Privacy Policy

We use your information to:

• Process purchase order financing applications
• Verify identity and conduct FICA compliance checks
• Assess creditworthiness and risk
• Facilitate purchase order financing for suppliers
• Communicate with you about your applications and account
• Send important updates, notices, and marketing communications (with your consent)
• Prevent fraud and ensure platform security
• Comply with legal and regulatory obligations (NCR, FICA, POPIA)
• Process IT support requests and track infrastructure issues
• Send important account and status alerts via email
• AI-assisted verification of FICA and compliance documents for admin/IT roles
• Improve our services and platform functionality

New Smartfin operates a unified escalation matrix that consolidates fraud (FIC STR), IT issue, and gate/compliance override escalations into a single administrative view. This ensures every escalation path is monitored and that confidential data is accessible only to authorised roles.

These row-level security rules are enforced at the database level on every request, ensuring confidential data is locked to the appropriate roles regardless of the access path.

We use AI-assisted verification to review FICA and compliance documents submitted by admin, IT support, and supplier users. When you upload identity, bank confirmation, or proof-of-address documents, our system analyses them for authenticity and completeness.

• AI verification results are stored alongside your submission and reviewed by an administrator before final approval
• Documents are processed securely and retained only for the duration required by FICA and NCA regulations
• You may request human review of any AI-generated verification decision

When you report a technical issue or request onboarding assistance, we create an IT support ticket that may include:

• Your name, email, phone number, and company (if provided)
• A description of the issue and any related entity references
• Priority and status tracking data
• Resolution notes recorded by IT support staff

IT support tickets are visible to the reporting user, assigned IT staff, and administrators. Critical issues may be auto-created from backend monitoring and escalated to all administrators after SLA thresholds are breached.

We implement industry-standard security measures to protect your information:

• Encryption of data in transit (SSL/TLS) and at rest
• Secure cloud infrastructure with access controls
• Regular security audits and vulnerability assessments
• Employee training on data protection and confidentiality
• Multi-factor authentication for user accounts
• Audit logs of all system access and data changes
• Backend automation functions authenticate via server-side shared secrets, preventing forged external requests from triggering automated workflows

While we strive to protect your personal information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

We retain your personal information for as long as necessary to:

• Fulfill the purposes outlined in this policy
• Comply with legal obligations (NCR requires 5 years minimum)
• Resolve disputes and enforce our agreements

When information is no longer needed, we will securely delete or anonymize it in accordance with applicable laws.

Our platform uses cookies and similar technologies to:

• Enable essential platform functionality
• Analyze usage patterns and improve user experience
• Remember your preferences and login session
• Provide relevant content and communications

You can control cookies through your browser settings, but disabling certain cookies may affect platform functionality.

Our platform may contain links to third-party websites (e.g., government portals, payment processors, verification services). We are not responsible for the privacy practices or content of these external sites. We encourage you to review their privacy policies.

Some of our service providers may process data outside South Africa. We ensure appropriate safeguards are in place, such as standard contractual clauses or adequacy decisions, to protect your information in accordance with POPIA.

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child without parental consent, we will take steps to delete it.

When you submit a purchase order for funding through the platform, a cession of payment rights is perfected at Gate 3 of the 7-Gate verification framework. This cession is irrevocable once acknowledged by the buyer and forms the security basis on which funding is advanced.

• The cession gives New Smartfin and its funding partners a first claim over the buyer's proceeds for the ceded purchase order
• The platform may take such legal and preservation steps as are necessary to protect, give effect to, and enforce the cession against any redirection, interference, or tampering with the ceded proceeds
• Misrepresentation, fraud, or any attempt to redirect, front-run, or interfere with ceded proceeds constitutes a material breach of the platform terms and may result in immediate termination, clawback of disbursed funds, and civil or criminal proceedings
• By using the platform, you acknowledge that the cession and the platform's enforcement rights survive any attempted cancellation or redirection of the underlying purchase order

These provisions are given effect in our Terms of Use and form part of the contractual framework binding on every supplier who submits a purchase order for funding.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

• Posting the updated policy on our platform
• Sending an email notification
• Displaying a notice on our website

Your continued use of the platform after changes constitutes acceptance of the updated policy.