Privacy Policy

1. Purpose and scope

This Privacy Policy explains how Universal Credit Application (Pty) Ltd trading as UCAP (“UCAP”, “we”, “us” or “our”) collects, uses, stores, shares, protects and deletes personal information when you use UCAP’s websites, applications, profile, document vault, verification services, sharing tools, partner journeys and related services.

UCAP is intended to be accessible internationally. This Policy is designed around South African data protection requirements, including the Protection of Personal Information Act 4 of 2013 (“POPIA”), and applies additional protections required by other data protection laws where those laws apply to UCAP’s activities. This statement is not a representation that UCAP is automatically compliant with every law in every country.

This Policy should be read with the UCAP Terms of Use and any additional notice shown for a particular active feature.

2. Who is responsible for your information?

UCAP is operated by Universal Credit Application (Pty) Ltd trading as UCAP. UCAP determines the purposes and essential means of processing information for operating the UCAP profile, identity and document-management features, account security, consent records, platform analytics and support.

The legal role UCAP or another organisation has depends on the particular processing activity. UCAP may act as a responsible party/controller for some activities and as an operator/processor for others. A partner may independently determine how it uses information it receives. We do not assume that one label applies to every activity.

Contact: privacy@ucap.africa. General enquiries: hello@ucap.africa. Security reports: security@ucap.africa.

3. Information we collect

Depending on how you use UCAP, we may collect:

• Account and identity information: name, email address, mobile number, date of birth, identity-document type and number, issuing country, verification status and account identifiers.
• Profile information: residential and postal addresses, employment, occupation, income sources, expenses, banking fields and other information you choose to provide.
• Documents and content: uploaded files, file names, folder labels, descriptions and document metadata. Documents may contain sensitive information even where UCAP has not specifically requested it.
• Verification information: verification provider, request and transaction identifiers, result codes, status, timestamps, and the minimum information needed to match a verification result to your profile. The verification provider may collect identity-document images and a live selfie directly from your device.
• Sharing and consent information: selected fields, recipient details, stated purpose, duration, consent version, grant status, expiry, revocation and access receipts.
• Application and transaction information: journey answers, selected products, application progress, partner referrals, status and outcomes you choose to share.
• Billing and subscription information: plan, payment references, subscription status and related records. Payment card details should be handled by the relevant payment provider where supported.
• Communications: support requests, feedback, service messages, notification preferences and communications metadata.
• Technical and usage information: log-in events, device and browser information, security events, page paths, referral parameters, interaction events, and error or diagnostic records.
• Information from other sources: verification providers, payment providers, partners and authorised representatives, where permitted and necessary for the relevant service.

Please do not upload another person’s personal information unless you are authorised to do so. Do not upload highly sensitive documents unless they are relevant to a purpose you understand and are comfortable with.

4. Why we use information

We use personal information for purposes that include:

• creating and maintaining your UCAP account and profile;
• storing, organising and making your documents available to you;
• authenticating you, protecting accounts and preventing fraud or misuse;
• verifying identity or validating selected information when you request it or a service requires it;
• calculating profile readiness and matching you with relevant journeys or offers;
• facilitating applications and transmitting information to recipients you select;
• recording, enforcing and evidencing your sharing choices and consent;
• administering subscriptions, payments, support and service communications;
• operating, troubleshooting, securing and improving UCAP;
• measuring platform usage through proportionate analytics and honouring your privacy preferences;
• complying with legal obligations, responding to lawful requests and establishing or defending legal claims; and
• sending marketing communications only where permitted and, where required, with your consent.

We will not use your personal information for a materially different purpose without a lawful basis and any notice, consent or other step required by law.

5. Lawful grounds and consent

Where POPIA or another applicable law requires a lawful justification, UCAP will identify and rely on an appropriate basis for the relevant processing. Depending on the activity, this may include performance of a contract or steps requested before a contract, compliance with a legal obligation, legitimate interests assessed against your rights, consent, or another basis recognised by applicable law.

Consent is not a universal basis for every processing activity. Where we rely on consent, we will explain the relevant choice, record it where appropriate, and provide a way to withdraw it. Withdrawal does not make prior lawful processing unlawful and may mean that a feature or transaction can no longer be provided. We will not treat acceptance of general Terms as blanket consent for every optional processing activity.

6. Sensitive and special personal information

Identity numbers, financial information, identity-verification outcomes, biometric-related information processed by a provider, and information contained in uploaded documents may be sensitive or subject to additional legal safeguards. We will limit access and use to defined purposes, apply appropriate security controls, and obtain consent or satisfy another legal condition where required. If a document contains health, religious, children’s or other specially protected information, additional rules may apply.

7. Profile storage and security

UCAP uses technical and organisational measures intended to protect information, including access controls, authentication safeguards, private storage, encryption in transit and at rest provided by infrastructure services, and field-level encryption for selected identifiers. These measures do not mean every field is encrypted at application level, that UCAP has no access to information, or that any system is immune from attack.

Access to personal information is limited according to role and operational need. We review access and security controls and investigate suspected misuse. You should use a strong unique password, protect your devices and authentication factors, and report suspected account compromise promptly to security@ucap.africa.

8. Sharing information

We share information only as described in this Policy, under your choices, where necessary to provide a service, or where otherwise permitted or required by law. This may include:

• recipients you expressly choose through a UCAP sharing flow;
• a partner to whom you direct an application or service request;
• identity-verification and validation providers;
• hosting, storage, authentication, communications, analytics, payment and support providers;
• professional advisers, auditors and insurers under appropriate confidentiality obligations;
• regulators, courts, law-enforcement bodies or other recipients where legally required or necessary to protect rights and safety; and
• a successor or buyer in a corporate transaction, subject to appropriate safeguards and applicable law.

Where you share a profile, the sharing interface should identify the recipient, purpose, fields, duration and relevant risks before you confirm. UCAP’s intended standard is granular, purpose-specific, time-limited sharing, with a record of the choice and a way to revoke future access. Some sharing features may not be available until implementation is complete; do not rely on a feature until it appears in your account and its terms are displayed.

Revocation ends future access through UCAP to the extent supported by the relevant sharing mechanism. It cannot retrieve copies a recipient has already downloaded, recorded, printed or otherwise retained, and it cannot control independent processing the recipient lawfully or unlawfully undertakes. We require partners to use received information only for agreed and lawful purposes through contracts and partner controls.

9. Identity verification

Where you request identity verification, UCAP may use an external provider. The provider may collect images of an identity document and a live selfie directly from your browser or device and process them to assess identity. UCAP may receive a verification result, status, reference, timestamp and limited matching information, rather than receiving the original images or biometric template. The exact data, processing locations and retention depend on the provider's configuration and terms. Contact privacy@ucap.africa for the information we hold about the provider's processing.

Verification is not a guarantee that every profile field is correct, that a document is genuine for every purpose, or that a partner will accept you. You may be unable to use a service that requires verification if you decline the relevant processing.

10. Partners and independent decisions

UCAP can help you prepare and share information or submit a request, but third-party providers remain responsible for their own products, services, eligibility criteria and decisions. A partner may become independently responsible for information it receives and may provide a separate privacy notice. Review the partner’s notice and terms before submitting an application. UCAP does not guarantee approval, pricing, acceptance, a financial outcome or the accuracy of information supplied by a third party.

11. AI, recommendations and automated processing

UCAP may use rule-based logic to assess profile readiness, organise information, surface relevant journeys and match offers. These outputs are aids to navigation and do not themselves constitute a lender’s, insurer’s or other partner’s approval decision.

UCAP may introduce an AI-assisted concierge such as Hugh. If an external AI provider is enabled, UCAP will disclose the provider, data sent, purpose, location and applicable controls before or when the feature is used, and will not use customer information to train general-purpose AI models. Optional external AI processing is intended to remain disabled until a provider and configuration have been selected and reviewed. Do not assume an AI feature is available or active unless it is presented in the product with the relevant notice.

Where required by applicable law, we will provide information about significant automated decisions, the logic or factors involved at an appropriate level, and available ways to request review or contest the outcome.

12. Cookies, local storage and analytics

UCAP uses necessary browser storage and session mechanisms to operate and secure the service. It may also use first-party analytics identifiers and events to understand visits, page paths, referrals, device/browser characteristics and interactions. We aim to minimise collection, avoid storing raw IP addresses in application analytics where possible, honour Do Not Track where technically supported. Infrastructure or security logs may still process network identifiers where necessary for security and operations.

You can enable Do Not Track in a browser that supports it, and can clear UCAP site data using your browser settings. Clearing site data may sign you out and remove saved preferences. Where applicable law requires prior consent for non-essential technologies, UCAP will implement the required consent mechanism before deploying them to the relevant users.

13. Marketing and service communications

We may send messages needed to operate your account, verify access, respond to requests, notify you of sharing activity, provide security alerts and communicate material service changes. These are service communications and may not be optional while your account is active.

Promotional messages are different. We will obtain consent or rely on another legally valid permission where available, identify UCAP as the sender, provide an accessible unsubscribe or opt-out method, and maintain a suppression record so an opted-out person is not inadvertently re-added. Withdrawing marketing consent does not prevent essential service communications.

14. International transfers and service providers

UCAP is hosted primarily in Google Cloud infrastructure intended to be located in Johannesburg, South Africa, while some supporting providers or services may process information in other countries.

Where personal information is transferred or made accessible across borders, UCAP will implement the safeguards required by applicable law, which may include an adequacy determination, binding contractual protections, consent where legally appropriate, or another recognised transfer mechanism. We will identify material recipients and transfer purposes in our provider register and update this Policy when material changes occur. Our current material service providers are:

15. Retention and deletion

We retain personal information only for as long as reasonably necessary for the stated purpose, to provide the service, comply with legal obligations, resolve disputes, maintain security and establish or defend legal claims. Specific periods depend on the data category and applicable law.

When information is no longer required, UCAP will delete it, anonymise it or securely dispose of it, subject to lawful retention exceptions. Deletion from the active system may not immediately remove information from backups, historical object versions, security logs or records that must be retained. Such residual copies should be access-restricted and expire under a defined schedule. You can ask us to close your account or erase your information by emailing privacy@ucap.africa. Account closure is currently handled manually, and automated deletion is not yet available.

16. Your rights and choices

Subject to applicable law and any lawful exceptions, you may be entitled to request access to, correction of, deletion of, or information about the processing of your personal information; object to certain processing; withdraw consent; request restriction or portability where applicable; and complain to the relevant regulator. POPIA provides rights and procedures that may apply to you, including access and correction rights.

Submit a request to privacy@ucap.africa with the account email, the request type and enough information to verify your identity. Do not send an identity document unless we request it through a secure method. We will verify the requester proportionately, acknowledge the request, assess it under applicable law, respond within the applicable deadline or explain a lawful extension, and maintain a record. We may refuse or limit a request where law permits, explaining the reason and available complaint route.

17. Children and capacity

UCAP is intended for people who are legally capable of entering into a binding contract and is not designed for children to create independent accounts. If a service has a higher age or eligibility requirement, that requirement will apply. If you believe a child’s information has been collected improperly, contact privacy@ucap.africa.

18. Breaches and complaints

If UCAP becomes aware of a security compromise involving personal information, it will assess and respond under its incident-response procedure, contain the incident, investigate, preserve evidence, remediate and notify affected people and regulators where required by law. For a privacy concern, contact privacy@ucap.africa. For a security vulnerability, contact security@ucap.africa. You may also have the right to complain to the Information Regulator in South Africa or another competent authority, depending on the applicable law.

19. Changes

We may update this Policy to reflect changes in law, services, technology or processing. For material changes, we will provide notice through appropriate channels and obtain fresh consent where required. The updated version will show its effective date. We will not use a policy update as a substitute for consent where consent is legally required.

20. Contact details

Company

Universal Credit Application (Pty) Ltd trading as UCAP

Registration number

2025/946424/07

Information Officer

Katekani Baloyi

Privacy requests

privacy@ucap.africa

General enquiries

hello@ucap.africa

Security reports

security@ucap.africa