Privacy Notice

Version: 1.2

Effective Date: 2026-06-09

1. Introduction

This Privacy Notice explains how Kwik Payments (Pty) Ltd (registration number 2024/631811/07) ("Kwik", "we", "our", or "us") collects, uses, stores, shares and protects Personal Information when providing our products and services, in accordance with the Protection of Personal Information Act, 2013 ("POPIA") and, where applicable, the General Data Protection Regulation ("GDPR").

This Privacy Notice applies to:

• Merchants;
• Merchant employees and authorised users;
• Customers making payments through the Services;
• Visitors to our websites;
• API users;
• Mobile application users;
• Prospective customers;
• Business partners; and
• Any other person whose Personal Information is processed by Kwik.

Where Kwik processes Personal Information on behalf of a Merchant, Kwik generally acts as an Operator under POPIA, or a Processor under the GDPR, where applicable. Where Kwik determines the purpose and means of processing for its own compliance, risk or operational obligations, Kwik acts as a Responsible Party under POPIA, or a Controller under the GDPR. This distinction is set out in full in our Data Processing Addendum.

2. Scope

This Privacy Notice applies to all products and services provided by Kwik, including:

• Merchant Dashboard;
• Payment Gateway;
• Payment Links;
• Hosted Checkout;
• Embedded Checkout;
• APIs;
• SDKs;
• Card Payments;
• Alternative Payment Methods;
• Payout Services;
• Mobile applications;
• Websites; and
• Related services.

3. Personal Information We Collect

Depending on the Services used, Kwik may collect:

Merchant Information

• Business name;
• Registration number;
• VAT number;
• Directors;
• Beneficial owners;
• Contact details;
• Banking information;
• Verification documentation;
• Financial information;
• Transaction history;
• Compliance documentation.

Customer Information

When a Customer makes a payment, we may process:

• Name;
• Email address;
• Mobile number;
• Billing address;
• Shipping address;
• Payment token;
• Payment method information;
• Transaction amount;
• Currency;
• Merchant reference;
• Transaction identifiers;
• IP address;
• Device information;
• Fraud indicators.

Kwik does not intentionally store sensitive card authentication data such as CVV/CVC after authorisation.

Technical Information

We may automatically collect:

• Browser type;
• Device type;
• Operating system;
• IP address;
• API request metadata;
• Cookies;
• Session identifiers;
• Error logs;
• Security logs;
• Audit logs; and
• Diagnostic information.

Special Personal Information

In limited circumstances, and only to the extent reasonably necessary, Kwik may process Special Personal Information as defined in section 26 of POPIA (such as information relating to criminal behaviour) for the purposes of:

• sanctions screening;
• anti-money laundering and counter-terrorist financing compliance;
• fraud prevention and investigation; and
• regulatory reporting.

Such processing is carried out in compliance with the conditions set out in section 27 of POPIA, including where the processing is necessary for the establishment, exercise or defence of a right or obligation in law, or to comply with an obligation of international public law.

4. How We Collect Information

Personal Information may be collected:

• directly from you;
• during Merchant onboarding;
• when using the Services;
• from payment transactions;
• from financial institutions;
• from payment partners;
• from verification providers;
• from sanctions screening providers;
• from fraud prevention providers;
• from publicly available sources where permitted by law; and
• from third parties authorised to share such information.

Where Personal Information is collected directly from a data subject, Kwik will, where reasonably required by section 18 of POPIA, take reasonably practicable steps to ensure the data subject is aware of the information being collected, the purpose of collection, whether the supply is voluntary or mandatory, the consequences of failure to provide the information, and the data subject's rights described in section 11 of this Notice.

5. Why We Process Personal Information

Kwik processes Personal Information for purposes including:

• providing the Services;
• processing payments;
• processing payouts;
• onboarding Merchants;
• identity verification;
• fraud prevention;
• sanctions screening;
• anti-money laundering compliance;
• transaction monitoring;
• customer support;
• regulatory reporting;
• risk management;
• security monitoring;
• improving the Services;
• developing new products;
• complying with Applicable Law;
• protecting Kwik's legal rights; and
• exercising rights under our agreements.

6. Lawful Processing Conditions

Kwik processes Personal Information in accordance with the conditions for lawful processing set out in Chapter 3 of POPIA, namely accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards, and data subject participation.

Where required by Applicable Law, Kwik processes Personal Information on one or more of the following grounds:

• performance of a contract to which the data subject is party, or to take steps prior to entering into a contract;
• compliance with a legal obligation to which Kwik is subject;
• protection of a legitimate interest of Kwik or a third party;
• consent given by the data subject, where consent is the applicable basis;
• establishment, exercise or defence of a right or obligation in law; or
• another lawful basis recognised by Applicable Law, including the GDPR where applicable.

7. Direct Marketing

Where Kwik wishes to send direct marketing communications by electronic means to a data subject who is a natural person, Kwik will only do so with the data subject's prior consent (opt-in), in accordance with section 69 of POPIA, unless the data subject is an existing customer and the communication relates to similar products or services, in which case Kwik may rely on the exemption in section 69(3) of POPIA. Data subjects may opt out of direct marketing at any time, free of charge, using the unsubscribe mechanism provided or by contacting the Privacy Officer.

8. Sharing Personal Information

Kwik may share Personal Information with:

• acquiring banks;
• sponsoring banks;
• payment schemes;
• payment partners;
• financial institutions;
• fraud prevention providers;
• identity verification providers;
• sanctions screening providers;
• cloud infrastructure providers;
• regulators;
• government authorities;
• auditors;
• professional advisers;
• insurers; and
• other service providers engaged to support the Services.

Kwik does not sell Personal Information.

9. International Transfers

Kwik processes and stores Personal Information both within the Republic of South Africa and, for certain categories of Personal Information and certain Services, in other jurisdictions, using infrastructure and service providers reasonably necessary to provide the Services. Where this relates to Card Payments, the jurisdictions and arrangements involved are disclosed to, and conducted in accordance with arrangements agreed with, Kwik's applicable acquiring and sponsoring banks.

In accordance with section 72 of POPIA, Kwik will only transfer Personal Information to a recipient in a foreign country where:

• the recipient is subject to a law, binding corporate rules or binding agreement that provides an adequate level of protection substantially similar to the conditions for lawful processing of Personal Information set out in POPIA, and that effectively upholds principles for reasonable processing substantially similar to POPIA;
• the data subject consents to the transfer;
• the transfer is necessary for the performance of a contract between the data subject and Kwik, or for the implementation of pre-contractual measures taken in response to the data subject's request;
• the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between Kwik and a third party; or
• the transfer is otherwise permitted under POPIA or another Applicable Law.

10. Information Security

Kwik maintains technical and organisational security measures designed to protect Personal Information against:

• unauthorised access;
• accidental disclosure;
• unlawful processing;
• alteration;
• destruction; and
• loss.

These measures may include:

• encryption;
• tokenisation;
• access controls;
• audit logging;
• network security;
• vulnerability management;
• multi-factor authentication;
• continuous monitoring; and
• incident response procedures.

No security measure can guarantee absolute security.

Where Kwik has reasonable grounds to believe that the Personal Information of a data subject has been accessed or acquired by an unauthorised person, Kwik will notify the Information Regulator and, where required by section 22 of POPIA, the affected data subject(s), as soon as reasonably possible after the discovery of the breach, having regard to the legitimate needs of law enforcement or any measures reasonably necessary to determine the scope of the breach and restore the integrity of Kwik's systems.

11. Data Retention

Kwik retains Personal Information only for as long as necessary to:

• provide the Services;
• comply with Applicable Law, including record-keeping obligations under FICA;
• resolve disputes;
• detect fraud;
• satisfy regulatory obligations;
• enforce our agreements; or
• protect our legal rights.

Retention periods may differ depending on the type of information and applicable legal requirements. Where Personal Information is no longer required for these purposes, Kwik will take reasonable steps to delete or de-identify it, in accordance with section 14 of POPIA.

12. Your Rights

Subject to Applicable Law, and in accordance with sections 23 to 25 of POPIA, individuals may have the right to:

• request confirmation, free of charge, of whether Kwik holds Personal Information about them;
• request access to their Personal Information, on payment of a prescribed fee where applicable;
• request correction or deletion of inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained Personal Information;
• object, on reasonable grounds, to the processing of their Personal Information;
• object to the processing of their Personal Information for purposes of direct marketing;
• not be subject, in certain circumstances, to a decision based solely on automated processing which affects them to a substantial degree, without an opportunity to make representations;
• withdraw consent where processing is based on consent;
• lodge a complaint with the Information Regulator; and
• exercise any other rights available under Applicable Law.

Certain requests may be refused or limited where Kwik is legally required to retain or continue processing the information, including for compliance with FICA, sanctions, tax or other regulatory obligations.

Requests may be directed to the Privacy Officer using the contact details in section 16 below.

13. Cookies

Kwik may use cookies and similar technologies to:

• authenticate users;
• maintain sessions;
• improve security;
• analyse website usage;
• remember preferences; and
• improve the user experience.

Additional information regarding cookies may be published separately.

14. Children's Information

The Services are not intended for individuals under the age of eighteen (18).

Kwik does not knowingly collect Personal Information directly from children, except where permitted by section 35 of POPIA (for example, where processing is carried out with the prior consent of a competent person, or is necessary for the establishment, exercise or defence of a right or obligation in law).

15. Changes to this Privacy Notice

Kwik may amend this Privacy Notice from time to time.

The latest version will always be published at: https://help.kwik.co.za/legal/privacy-notice

Continued use of the Services after an updated Privacy Notice becomes effective constitutes acceptance of the revised version where permitted by Applicable Law.

16. Contact Us

Questions regarding this Privacy Notice, or requests to exercise your rights, may be directed to:

Information Officer / Privacy Officer

Email: privacy@kwik.co.za

Website: https://kwik.co.za

Kwik's Information Officer is registered with the Information Regulator in accordance with section 55 of POPIA.

17. Information Regulator

If you are not satisfied with how Kwik has handled your Personal Information, or wish to lodge a complaint, you may contact the South African Information Regulator:

The Information Regulator (South Africa)

Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

P.O. Box: P.O. Box 31533, Braamfontein, Johannesburg, 2017

Email: complaints.IR@justice.gov.za / inforeg@justice.gov.za

Website: https://www.justice.gov.za/inforeg/