Privacy Policy

How RealPay collects, uses, shares, retains and protects personal information across our countries of operation.

Last updated October 2026

RealPay operates across several African markets, including South Africa, Namibia, Botswana, Eswatini, Lesotho, Uganda, Zambia and Kenya. We process personal information in accordance with the data protection and privacy laws applicable in the jurisdictions in which we operate.

Where this Privacy Policy refers specifically to South African legislation, including the Protection of Personal Information Act (POPIA) and the Promotion of Access to Information Act (PAIA), those references apply to RealPay’s South African operations. Equivalent or other applicable data protection requirements may apply in other jurisdictions.

1. Information Officer

RealPay has appointed an Information Officer responsible for overseeing compliance with applicable data protection legislation. Privacy, POPIA and PAIA enquiries may be directed to:

Information Officer: Compliance and Risk Manager

Email: compliance@realpay.co.za

Subject line: Privacy Enquiry

2. Personal Information We Collect

RealPay processes personal information necessary for our business, services and regulatory purposes. Depending on the relationship and service, this may include:

Identity and contact information: such as name, identity or passport number, physical or postal address, email address and telephone number.
Business, ownership and verification information: such as business registration documents, company and beneficial ownership information, proof of address, banking details, customer and merchant identification, KYC documentation and other information required for onboarding and verification.
Transaction and payment information: such as payment instructions, transaction, settlement and collection records, banking information, mandates, disputes and related payment information.
Agreements and consent records: including contractual documentation, mandates, consent records and recorded preferences or objections.
Account and authentication information: such as usernames, access roles, permissions, login information, device identifiers and security events.
Technical and usage information: such as IP address, browser or device information, cookies, usage data, logs and information relating to interactions with RealPay’s websites, platforms and services.
Communications and support information: including correspondence, enquiries, complaints, support interactions and other customer communications.
Compliance, fraud and risk information: such as due-diligence and verification results, sanctions screening, fraud indicators and other information required for legal, regulatory, fraud-prevention, information-security and risk-management purposes.
Marketing and engagement information: such as business contact details, communication preferences, consent and objection records, event attendance and interactions with RealPay content.

RealPay processes only personal information that is adequate, relevant and reasonably necessary for the stated purpose.

3. Legal Basis for Processing

RealPay processes personal information only where there is an appropriate lawful basis under applicable data protection legislation and only to the extent necessary for the purpose for which the information was collected.

Depending on the processing activity, the lawful basis may include:

Contract performance: to provide our payments services and fulfil our agreement with you.
Legal obligation: to comply with applicable financial services, anti-money laundering, tax and other laws in the jurisdictions in which we operate.
Legitimate interests: including fraud prevention, security and improving our services, where permitted by applicable law.
Consent: where we have obtained consent for specific processing. Where special or sensitive personal information is processed, this will occur only where permitted under applicable data protection legislation or where the necessary consent or other lawful justification exists.

4. How We Use Your Information

RealPay may process personal information for:

merchant onboarding and account establishment
customer identification and verification
payment processing and transaction management
client relationship management, service delivery and communication
improving our products, services and customer experience
regulatory compliance and reporting
fraud detection and prevention, platform security and risk management
meeting regulatory and legal obligations
complaint handling and information security
human-resources administration and supplier management
marketing where permitted by law
analytics, product development and service improvement, using aggregated or de-identified information where reasonably possible
establishing, exercising or defending legal rights and claims.

5. Sharing of Personal Information

RealPay may disclose or make personal information available where necessary to provide payments services, meet legal or regulatory obligations, administer contractual relationships, support information security or otherwise carry out an approved processing purpose.

Where third parties process personal information on RealPay’s behalf, they are required to comply with appropriate contractual, confidentiality and security requirements and maintain appropriate safeguards to protect personal information.

Recipients may include:

Bank partners and payment networks involved in transaction processing.
Regulators and law enforcement where required or permitted by law.
Service providers and technology partners that process information on our behalf under written agreements.
Professional advisers, including lawyers and auditors, where necessary.
RealPay Group entities, where necessary for service delivery, administration, security, compliance, support and reporting, subject to appropriate access controls and applicable cross-border requirements.

6. Cross-Border Processing

Because RealPay operates across multiple jurisdictions and uses regional or international service providers, personal information may be stored in, accessed from or transferred to another country.

RealPay will transfer personal information only where permitted by applicable law and will apply appropriate contractual, technical and organisational safeguards.

For South African personal information, cross-border transfers will comply with section 72 of POPIA. Equivalent local requirements will apply in other jurisdictions.

7. Data Retention

RealPay retains personal information only for as long as reasonably necessary for the purpose for which it was collected and for any applicable legal, regulatory, contractual, audit, dispute, tax, employment, payment-system or financial intelligence requirement.

When retention is no longer justified, information will be securely destroyed, deleted or de-identified, subject to applicable legal and record-keeping requirements.

8. Your Privacy Rights

Individuals have the right, where applicable, to:

be notified when their personal information is collected and in the event of a data breach;
ask whether RealPay holds personal information about them and request access to it;
request correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;
object to the processing of their personal information where permitted by applicable law;
withdraw consent where processing relies on consent;
object at any time to direct marketing;
request restriction of processing or data portability where these rights are provided by applicable law;
request human review of certain solely automated decisions where applicable; and
lodge a complaint with the applicable data protection or regulatory authority, where provided for by law.

Deletion, objection and other data subject requests remain subject to applicable legal, regulatory and record-keeping requirements.

9. Direct Marketing

RealPay conducts direct marketing in accordance with applicable data protection, privacy and consumer protection laws. Electronic direct marketing will be sent only where valid consent has been obtained or where another lawful basis or applicable existing-customer exception permits it.

Marketing communications will identify the sender and provide a simple, effective and free method to opt out.

For South African data subjects, electronic direct marketing will be managed in accordance with section 69 of POPIA.

10. Cookies and Website Tracking

RealPay uses cookies and similar technologies to operate, secure and improve our websites and online services, remember user preferences, understand how our services are used and, where permitted, support marketing activities. This Privacy Policy should be read together with our Cookie Policy.

Where consent is required for non-essential cookies or similar technologies, RealPay will obtain consent before activating them and will provide an appropriate mechanism for users to manage or withdraw their preferences. Strictly necessary technologies may be used without consent where permitted by applicable law.

11. Security

RealPay applies technical and organisational measures to protect the integrity and confidentiality of personal information in our possession or under our control. These measures are supported by RealPay’s risk-management framework and Information Security Management System, together with policies and procedures governing data, systems, networks and users.

RealPay maintains an Information Security Management System (ISMS) aligned to ISO/IEC 27001:2022.

12. Data Breaches

Where RealPay is the responsible party or data controller, we will notify the relevant supervisory authority and affected data subjects of a security compromise or personal data breach within the period and in the manner required by applicable law.

Where RealPay acts as an operator or data processor, we will notify the relevant responsible party or data controller in accordance with applicable law and contractual requirements.

13. Automated Processing

RealPay may use automated rules, models and screening tools to identify fraud, sanctions exposure, suspicious activity, security threats, transaction anomalies and regulatory risk.

Where automated processing may have a legal or similarly significant effect on an individual, RealPay will apply the safeguards required by applicable law.

14. Requests for Information and Access

Individuals may, upon providing appropriate proof of identity, request RealPay to confirm whether we hold personal information about them and request access to that information.

Requests will be handled in accordance with applicable data protection and access-to-information legislation. For requests relating to RealPay’s South African operations, the requirements of POPIA, PAIA and the applicable regulations will apply, including prescribed request forms where required.

Supporting documentation may be required to verify the identity and authority of the requester. RealPay will process requests within the prescribed period and communicate the outcome in writing.

Personal identification documents and other sensitive personal information should not be sent to RealPay by ordinary email. Contact the Information Officer for guidance on a secure submission method.

Where RealPay acts solely as an operator or data processor, the request may need to be directed to the relevant responsible party or data controller. RealPay will assist or forward the request where appropriate and permitted.

15. Objection, Correction and Deletion Requests

Individuals or users may, where permitted under applicable data protection legislation, object to the processing of their personal information and request its correction or deletion.

For South African data subjects, these rights include those provided under sections 11(3) and 24 of POPIA and the applicable regulations.

Individuals may request correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, or request destruction or deletion where RealPay is no longer authorised to retain the record.

These rights are subject to applicable legal and record-keeping obligations.

16. Changes to This Policy

RealPay may review and update this Privacy Policy where there is a material change in applicable law, regulatory guidance, processing activities, technology, risk, business structure or service delivery.

Material changes affecting data subjects will be communicated through an appropriate channel where required by applicable law.

17. Policy Scope and Availability

This document is a public-facing version of RealPay’s applicable policy and does not necessarily reflect the full scope or detail of the internal policy maintained by RealPay.

The complete policy, where appropriate and subject to applicable confidentiality, legal and regulatory requirements, may be requested from RealPay at info@realpay.co.za.

18. Contact Details

Information Officer: Compliance and Risk Manager

Email: compliance@realpay.co.za

Subject line: Privacy Enquiry

Postal: PostNet Suite 465, Private Bag X10, Elardus Park, Gauteng, 0047