Privacy Policy

1.1. Identity and Status of MINT Platforms

1.1.1. MINT Platforms (Pty) Ltd (Registration Number 2024/644796/07) (“MINT”, the “Company”, “we”, “us” or “our”) is a private company incorporated under the laws of the Republic of South Africa. MINT is registered as a Financial Services Provider under the Financial Advisory and Intermediary Services Act 37 of 2002 (FSP Licence Number 55118) and as a credit provider under the National Credit Act 34 of 2005 (NCR Registration Number NCRCP22892).

1.1.2. AlgoLend is not a separate legal person. AlgoLend is a trading name, product and business unit of MINT, comprising a credit engine, a KYC and verification module, open banking integration, electronic contracting functionality and SACRRA reporting capability. A reference to AlgoLend in this Policy, on the Site or in any related documentation is a reference to MINT trading and operating in that name, and any agreement concluded through the Site or the Platform is concluded with MINT.

1.1.3. This Policy is issued in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”) and sets out how MINT collects, uses, discloses, retains and protects personal information in connection with AlgoLend and the website at algolend.co.za (the “Site”), and describes the rights available to data subjects whose personal information MINT processes.

1.2. Application of this Policy

1.2.1. This Policy applies to visitors to the Site, to prospective Corporate Clients who make enquiries about AlgoLend, to Corporate Clients that have concluded a Platform Services Agreement with MINT, and to the directors, beneficial owners, authorised users and representatives of those Corporate Clients whose personal information is submitted to MINT in the course of onboarding, credit assessment and account administration.

1.2.2. MINT is the sole registered credit provider extending credit facilities to Corporate Clients through AlgoLend, and Corporate Clients are the borrowers under those facilities. Where a Corporate Client separately uses functionality within AlgoLend to originate, assess or manage credit extended by that Corporate Client to its own customers, that Corporate Client determines the purpose and means of processing its customers' personal information and is the responsible party for that processing. MINT processes such personal information solely on the Corporate Client's instruction and in that respect acts as an operator, as more fully addressed at clause 3.

2.1. Definitions

• “Corporate Client” means a juristic entity that has been onboarded to, or has applied to be onboarded to, AlgoLend and that borrows from MINT, and where applicable extends credit to its own customers, using the Platform, under a Platform Services Agreement.
• “Information Officer” means the person appointed by MINT as its information officer under section 55 of POPIA.
• “Information Regulator” means the Information Regulator established under section 39 of POPIA.
• “Operator”, “Personal Information”, “Processing” and “Responsible Party” have the meanings given in section 1 of POPIA.
• “Platform” means AlgoLend, comprising the credit engine, the KYC and verification module, open banking integration, electronic contracting functionality, SACRRA reporting capability, and the Site.
• “Platform Services Agreement” means the agreement concluded between MINT and a Corporate Client governing that Corporate Client's use of the Platform and, where applicable, the credit facility extended by MINT to that Corporate Client.
• “Site” means the website located at algolend.co.za.

2.2. Interpretation. Words importing the singular include the plural and words importing the plural include the singular. A reference to legislation is a reference to that legislation as amended, re-enacted or replaced from time to time. Clause headings are for convenience only and do not affect the interpretation of this Policy.

An individual who has obtained or applied for credit from a Corporate Client using AlgoLend should refer to that Corporate Client's own privacy policy for information on how that individual's personal information is processed. This Policy governs MINT's processing of personal information as responsible party, being personal information relating to Site visitors, prospective and onboarded Corporate Clients, and the directors, beneficial owners, authorised users and representatives of those Corporate Clients.

4.1. Categories of Personal Information

4.1.1. MINT collects enquiry and correspondence data, being the name, business email address, telephone number, company name and any other information volunteered through an enquiry or support channel on the Site.

4.1.2. MINT collects onboarding and KYC data in respect of a Corporate Client and its directors, beneficial owners and authorised representatives, including identity or passport numbers, proof of identity and residential address, company registration details, proof of business address, banking details and source of funds information, collected to fulfil MINT's obligations under the Financial Intelligence Centre Act 38 of 2001 (“FICA”) and its risk-based customer due diligence processes.

4.1.3. MINT collects credit and financial information relating to a Corporate Client's financial position, credit history and creditworthiness, including information obtained from registered credit bureaux and the South African Credit and Risk Reporting Association (SACRRA), collected in MINT's capacity as a registered credit provider under the National Credit Act.

4.1.4. MINT collects platform usage data, being login credentials, user activity, IP addresses, device identifiers and diagnostic data generated through use of the Site and the Platform.

4.1.5. MINT retains records of communications between a data subject and MINT, including support queries.

4.2. Special Personal Information and Children

4.2.1. MINT does not knowingly collect special personal information as defined in section 26 of POPIA, save where such information is incidentally disclosed in correspondence or where processing is otherwise permitted under section 27 of POPIA, in which event MINT will process it strictly in accordance with that section.

4.2.2. AlgoLend is a business-to-business platform intended for use by juristic entities and their authorised adult representatives. It is not directed at children, and MINT does not knowingly collect personal information from children other than in accordance with section 35 of POPIA. Where MINT becomes aware that it has inadvertently collected a child's personal information other than as permitted by that section, it will take reasonable steps to delete that information.

4.3. Sources of Personal Information. MINT collects personal information directly from data subjects, from public company registers, from registered credit bureaux and SACRRA, from open banking data providers authorised by a Corporate Client, and from third-party identity verification and KYC service providers engaged by MINT.

5.1. Purpose of Processing. MINT processes personal information to:

• Respond to enquiries and provide information about AlgoLend
• Assess applications to become a Corporate Client and conduct onboarding, KYC and credit due diligence
• Conclude and administer the Platform Services Agreement and the credit facility extended to a Corporate Client
• Operate, maintain and secure the Platform and the Site
• Comply with obligations under FICA, the National Credit Act, the Financial Advisory and Intermediary Services Act, the Companies Act 71 of 2008 and other applicable law
• Detect, investigate and prevent fraud, money laundering and other financial crime
• Communicate with Corporate Clients regarding the Platform, including service notices and, where consented to, marketing communications
• Exercise or defend its legal rights

5.2. Lawful Basis. MINT relies on one or more of the justifications recognised under section 11 of POPIA for each processing activity described in this Policy, namely consent, the performance of a contract or the taking of steps at a data subject's request prior to entering into a contract, compliance with a legal obligation including under FICA, the National Credit Act and POPIA, and the pursuit of legitimate interests by MINT or a third party, including fraud prevention, platform security and the assessment of creditworthiness, provided such interests are not overridden by the data subject's interests or fundamental rights.

5.3. Consent. Where MINT relies on consent, that consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before withdrawal, by contacting the Information Officer using the details in clause 10.3. Withdrawal of consent to processing necessary for the performance of the Platform Services Agreement may affect MINT's ability to continue providing the Platform to the relevant Corporate Client.

6.1. Cookies. The Site may use cookies and similar technologies for authentication, security and session management, and, where enabled, for analytics purposes.

6.2. Marketing. MINT may use a business contact's details to send information about AlgoLend and related services, where consent has been given or where the communication falls within the existing business relationship exemption recognised under section 69 of the Electronic Communications and Transactions Act 25 of 2002. A recipient may opt out of marketing communications at any time using the unsubscribe mechanism provided or by contacting MINT directly.

7.1. AlgoLend's credit engine generates automated outputs, including credit scoring and risk indicators, that inform credit decisions taken by MINT in respect of a Corporate Client's facility and, where applicable, decisions taken by a Corporate Client in respect of its own customers. Where such automated processing produces legal or similarly significant effects for a data subject, section 71 of POPIA affords that data subject the right not to be subject to a decision based solely on automated processing intended to profile them, subject to the exceptions in that section.

7.2. Where MINT itself makes an automated decision in respect of a Corporate Client's credit facility, an authorised representative of the Corporate Client may request that the decision be reconsidered by a natural person by contacting MINT using the details in clause 10.3. Where a Corporate Client uses AlgoLend's outputs to make its own automated decisions regarding its customers, the Corporate Client, as responsible party for that processing, is responsible for affording those customers the equivalent right, and MINT will provide reasonable assistance to Corporate Clients in meeting that obligation in accordance with the Platform Services Agreement.

8.1. Retention. MINT retains personal information for as long as necessary to fulfil the purposes described in this Policy and to comply with its statutory retention obligations, including the record-keeping requirements of FICA, the National Credit Act and the Companies Act, and to establish, exercise or defend legal claims. Retention periods vary according to the category of information and the purpose for which it was collected.

8.2. Security Safeguards. MINT implements appropriate technical and organisational measures, in accordance with section 19 of POPIA, to secure the integrity and confidentiality of personal information in its possession or under its control, including access controls, encryption of data in transit, and contractual security obligations imposed on its third-party service providers. No system of transmission or storage can be guaranteed to be entirely secure.

8.3. Cross-Border Transfers. Where MINT transfers personal information to a third party located outside South Africa, it does so only where the recipient is subject to a law, binding corporate rules or a binding agreement affording a level of protection substantially similar to POPIA, or where another ground recognised under section 72 of POPIA applies.

8.4. Operators and Third-Party Service Providers. MINT engages third-party service providers to support the operation of AlgoLend, which may include identity verification and KYC providers, open banking data aggregators, payment processing providers, cloud hosting providers, and SACRRA. Each such provider is contractually bound to process personal information only on MINT's instruction, to maintain appropriate security safeguards, and to comply with section 21 of POPIA.

9.1. Rights Under POPIA. A data subject has the right, subject to POPIA, to:

• Be notified that personal information about them is being collected and, in the circumstances set out in section 24 of POPIA, that it has been accessed or acquired by an unauthorised person
• Establish whether MINT holds personal information about them and to request access to that information
• Request the correction, destruction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, unlawfully obtained, or that MINT is no longer authorised to retain
• Object, on reasonable grounds, to the processing of their personal information, and to object to the processing of their personal information for purposes of direct marketing
• Withdraw consent to processing where processing is based on consent, and to lodge a complaint with the Information Regulator or approach a competent court regarding an alleged infringement of their rights under POPIA

A data subject who wishes to exercise a right described in this clause should contact the Information Officer using the details in clause 10.3. MINT will respond within the timeframes prescribed by POPIA.

9.2. Data Breach Notification. Should a security compromise occur that has resulted, or is reasonably likely to result, in unauthorised access to or acquisition of personal information, MINT will notify the Information Regulator and the affected data subjects as soon as reasonably possible, in accordance with section 22 of POPIA, unless a public body responsible for the prevention, detection or investigation of offences requests that notification be delayed.

9.3. Complaints. A data subject who is not satisfied with MINT's response to a request or complaint may lodge a complaint with the Information Regulator, whose contact details are published at www.justice.gov.za/inforeg.

10.1. Amendment. MINT may amend this Policy from time to time to reflect changes in its processing activities or in applicable law. The version number and effective date on the cover of this Policy indicate the current version. Material changes will be notified to Corporate Clients in accordance with the notice provisions of the Platform Services Agreement.

10.2. Related Policies and Documents. This Policy should be read together with the Platform Services Agreement, the Cookie Policy, the Acceptable Use Policy, the AlgoLend AML and Financial Crime Statement, the PAIA Manual Access Notice, and MINT's internal POPIA Compliance Framework and Privacy Policy, which governs MINT's processing of personal information generally, beyond the AlgoLend Platform.

10.3. Contact Details. Queries regarding this Policy, or requests to exercise a right described at clause 9, may be directed to MINT's Information Officer, Lonwabo Damane, by email to info@algolend.co.za or in writing to 3 Gwen Lane, Sandown, Johannesburg, 2031.