Privacy Policy

1. Responsible Party

Swytch (Pty) Ltd is the “responsible party” (and, where the GDPR applies, the “controller”) in respect of the personal information described in this Policy. Our registered address is Melrose North, Johannesburg 2196, South Africa. All privacy enquiries, objections and data subject requests may be directed to info@swytch.co.za.

Where Swytch processes personal information on behalf of a client under a commercial agreement, Swytch acts as an “operator” (processor) and processes that information only on the documented instructions of the client, subject to the terms of the relevant agreement.

2. Categories of Personal Information We Process

Identity and contact data: name, surname, job title, employer, business email address, telephone number and any other details you voluntarily provide in an enquiry form or in correspondence with us.

Commercial and transactional data: information relating to prospective or existing supply arrangements, product interests, territories of operation, integration requirements and records of communications between us.

Technical and usage data: IP address, device and browser type, operating system, referring pages, pages viewed, session duration and other information collected automatically through cookies and similar technologies (see our Cookie Policy).

We do not knowingly collect special personal information as defined in POPIA, nor personal information relating to children, and you should not submit such information to us.

3. Lawful Basis and Purpose of Processing

We process personal information only where a lawful basis exists, namely: (a) with your consent; (b) where processing is necessary to conclude or perform a contract to which you are a party; (c) where processing is necessary to comply with a legal obligation imposed on Swytch; or (d) where processing is necessary for the legitimate interests of Swytch or a third party, provided those interests are not overridden by your rights and freedoms.

The purposes for which we process personal information include responding to enquiries and requests for information; providing, administering and improving our products, technology solutions and advisory services; onboarding and managing supplier, partner and client relationships; performing due diligence, sanctions screening and anti-money-laundering checks where required; maintaining the security and integrity of our systems; conducting website analytics; and complying with legal, regulatory and audit obligations.

4. Disclosure to Third Parties

We may disclose personal information to: members of the Swytch group; suppliers, aggregators and distribution partners where necessary to fulfil a request or a contractual arrangement; professional advisers such as auditors, attorneys, accountants and insurers; and service providers who host, maintain, secure or support our systems, communications and analytics.

We may further disclose personal information where required or permitted by law, by an order of court, by a regulator or law-enforcement authority with competent jurisdiction, or where necessary to establish, exercise or defend a legal claim, or to protect the rights, property or safety of Swytch, our clients or the public.

We do not sell personal information, and we do not disclose personal information for the direct-marketing purposes of unrelated third parties.

5. Cross-Border Transfers

Swytch operates internationally and personal information may be transferred to, stored in, or accessed from countries outside the Republic of South Africa. Any such transfer is effected in accordance with section 72 of POPIA, on the basis that the recipient is subject to a law, binding corporate rules or a binding agreement providing an adequate level of protection substantially similar to POPIA, or that you have consented to the transfer, or that the transfer is necessary for the performance of a contract.

6. Retention of Records

Personal information is retained only for as long as is necessary to achieve the purpose for which it was collected, or for such longer period as is required or authorised by law, including the record-retention periods prescribed by the Companies Act 71 of 2008, the Tax Administration Act 28 of 2011 and the Financial Intelligence Centre Act 38 of 2001 where applicable.

Where personal information is no longer required and no lawful basis for retention exists, it is deleted, destroyed or de-identified in a manner that prevents its reconstruction in an intelligible form.

7. Information Security

Swytch implements appropriate, reasonable technical and organisational measures to prevent the loss of, damage to, or unauthorised destruction of personal information, and unlawful access to or processing of personal information, as contemplated in section 19 of POPIA. These measures include access controls, encryption in transit, network protections, logging, vendor assurance and periodic review of our safeguards.

No method of transmission over the internet or method of electronic storage is entirely secure. While we take our security obligations seriously, we cannot guarantee absolute security, and any transmission of information to us is at your own risk.

In the event of a compromise of personal information, Swytch will notify the Information Regulator and affected data subjects as soon as reasonably possible after becoming aware of the compromise, in accordance with section 22 of POPIA.

8. Your Rights as a Data Subject

Subject to the requirements and exceptions of POPIA, you have the right to: be notified that personal information about you is being collected or has been compromised; request confirmation of whether we hold personal information about you and to request access to that information; request the correction, destruction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained; object, on reasonable grounds, to the processing of your personal information; withdraw a consent previously given, without affecting the lawfulness of processing before withdrawal; and not to be subject to a decision based solely on automated processing that results in legal consequences for you.

Requests may be submitted to info@swytch.co.za, and where required, on the prescribed form contemplated in the Promotion of Access to Information Act 2 of 2000. We may require verification of your identity before acting on a request and may charge a prescribed fee for access requests. We will respond within the period prescribed by law.

9. Complaints

If you are not satisfied with the manner in which we have processed your personal information or handled your request, you may lodge a complaint with the Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001, or by email to complaints.IR@justice.gov.za. We would, however, appreciate the opportunity to address your concerns directly before you approach the Regulator.

10. Amendments to this Policy

Swytch may amend this Policy from time to time to reflect changes in our operations, technology or legal obligations. The version and effective date appear at the top of this page, and the amended Policy takes effect on publication on this website. Your continued use of the website following publication constitutes acceptance of the amended Policy.