provide access to products. We process personal information based on consent, contractual necessity, legal obligations, and legitimate business interests where permitted by law.

How we protect your information

We use technical, organisational and physical security measures to protect your information from loss, unauthorised access, alteration, disclosure and misuse. If a personal information breach occurs that poses a risk to you, we will notify you and the Information Regulator where required by law.

This includes encryption, access controls, secure storage, monitoring and regular security reviews.

How we use cookies and website data

We use cookies and analytics tools to:

• Improve your website experience;

• Understand how our site is used;

• Enhance site functionality.

Cookies do not identify you personally. You can disable cookies through your browser settings, but some features may not function properly.

How we share your information

We only share personal information when:

• You give consent;

• We are submitting applications or servicing your product;

• It is required by law or regulatory bodies;

• We work with trusted service providers (operators); or

• We work with product providers who need information to administer your policy.

Third‑party operators

These include IT providers, administrators, compliance services, and other suppliers who help deliver our services. They must:

• Protect your information;

• Follow our instructions;

• Notify us of any data breach;

• Keep your information confidential.

Use of Artificial Intelligence (AI)
We may use AI and other automated technologies to support our services, improve operational efficiency, and enhance client experience. Where personal information is used, we apply appropriate safeguards and ensure that significant decisions affecting individuals are subject to appropriate human oversight. We do not make decisions that significantly affect individuals solely through automated processing without appropriate human involvement.

Third‑party product providers

We work with independent product providers (e.g., insurers). They act as Responsible Parties when processing your information for underwriting, policy administration, actuarial work, claims and regulatory requirements. Each product provider must protect your information according to their own privacy laws and policies. You can review their privacy notices on their websites.

Transferring information outside South Africa

If your information must be transferred outside South Africa, we will only do so if:

• The receiving country offers similar protection to POPIA;

• You give consent;

• The transfer is required to fulfil a contract;

• The transfer is in your best interest; or

• Binding agreements ensure your data stays protected.

How long we keep your information

We only keep personal information for as long as necessary to:

• Provide financial advice;

• Service your products;

• Comply with FAIS, FICA, SARS, and other legal requirements;

• Maintain lawful records of advice;

• Resolve disputes or complaints.

After retention periods expire, information is securely deleted, destroyed, or anonymised according to our internal Retention and Destruction Schedule.

Your rights as a data subject

You have the right to:

• Request the review or update of personal information where appropriate;

• Exercise your rights under PAIA and POPIA.

• Know that we are collecting your personal information;

• Request access to your information;

• Request correction or deletion of personal information;

• Object to the processing of your information;

• Withdraw consent (where processing is consent‑based);

• Object to direct marketing;

• Lodge complaints with The Amber Room or the Information Regulator;

• Lodge a FAIS‑related complaint with the FAIS Ombud.