This policy explains how BluCross Capital (Pty) Ltd collects, uses, stores, shares and protects your personal information. It is drafted in compliance with the Protection of Personal Information Act 4 of 2013 (POPIA) and all applicable South African legislation.
Blu Cross Capital (Pty) Ltd (trading as "BluCross Capital", "we", "us" or "our") is a registered South African company operating as a short-term credit provider and financial services provider.
As a responsible party under POPIA, Blu Cross Capital (Pty) Ltd (trading as BluCross Capital, together with Bilti Menutzach (Private) Limited as our authorized technology partner and Operator) processes your personal information lawfully, fairly, transparently and in a manner that respects your right to privacy as guaranteed under section 14 of the Constitution of the Republic of South Africa, 1996.
This Privacy Policy applies to:
This policy does not cover the privacy practices of third-party websites or services that may be linked from our website. We encourage you to read the privacy policies of any third-party sites you visit.
We collect only the information that is necessary for the purposes described in this policy. The categories of personal information we collect include:
| Category | Examples | Why We Need It |
|---|---|---|
| Identity Information | Full name, ID number, date of birth, nationality, gender | Identity verification, FICA compliance, NCA requirements |
| Contact Information | Phone number, email address, physical address, postal address | Communication, correspondence, account management |
| Financial Information | Income details, employment information, bank account number, bank statements, credit history | Affordability assessment (NCA s.81), credit checks, disbursement |
| Employment Information | Employer name, payslip details, employment type, salary pay date | Creditworthiness assessment, responsible lending |
| Account Information | Username, password (encrypted), login history, branch preference, application history | Account management, security, service delivery |
| Document Information | Bank statement PDFs, ID document copies, supporting documents | Application verification, NCA compliance, fraud prevention |
| Technical Information | IP address, browser type, device information, pages visited, time and date of access | Website security, analytics, fraud prevention, service improvement |
| Communication Records | Emails, WhatsApp messages, call logs, support requests | Record-keeping, dispute resolution, service quality |
We do not intentionally collect special personal information (race, religion, health, biometrics, political views, sexual orientation) unless strictly required by law or with your explicit consent.
Under POPIA Chapter 3, we may only process your personal information if at least one of the following conditions (lawful bases) applies:
| POPIA Condition | How It Applies to Us |
|---|---|
| Consent (s.11(1)(a)) | By creating an account and submitting a loan application, you consent to the processing of your personal information as described in this policy. You may withdraw consent, subject to legal and contractual limitations. |
| Contractual Necessity (s.11(1)(b)) | Processing is necessary to enter into or perform a credit agreement with you — including identity verification, affordability assessment and disbursement. |
| Legal Obligation (s.11(1)(c)) | We are required by law to process certain information — e.g., FICA (FIC Act 38 of 2001), NCA affordability assessment (s.81), NCR registration requirements, SARS compliance. |
| Legitimate Interest (s.11(1)(f)) | We have a legitimate business interest in processing information for fraud prevention, debt recovery, security, and improving our services — provided this does not override your rights. |
| Vital Interest (s.11(1)(d)) | In rare circumstances where processing is necessary to protect your vital interests or those of another person. |
We process your personal information only for the specific, explicitly defined purposes listed below. We will not process your information for any other purpose without your prior consent:
We do not sell, rent, or publicly disclose your personal information to third parties or the general public under any circumstances. Your data is locked, encrypted, and strictly guarded. We share or permit access to your information only in the specific, lawful circumstances detailed below:
| Recipient / Partner | Scope & Purpose | Legal Basis & Protections |
|---|---|---|
| Bilti Menutzach (Private) Limited (Technology Partner & Operator) |
Software development, database maintenance, infrastructure hosting, security telemetry, algorithm validation, and platform operations. | POPIA s.20–22 Operator Agreement; Legitimate Technical Interest |
| Registered Credit Bureaux (TransUnion, Experian, XDS) |
Mandatory credit checks, affordability assessment, and statutory payment behaviour reporting. | NCA s.70 statutory obligation; contractual necessity |
| Statutory Regulatory Authorities (NCR, FIC, SARS, Information Regulator) |
Suspicious transaction reporting, FICA compliance, tax filing, and regulatory oversight audits. | FIC Act 38 of 2001, NCA 34 of 2005, Tax Administration Act — Legal duty |
| Certified Auditing & Compliance Partners (External Auditors & Cyber Assessors) |
Independent statutory financial audits, legal compliance certifications, and external cybersecurity auditing. | Statutory audit obligations; POPIA s.19 security compliance |
| Banking Institutions | Disbursing loan funds directly and processing electronic repayments or debit orders. | Contractual necessity |
| Debt Collectors & Legal Practitioners | Recovery of overdue accounts in lawful default proceedings. | Legitimate interest; Credit Agreement terms |
| Courts of Law & Law Enforcement (SAPS) | Compliance with valid court orders, subpoenas, or lawful criminal investigations. | Legal obligation under South African law |
As our core technology partner and appointed Operator under POPIA section 20, software engineers and systems administrators at Bilti Menutzach (Private) Limited access system databases and application logs strictly for lawful reasons inherent to modern software development: ensuring application safety, diagnosing technical anomalies, deploying security patches, optimizing database indexing, preventing fraud, and ensuring the platform meets the highest standards of reliability and compliance.
In accordance with POPIA Act 4 of 2013 (sections 11(1)(a) and 15(3)(a)), your informed consent enables your verified profile attributes, credentials, and KYC status to be recognized across applications and digital platforms engineered or operated by Bilti Menutzach (Private) Limited (the Bilti Menutzach Ecosystem). This provides seamless single sign-on (SSO), profile portability, and secure access across ecosystem services without redundant verification, under continuous POPIA security compliance.
BluCross Capital and Bilti Menutzach retain your personal information, audit trails, and system records only for as long as is necessary to fulfill the purpose of collection, satisfy statutory mandates under South African law, or comply with international software security and financial audit standards. Our retention schedule is as follows:
| Information Type | Retention Period | Reason |
|---|---|---|
| Loan application records | 5 years after agreement end | NCA requirement; SARS compliance |
| Identity documents (FICA) | 5 years after business relationship ends | FIC Act s.22 requirement |
| Financial statements & bank records | 5 years | NCA, Companies Act, SARS |
| Credit bureau report records | 5 years | NCA; legitimate interest |
| Active client accounts | Duration of relationship + 5 years | Contractual; regulatory |
| Communication records | 3 years | Dispute resolution; audit trail |
| Website access logs | 12 months | Security; fraud prevention |
| Marketing preferences | Until you opt out or 3 years inactive | POPIA s.69; CPA compliance |
After the retention period expires, your personal information will be destroyed or de-identified in a secure manner, unless retention is required for legal proceedings or regulatory investigations.
As required by POPIA section 19, we take reasonable technical and organisational measures to secure your personal information against loss, damage, unauthorised access, disclosure, interference or destruction.
Under POPIA sections 5, 23, 24 and 68–73, you have the following rights in relation to your personal information:
You have the absolute right to request the deletion or de-identification of your personal information held by BluCross Capital and Bilti Menutzach (Private) Limited under Section 24 of POPIA:
To exercise any of these rights, submit a written request to our Information Officer at info@blucrosscapital.com. We will respond within 30 days as required by POPIA.
Our website uses cookies and similar tracking technologies to improve your experience. Cookies are small text files stored on your device by your browser.
| Cookie Type | Purpose | Duration |
|---|---|---|
| Essential / Session | Required for login sessions, form submissions, security (CSRF tokens) | Session (deleted on close) |
| Functional | Remembering your branch preference, language and display settings | Up to 12 months |
| Analytics | Understanding how visitors use our website (page views, navigation paths) | Up to 24 months |
| Security | Detecting suspicious activity, fraud prevention, bot protection | Session / 30 days |
You can control or disable cookies through your browser settings. Note that disabling essential cookies may prevent you from logging in or using certain features of our website. We do not use tracking cookies for advertising or share your browsing data with advertising networks.
Under POPIA section 69 and the Consumer Protection Act (CPA), you have the right to opt out of direct marketing communications at any time.
In limited circumstances, your personal information may be transferred to or processed in countries outside South Africa — for example, if we use cloud-based infrastructure hosted internationally.
We comply with POPIA section 72, which requires that cross-border transfers may only occur if:
We take reasonable steps to ensure any third-party international processors are bound by appropriate data protection agreements.
As required by POPIA section 55, we have appointed an Information Officer responsible for ensuring compliance with POPIA. You may direct any privacy-related queries, requests or complaints to:
If you are dissatisfied with our response to a privacy complaint, or believe we are processing your information in violation of POPIA, you have the right to lodge a complaint with the Information Regulator of South Africa.
We encourage you to contact us first before escalating to the Regulator. We are committed to resolving all privacy concerns promptly and fairly.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. When we make material changes, we will:
Your continued use of our services after any updated policy has been published constitutes your acceptance of the updated terms, to the extent permitted by law.
For any privacy-related queries, requests to exercise your POPIA rights, or general questions about this policy, please contact us:
NCR Registered
FSP · FIC · PCC 25