PRIVACY POLICY
Effective Date: 2026/09/01
Last Updated: 2026/08/28
Version: 1.002
1. Introduction
FICA sure respects the privacy and security of Personal Information.
FICA sure is a developing compliance, identity-verification and screening service operating under the FICA sure brand.
Until a separate legal entity is incorporated, references in this Privacy Policy to “FICA sure”, “we”, “us” or “our” refer to the operators of the FICA sure service.
This Privacy Policy explains how Personal Information is collected, received, used, stored, processed, shared, protected and retained through FICA sure.
It applies to Personal Information processed through the FICA sure:
- website;
- client portal;
- administration platform;
- APIs;
- verification services;
- FICA/KYC services;
- document-processing services;
- AML, PEP and sanctions-screening services;
- test and live environments;
- integrations;
- account and billing systems; and
- related services.
FICA sure processes Personal Information in accordance with applicable South African law, including the Protection of Personal Information Act 4 of 2013 (“POPIA”).
This Privacy Policy should be read with the FICA sure Terms and Conditions, Acceptable Use and API Usage Terms, and any applicable Data Processing or other written agreement.
2. Definitions
Client means a person, business, professional, organisation, institution, merchant or other party using FICA sure.
Data Subject means the person to whom Personal Information relates.
Personal Information has the meaning assigned to it under POPIA.
Processing includes collecting, receiving, recording, organising, storing, updating, retrieving, consulting, using, transmitting, distributing, merging, restricting, deleting, destroying or otherwise handling Personal Information.
Responsible Party means the person who determines the purpose of and means for processing Personal Information.
Operator means a person who processes Personal Information for a Responsible Party in terms of a contract or mandate without coming under the direct authority of that Responsible Party.
Verification Subject means an individual or entity whose information is submitted to FICA sure for verification, screening or compliance purposes.
3. Our role under POPIA
FICA sure may act in different capacities depending on the circumstances.
Where FICA sure collects information for its own operational purposes, such as account administration, billing, security, support, fraud prevention, system logging and legal compliance, FICA sure may act as a Responsible Party.
Where a Client submits information relating to its customer, applicant, merchant, director, shareholder, beneficial owner or other person for verification or screening, the Client will ordinarily act as the Responsible Party and FICA sure will ordinarily process the information as an Operator.
The Client remains responsible for determining whether it has a lawful basis to collect and submit Personal Information to FICA sure.
4. Personal Information we may process
Depending on the verification or application type, FICA sure may process information including:
Identity information
Full name, previous names, aliases, initials, South African identity number, foreign identity number, passport number, passport country, passport expiry date, date of birth, nationality, citizenship, country of birth and other relevant identity information.
Contact and address information
Mobile number, telephone numbers, email address, residential address, street address, suburb, city or town, province, postal code, country, postal address, business address and trading address.
Employment and financial information
Occupation, employer, employment information, source of funds, source of wealth, financial circumstances, business activities and other information reasonably required for compliance verification.
Business and legal-entity information
Business name, trading name, registration number, date of registration, business type, nature of business, VAT information, financial year-end, contact person, countries of operation, country of incorporation, country of effective management, website, merchant information and related information.
Associated persons
Information regarding directors, members, shareholders, partners, trustees, founders, beneficiaries, executors, authorised persons, controlling persons, associated persons and beneficial owners.
Banking information
Bank name, account-holder name, bank-account number, branch information, bank-account verification information and supporting documentation where applicable.
FICA sure does not require online-banking passwords, PINs or similar credentials for ordinary FICA verification. Clients must not submit such credentials unless a specific secure service expressly requires them.
5. Documents we may process
FICA sure may process documents including identity documents, passports, proof of address, municipal or utility accounts, bank statements, lease agreements, selfies or photographs, company-registration documents, proof of business address, bank-account proof, partnership agreements, beneficial-ownership documents, authority resolutions, trust deeds, letters of authority, letters of executorship, founding documents, merchant agreements and supporting documentation.
Where the relevant API or service supports multiple files for a document category, multiple files may be submitted.
6. Photographs and biometric information
FICA sure may process selfies, facial photographs and identity-document photographs for identity-verification purposes.
Where such Processing constitutes biometric or Special Personal Information under applicable law, appropriate safeguards and lawful-processing requirements will apply.
Images may be used to compare a person with an identity document, assess document or image quality, identify inconsistencies, detect possible manipulation or support human review.
FICA sure does not use verification photographs for unrelated advertising or marketing.
7. How information is collected
Information may be obtained:
directly from a Data Subject;
from a FICA sure Client;
through an API or integrated onboarding system;
from uploaded documents;
through automated or AI-assisted document extraction;
from government, regulatory or public information sources;
from sanctions, PEP and AML sources;
from commercial verification and screening providers; and
from other lawful third-party data sources.
8. Purposes of Processing
Personal Information may be processed for purposes including identity verification, FICA compliance, KYC, customer due diligence, enhanced due diligence, AML screening, terrorist-financing controls, sanctions screening, PEP screening, fraud prevention, document verification, risk assessment, legal-entity verification, beneficial-ownership checks, inconsistency detection, compliance reporting, API result generation, account administration, billing, security, troubleshooting, legal compliance and protection against unlawful activity.
9. Lawful basis
FICA sure processes Personal Information only where an appropriate lawful basis exists.
Depending on the circumstances, Processing may be necessary because:
the Data Subject has consented;
Processing is required for the performance of a contract;
Processing is required by law;
Processing protects a legitimate interest of the Data Subject;
Processing is necessary to perform a public-law duty; or
Processing is necessary to pursue a legitimate interest permitted by law.
Where a Client supplies the information, the Client is responsible for establishing the lawful basis for doing so.
10. Client responsibilities
Clients must ensure that Personal Information supplied to FICA sure is lawfully collected and processed.
Clients must provide appropriate privacy notices, obtain consent where legally required, submit only information necessary for legitimate purposes, and use verification results lawfully.
FICA sure may not be used merely to investigate individuals out of curiosity.
11. PEP information
A PEP result does not mean that a person has committed wrongdoing or is automatically prohibited from becoming a customer.
PEP information is intended to assist Clients in identifying circumstances that may require further risk assessment, enhanced due diligence, additional approval or ongoing monitoring.
12. Sanctions information
A sanctions result may have more serious legal consequences.
A potential match must nevertheless be appropriately verified to determine whether the Verification Subject is actually the listed individual or entity and which sanctions regime applies.
13. Automated and AI-assisted Processing
FICA sure may use automated technology and artificial intelligence for document reading, information extraction, classification, comparison, inconsistency detection, document-quality assessment, manipulation detection, screening, risk indicators, profile consolidation and compliance workflow support.
Automated systems can make mistakes.
A confidence score, match or automated result is not a guarantee of accuracy.
Appropriate human review should be performed where required by law or reasonably appropriate to the risk involved.
14. Automated outcomes
FICA sure may produce statuses including:
clear, matched, possible match, outstanding, mismatch, needs information, review required, identity verified, FICA complete, FICA incomplete, hold, do not allow yet, or equivalent statuses.
These outputs support the Client’s compliance process. Unless expressly agreed otherwise, the Client remains responsible for the final onboarding, compliance and risk decision.
15. Accuracy and inconsistencies
FICA sure may identify discrepancies between submitted information, documents, extracted information and external sources.
A mismatch does not automatically prove fraud or dishonesty.
Differences may result from spelling variations, transliteration, outdated records, typing errors, incomplete records, common names or errors in source data.
16. Service Providers and Sub-processors
FICA sure may use authorised third-party Service Providers and Sub-processors to assist with infrastructure, hosting, artificial intelligence, document processing, identity verification, PEP screening, sanctions screening, AML screening, cybersecurity, communications, analytics, payment processing, backup and technical operations.
FICA sure may change Service Providers where reasonably required to operate or improve the Service.
Only information reasonably necessary to provide the relevant service should be supplied to such providers.
Where appropriate, material providers may be identified separately in a Sub-processor Notice.
17. Cross-border Processing
Some Service Providers or screening sources may operate outside South Africa.
Personal Information may therefore be processed outside South Africa where necessary to provide the Service.
FICA sure will take reasonable steps to apply appropriate contractual, confidentiality, security and data-protection safeguards where cross-border Processing occurs.
18. We do not sell Personal Information
FICA sure does not sell Verification Subjects’ Personal Information to advertisers or data brokers.
Verification information is not collected for the purpose of constructing advertising profiles.
19. Disclosure of information
Personal Information may be disclosed to authorised Clients, authorised Client users, Service Providers, regulators, courts, law-enforcement authorities or other parties where disclosure is lawfully required or reasonably necessary for the provision or protection of the Service.
Information may also be disclosed where necessary to establish or defend legal rights or in connection with a lawful restructuring or transfer of the FICA sure service.
20. Data minimisation
FICA sure seeks to process only information reasonably necessary for the requested verification.
Clients should not submit unrelated Personal Information.
21. Retention
Personal Information will be retained only for as long as there is an appropriate legal, contractual, regulatory, security, operational or compliance reason to retain it.
Retention may depend on:
the nature of the information;
Client instructions;
applicable FICA or other recordkeeping obligations;
contractual requirements;
security requirements;
fraud-prevention requirements;
audit requirements;
disputes;
backup cycles; and
other applicable legal obligations.
When information is no longer lawfully required, it may be deleted, securely destroyed or de-identified.
Deletion from active systems may not immediately remove information from protected backups. Backup copies may remain until removed through normal backup-rotation processes.
22. Security
FICA sure implements reasonable technical and organisational safeguards appropriate to the information processed.
These may include encrypted communications, authentication, access controls, server-side API credentials, separate test and production credentials, restricted administrative access, logging, monitoring, backups, security updates and least-privilege controls.
No electronic system can guarantee absolute security.
23. API security
Clients are responsible for protecting API credentials.
API keys must not be unnecessarily exposed in public websites, client-side code, screenshots, public repositories or unsecured logs.
Where a key is believed to have been compromised, FICA sure may revoke or rotate it.
24. Test environment
FICA sure may provide a separate test or sandbox environment.
The test environment may use fictional people, synthetic documents, simulated PEP results, simulated sanctions results or other non-production information.
Clients should avoid submitting real Personal Information into a test environment unless reasonably necessary and appropriately protected.
25. Security incidents
If FICA sure becomes aware of unauthorised access to Personal Information, reasonable steps will be taken to investigate, contain and remediate the incident.
Where FICA sure acts as Operator, the relevant Responsible Party will be informed where required so that applicable POPIA obligations can be fulfilled.
26. Data Subject rights
Subject to applicable law, a Data Subject may have rights to:
request confirmation that information is held;
request access;
request correction;
request deletion or destruction where legally permitted;
object to certain Processing;
withdraw consent where consent is the applicable lawful basis;
request information about the source of information where appropriate; and
lodge a complaint.
27. Where information was submitted by a Client
If your information was submitted to FICA sure by another organisation, that organisation may be the Responsible Party.
Questions about why the information was collected, whether you should have been screened, whether your application should be approved or whether information should be deleted may therefore need to be directed to that organisation.
FICA sure will reasonably assist the Responsible Party where required.
28. Correction of external screening information
Some information returned through FICA sure may originate from government, regulatory, public or commercial databases.
FICA sure may not control or have authority to alter the original source.
If a Data Subject disputes a result, FICA sure may investigate whether the correct person was matched, correct information maintained directly by FICA sure, record the dispute or direct the person to the originating source where appropriate.
29. False positives and false negatives
Screening services can produce false positives and false negatives.
A possible PEP or sanctions match does not establish that the Verification Subject is necessarily the listed person.
Likewise, a clear result does not guarantee that a person is absent from every relevant database or presents no compliance risk.
30. Children’s information
Where information concerning a child is processed, the Client must ensure that the Processing is lawful and that any required parental, guardian, statutory or other authority exists.
FICA sure must not knowingly be used to unlawfully profile or investigate children.
31. Technical information
FICA sure systems may process IP addresses, browser details, operating-system information, session identifiers, timestamps, API activity, error logs, authentication events and security events.
This information may be used for operation, cybersecurity, debugging, fraud prevention, audit trails and performance monitoring.
32. Cookies
The FICA sure website may use cookies or similar technologies necessary for security, authentication, account functionality and preferences.
If optional analytics or advertising technologies are introduced, appropriate notice and consent mechanisms should be implemented where required.
33. Payment information
Where Clients purchase Services through an external payment provider, payment information may be processed by that provider.
FICA sure should not store complete payment-card numbers, CVV values, online-banking passwords or similar credentials unless specifically required by an appropriately secured payment function.
34. Marketing
Operational communications relating to security, accounts, verification cases, APIs, billing, maintenance or legal matters are not marketing communications.
Marketing will be conducted only where permitted by applicable law.
Recipients may opt out of non-essential marketing.
35. Internal access
Personal Information should only be accessible to authorised persons who reasonably require it for providing the Service, support, compliance, security, authorised review, technical troubleshooting or legal obligations.
36. Product improvement
FICA sure may use technical and appropriately de-identified information to improve reliability, workflow, security, document processing and false-positive reduction.
Identifiable customer documents should not be used to train unrelated general-purpose AI models unless an appropriate lawful basis and contractual safeguards exist.
37. Changes to this Privacy Policy
FICA sure may amend this Privacy Policy to reflect changes in law, technology, Services, Processing activities, APIs, security arrangements or Service Providers.
The current version will display its effective date and version number.
38. Information Officer and privacy requests
Information Officer: Benjan Petterson
Trading name: FICA sure
Website: ficasure.com
Privacy enquiries: enquiries@ficasure.com
General enquiries: enquiries@ficasure.com
Security reports: help@ficasure.com
A person submitting a privacy request may be asked for sufficient information to confirm identity and prevent unauthorised disclosure of Personal Information.
Data Subjects may also lodge complaints with the South African Information Regulator where applicable.
FICA sure
TERMS AND CONDITIONS
Effective Date: [DATE]
Version: 1.0
1. FICA sure
FICA sure is a developing compliance, verification and screening service operating under the FICA sure brand.
FICA sure is not currently incorporated as a separate company.
Until a separate legal entity is established, references to “FICA sure”, “we”, “us” or “our” mean the operator of the FICA sure service.
The FICA sure service is presently operated by Benjan Petterson.
These Terms govern access to FICA sure’s website, platform, APIs, verification services, screening services, reports and related functionality.
2. Acceptance
By creating an account, using an API key, submitting information, requesting a verification, purchasing credits or otherwise using FICA sure, you agree to these Terms.
If you use FICA sure for an organisation, you confirm that you have authority to act on behalf of that organisation.
3. Services
FICA sure may provide technology to assist with FICA, KYC, customer due diligence, AML screening, PEP screening, sanctions screening, identity verification, document analysis, business verification, beneficial-ownership verification, risk indicators, ongoing monitoring and related compliance processes.
Available functionality may depend on the Client’s account, package, API configuration and environment.
4. FICA sure is an assistance tool
FICA sure assists Clients with compliance processes.
It is not a law firm, regulator, compliance officer or government authority and does not provide legal advice.
Using FICA sure does not automatically establish compliance with FICA, POPIA or another law.
The Client remains responsible for its legal and compliance obligations and for final decisions concerning its customers.
5. Screening results
Screening results are informational and risk-management tools.
A clear result does not guarantee that a person or entity presents no risk.
A possible match does not establish that the Verification Subject is necessarily the listed person.
Clients should use appropriate identifiers and human review before making material decisions.
6. PEP results
Being identified as a politically exposed person does not automatically mean that the person has committed wrongdoing or that the Client is prohibited from doing business with that person.
The result may require enhanced due diligence or additional risk management.
7. Sanctions results
A sanctions match may involve legal restrictions.
Clients remain responsible for determining:
whether the match is genuine;
which sanctions regime applies;
whether the relationship or transaction is legally prohibited;
whether funds must be frozen;
whether reporting is required; and
whether professional advice is necessary.
8. Data sources
FICA sure may use public records, government information, regulatory information, international lists, commercial databases, screening providers, identity-verification providers, artificial-intelligence services and other lawful information sources.
FICA sure may change or replace its suppliers and data sources.
Third-party information may be incomplete, inaccurate, outdated or unavailable.
9. Lawful Processing
Clients warrant that they have lawful authority to submit Personal Information to FICA sure.
Where notice, consent or another lawful basis is required, the Client is responsible for establishing it.
10. POPIA roles
Where FICA sure processes information supplied by a Client purely to provide verification services, the Client will ordinarily act as Responsible Party and FICA sure will ordinarily act as Operator.
FICA sure may act as Responsible Party for information processed for its own account administration, billing, security, fraud prevention, legal compliance and other legitimate operational purposes.
11. Client information
Clients must not deliberately submit false, misleading, stolen or unlawfully obtained information except where clearly permitted synthetic data is used within a test environment.
12. Sensitive information
Clients acknowledge that FICA sure may process highly sensitive identity and compliance information.
Access must be restricted to authorised persons.
13. Documents
FICA sure may accept images, PDFs and other formats expressly identified as supported.
Word, spreadsheet or other unsupported documents may be rejected.
Where multiple-file uploads are supported, the Client must follow the documented API convention.
14. Automated Processing
FICA sure may use automated and AI-assisted systems for extraction, classification, comparisons, document-quality assessment, inconsistency detection, risk analysis and workflow support.
Automated systems can make mistakes.
Clients must apply appropriate human judgment where required.
15. False positives and false negatives
No verification or screening service can guarantee the elimination of false positives or false negatives.
FICA sure does not warrant that every relevant person, document, risk or database entry will be detected.
16. Accounts
Clients are responsible for safeguarding usernames, passwords and API credentials and for activities performed through their authorised accounts.
Suspected compromise must be reported promptly.
17. API credentials
API keys must remain confidential.
Clients may not publish, sell, share, expose or otherwise make credentials available to unauthorised persons.
FICA sure may rotate, revoke or disable compromised credentials.
18. Test and live environments
Test and live environments may operate separately.
Test environments may contain synthetic information, sandbox screening, simulated results or different configurations.
Test results must not be represented as production screening results.
19. Fees and credits
FICA sure may charge through credits, subscriptions, packages, per-request charges or negotiated pricing.
Payment is for the processing service and does not guarantee a favourable result.
Credits generally have no cash redemption value unless expressly stated otherwise.
20. Processing failure
Where a verification cannot be completed because of a FICA sure technical failure, reserved credits may be released or refunded according to the applicable billing rules.
Failures caused by invalid Client data or rejected verification outcomes do not necessarily constitute a technical failure.
21. Availability
FICA sure does not guarantee uninterrupted availability unless a separate Service Level Agreement expressly provides otherwise.
Service may be affected by maintenance, network problems, supplier outages, government database availability, cybersecurity incidents or other circumstances outside reasonable control.
22. Security
FICA sure will maintain reasonable safeguards appropriate to the information processed.
No internet-connected service can guarantee complete security.
23. Intellectual Property
FICA sure retains its rights in its software, APIs, interfaces, documentation, processes, website, databases, branding and proprietary technology.
Third-party intellectual property remains the property of the applicable owner.
24. Client Data
The Client retains its rights in information lawfully supplied by it.
The Client grants FICA sure the rights reasonably required to process the information to provide the requested Service and meet applicable legal obligations.
25. Verification reports and results
Clients may retain and use reports for legitimate compliance, audit and recordkeeping purposes.
Clients may not commercially resell, republish or use FICA sure results to create a competing screening database without written authorisation.
26. Prohibited use
FICA sure may not be used for unlawful surveillance, harassment, stalking, identity theft, unlawful discrimination, unauthorised background investigations, unlawful profiling, scraping, security circumvention, malicious uploads, credential abuse or accessing another Client’s information.
27. Resale
Use of a normal FICA sure account does not automatically grant rights to resell, sublicense or white-label the Service.
Separate written authorisation may be required.
28. Suspension
FICA sure may suspend or restrict access where reasonably necessary because of fraud, misuse, security risk, unlawful Processing, unpaid amounts, legal requirements, system abuse or breach of these Terms.
29. Termination
Access may be terminated according to the applicable service agreement.
Serious misuse, unlawful activity or material breach may result in immediate termination.
Provisions relating to confidentiality, intellectual property, liability, data obligations and accrued payments may survive termination.
30. Confidentiality
Each party must reasonably protect confidential information received from the other.
Disclosure may occur where legally required.
31. Disclaimer of warranties
To the maximum extent permitted by law, FICA sure is provided “as is” and “as available.”
FICA sure does not guarantee that:
every result will be accurate;
all databases are complete;
every database is current;
every PEP will be detected;
every sanctioned person will be detected;
every false document will be detected;
every verification will complete successfully;
the Service will always be available; or
use of the Service guarantees regulatory compliance.
32. Limitation of liability
To the maximum extent permitted by law, FICA sure will not be liable for indirect, consequential, incidental or special losses arising from use of the Service, including lost profits, lost revenue, lost business opportunities or reputational damage.
FICA sure is not responsible for Client decisions made solely on the basis of an automated screening result without appropriate review.
Before commercial launch, a South African attorney should insert an appropriate monetary liability cap for your business model.
33. Client indemnity
To the extent permitted by law, the Client will be responsible for claims arising from the Client’s unlawful collection or submission of Personal Information, lack of lawful authority, misuse of screening results, violation of another person’s rights, unlawful customer decisions or misuse of FICA sure credentials.
34. Changes to Services
FICA sure may modify APIs, Service Providers, data sources, functionality and pricing from time to time.
Material changes affecting existing Clients should be communicated reasonably where appropriate.
35. Changes to these Terms
These Terms may be updated to reflect legal, regulatory, commercial, technical or security changes.
The current version will display its effective date and version.
36. Governing law
These Terms are governed by the laws of the Republic of South Africa.
37. Jurisdiction
Subject to mandatory law, disputes will be subject to the jurisdiction of the appropriate courts of South Africa.
38. Severability
If a provision is held to be invalid or unenforceable, the remaining provisions continue to apply.
39. Entire agreement
These Terms, the Privacy Policy, Acceptable Use and API Usage Terms, applicable pricing terms and any signed agreement form the agreement governing use of FICA sure.
Where a separately signed written agreement expressly conflicts with these Terms, the signed agreement will prevail to the extent of that conflict.
40. FICA sure enquiries
FICA sure
Website: ficasure.com
General enquiries: enquiries@ficasure.com
Privacy enquiries: enquiries@ficasure.com
Security reports: help@ficasure.com