1. Your privacy is important to Upstream (Pty) Limited (Registration no 2022/598037/07) (including its Affiliates and Representatives) (“Upstream”, “we”, “our” or “us”) and we are committed to processing your personal information in compliance with the Protection of Personal Information Act 4 of 2013 (“POPIA”) and any other applicable data protection laws.
2. This purpose of this privacy policy (Policy) is to explain how and what information we collect and how we may use that information, who we may share it with, when we may share it and how we keep it private and secure. It also explains the rights you have in relation to your personal information.
3. If you have any questions, please contact us at support@upstreammoney.co.za.
4. If you do not agree with this Policy, please do not continue to use the Upstream Sites or Services.

1. This Policy will apply when you browse, use and/ or download the Website, Upstream mobile application (“App”) or any other interface (“Sites”) through which you access, consider, browse and / or subscribe for our products and services and/ or any of the services accessible through the Sites and your communications with us.
2. By using the Sites (or downloading the App), you confirm that you have read, understood and accept the terms of this Policy. You also consent to the collection, use, storage, processing and disclosure of your personal information in the manner explained in this Policy. This Policy will apply to you, as a visitor to a Site even if you do not subscribe for our Services.
3. This Policy must be read together with any other legal notices or terms and conditions provided or made available to you on other pages of our Sites, when you download our Apps and/or when you complete and/or use any documents provided by us to you in respect of any of our Services.

1. To help you understand this Policy, this is what we mean when we use the following terms and expressions:
   • Affiliates means any company or entity which is a subsidiary of Upstream, a holding company of Upstream or a subsidiary of any holding company of Upstream (where the terms "subsidiary" and "holding company" shall have the meaning ascribed to them in Section 1 of the Companies Act, 2008 (Act No. 71 of 2008)), provided that they shall also include any foreign entity which, had it been registered in terms of the aforesaid Act, would fall within the ambit of such term. Affiliate also means any company which controls, is controlled by or is under common control of Upstream;
   • Business Partner(s) means third parties who we may collaborate with to provide you with products or services from time to time and may include Corporate Partners;
   • Corporate Partner means an organisation which has contracted with us as a Business Partner to use our Services in relation to Subscribers who are also their customers;
   • Personal Information means information about you and which can be used to personally identify you;
   • Process means everything that we do with your personal information as described in POPIA, including collection, use and storage thereof;
   • Representatives means directors, employees, and consultants of Upstream or any of its Affiliates, their service providers, suppliers, agents and partners; and may refer to any one of them as the context require.
   • Services means the products and services offered by Upstream and such additional services as may be used to facilitate the operation of our Services to you, including, for example, electronic billing platforms, online portals, and interactive customer Sites, and shall include the content and information provided or exchanged as part of such services;
   • Service Provider means third parties who we may contract with from time to time to assist with the operation and implementation of the Services we provide you;

1. We collect and store personal information about you directly and indirectly from the following sources:
   • directly from you when you provide it to us, such as when you complete the contact us or an application on our Sites, enter into an agreement with us, register an account, apply or become a subscriber, Business Partner or user, contact us, communicate with us (like via email or WhatsApp chat), lodge a complaint, enter a competition or survey from us or otherwise through the course of our relationship with you;
   • third parties to verify your identity and bank account details where you have consented;
   • Corporate Partners, where you have consented;
   • from your web browser when you visit our Sites, subject to the settings of your web browser;
   • from public sources where you have made your personal information public, such as on social media or online platforms;
   • from your interaction with our Services and products and services of our Service Providers and Business Partners and/ or when you use any features or resources available on or through our Sites; and
   • 4.7. from other third parties if you consent thereto and/ or if the law allows for it.

1. We collect various categories of personal information depending on the reason for processing. The categories may (but will not necessarily) include, and shall not be limited to:
   • General personal details: for individuals, we collect for example name and surname, identity or passport number, bank account details, debit order details; and for juristic persons, we collect registered name, registration number, address, directors’ details and VAT details.
   • Contact details: your address, contact number, email address, public social media profiles.
   • User information: personal information included in correspondence between us, transaction documents, how you provide products or services to us (when you are a Service Provider or Business Partner for example) or how you use our Services and/ or Business Partner products or services (when you are a Subscriber or user for example).
   • Bank Account details: for example, username, password (note that we cannot view this), usage data, and aggregate statistical information.
   • Banking Information: transactional information about your bank account which you agree to share with us;
   • Consent records: records of any consents you have given us, as well as any records of your withdrawal or refusal of consent.
   • Payment details: for example, bank account details, remuneration, banking transaction information, information provided by payment gateway service providers, payments made in terms of the service and related information.
   • Log data and data relating to our services: for example, your device type, the operating system and browser, browser settings, IP address, dates and times of connecting to and using the website or app and other technical communications information, including cookies and other technologies.
   • Views and opinions: any views and opinions that you choose to share with us, or publicly post on our Sites, social media platforms or elsewhere.
   • Children’s Personal Information: our services are not aimed at persons under the age of 18 and we do not collect children’s data.

1. We only process adequate and relevant personal information:
1. For purposes of your Subscription and our agreement with you;
2. For purposes of Business Partner agreements;
3. To operate and manage your application, account or relationship with us and, where applicable, Business Partners;
4. To monitor and analyse our Services to provide optimum performance and ensure they are operating properly, for financial management and for business-development purposes;
5. To contact you by email, WhatsApp, SMS, push notifications or other means to inform you about your Subscription, our Services and/ or Business Partner products or services. Subject to lawful exceptions, you can opt-out of such communications at any time;
6. To form a view of you as an individual/juristic person and to identify, develop or improve our Site offerings and to assess your application and create a profile of you;
7. For fraud prevention;
8. To carry out market research and surveys, business and statistical analysis and necessary audits;
9. To perform other administrative and operational tasks like testing our processes, systems and security measures; and
10. To comply with our regulatory, legal or other requirements or obligations.

• We may also use your personal information for other purposes if the law allows for it, you consent to it, or if it is in the public interest to do so. All purposes for the processing of your personal information will be legal in terms of POPIA.

1. Part of our Services include the offering of selected Business Partner products and services.
2. The Policy generally provides information on our processing practices when we are the responsible party for the personal information processed.
3. When dealing with Business Partners which you choose to investigate and/ or use, we may process personal information received from such Business Partners as an operator on behalf of the Business Partner, unless or until you register to use a Site and Services. At this point we also become a responsible party and you will be a customer of both upstream and the relevant Business Partner. When we hold information as an operator, we only act on the instructions of the Business Partner.

1. Where you are a customer of a Corporate Partner and register to subscribe for the Services, you understand and agree that we may exchange personal information with the Corporate Partner for purposes of reporting and to operate our agreement with the Corporate Partner concerned and provide our Services to you.

1. As a user of our Sites and/or Services, we may contact you to provide information about our Services and related products or services.
2. We also use your information to send you marketing by email, SMS, or to call you about Business Partner products and services. We will include the opportunity to opt-out from marketing in each communication.
3. If you ask us to, we will send you our newsletter.
4. If you are not a Subscriber or user, we will only send you direct marketing communications if you consented to it, or otherwise in compliance with POPIA.
5. You may unsubscribe from any direct marketing at any time if you contact us at support@upstream.money and request to unsubscribe. We will not send you any direct marketing if you unsubscribe, but may still contact you for purposes of the agreement between us as part of our business relationship with you.

1. We will keep your personal information confidential and only share it with others in terms of this Policy, if you consent to it, or if the law allows or requires us to share it. We will typically share or disclose your (relevant) personal information to:
2. 1. our Business Partners or Service Providers;
   2. If you ask us to, we may share your information with other companies who advertise on our website and with those companies whose products or services you applied for;
   3. Service Providers who help us deliver our Services to you only if they have agreed to protect your information. For instance, we may share your information with our SMS service providers. Some of our Service Providers are situated overseas, and we may share your personal information with them.
   4. legal and regulatory authorities, upon their request, or for the purposes of reporting as prescribed or for purposes of any breach of legislation;
   5. accountants, auditors, lawyers and other external professional advisors;
   6. any relevant party to the extent necessary for the establishment, exercise or defence of legal rights, criminal offences, threats to public security, etc.;
   7. if you register as a subscriber, we may use your information to collect your credit score and credit report from a credit bureau;
   8. If there is a change in our company structure or ownership, we may share your information as part of the assets transferred, or the due diligence for that transaction.
   9. any relevant third party provider where we use third party advertising, plugins or content in our services.

   10. to a third party:

       1. if we believe that disclosure is reasonably necessary to comply with the law, legal process, or a government request:
       2. to enforce our agreements and policies;
       3. to protect the security and integrity of our Services;
       4. to protect ourselves, clients, Business Partners and the public from illegal activity; or
       5. to respond to an emergency which we believe in good faith requires that we disclose your personal information.

We may from time to time need to transfer personal information to and from recipients in different countries and if we do, we will always do so in compliance with POPIA. We will only transfer personal information to third parties in countries with adequate data protection laws or transfer it in terms of a written agreement with the recipient which imposes data protection requirements as required by POPIA. An example of such transfer may be when a third-party technology service provider resides offshore.

1. We have implemented appropriate technical and organisational security measures in accordance with POPI, designed to protect personal information against accidental or unlawful destruction, loss, alteration, disclosure, access and other unlawful or unauthorised forms of processing.
2. The internet is an open and often vulnerable system and the transfer of information over the internet is not completely secure. Although we will implement all reasonable measures to protect personal information, we cannot guarantee the security of your personal information that you transfer to us using the internet and you use the internet at your own risk.

1. You have the right to:
2. ask what personal information we have about you;
3. ask what personal information we sent to our suppliers, service providers, or anyone else;
4. ask us to update, correct, or delete any out-of-date or incorrect personal information we have about you;
5. unsubscribe from any direct marketing communications we may send you;
6. object to the processing of your personal information; and
7. make a complaint to the Information Regulator.

You can send any request or comment in respect of your privacy rights or this policy to support@upstream.money.

1. When you use our website, we automatically receive and record information on our server logs from your browser. This information may, for example, include browser type, language preference, referring site, the date and time of each visitor request, your location, IP address, cookie information, and Google Analytics information. This is statistical data about browsing actions and patterns. We may also receive information about your general internet usage through a cookie file which is stored on your hard drive. Cookies enable us to improve our website and services, estimate our audience size and usage patterns, store information about preferences, and recognize when you return to our website.
2. In some instances, we may collect and store information about your location through cookies (other than when you share your location with us). We convert your IP address into a rough geo-location, and we may use location information to improve and personalize our website and services for you.
3. You can set your web browser to refuse cookies, but if you do this, you might not be able to enjoy the full use of the website or services, and you may not be able to take advantage of certain promotions we may run.
4. Please note that third parties may also use cookies, but we do not have access to or control over them, and therefore cannot take responsibility for them.

1. Our website may include links to other apps or third-party websites which do not fall under our supervision. We do not accept any responsibility for your privacy if you use these links or for the content of these sites. We display these links to make it easier for you to find information about specific subjects. If you use or rely on these links, it is at your own risk.

1. We do not intentionally collect or use children’s personal information.
2. If we ever need to collect and/or process children’s personal information or special personal information as a result of our business relationship or services, we will only do so with consent or if otherwise allowed by POPI.

1. We take reasonable steps to ensure that we only process personal information for the period necessary for the purposes set out in this Policy, including any period necessary to establish, exercise or defend any legal rights.
2. We therefore retain personal information in accordance with the required retention periods in terms of any laws that require specific retention periods, or otherwise in terms of POPI or for legitimate business purposes. We may retain information indefinitely in a de-identified format for research and statistical purposes, which may include, for example, statistics of how you use the website and services.

1. We will report any security breach to the applicable regulatory authority in terms of POPI and to the data subjects whose personal information is involved in the breach. If you want to report any concerns about our privacy practices or if you suspect any breach regarding your personal information, please send an email to support@upstream.money.

1. Any changes we may make to this Policy in the future will be posted on the Website and, where appropriate, notified to you when you next start the App. The new terms may be displayed on-screen and you may be required to read and accept them to continue your use of the App or the Services. In any event, by continuing to use the App or any Services after the posting of any changes, you confirm your continuing acceptance of this Policy together with such changes, and your consent to the terms set out therein.

1. If you want to raise any objection or have any queries about our privacy practices, you can contact our information officer at info@upstream.money.
2. You also have the right to formally lodge a complaint as follows: