Privacy Notice - POPI Act Compliance

Trace4U, operated by MyGenesis.io, is committed to protecting your personal information in compliance with the Protection of Personal Information Act, 2013 (Act No. 4 of 2013) ("POPI Act"), as amended. This Privacy Notice explains how we collect, use, process, and protect personal information in accordance with South African law and international best practices.

This policy applies to all personal information we collect and process through our tracing and verification management system, whether collected directly from you or from other authorized sources.

We collect the following categories of personal information:

• Personal Information: Full names, identification numbers (ID, passport), date of birth, contact details (phone, email, postal address), and physical addresses
• Employment Information: Employer names, employment status, job titles, and work contact details
• Financial Information: Debt amounts, payment history, bank account details, outstanding balances, and financial transaction records
• Address Information: Residential addresses, business addresses, and historical address records
• Case-Related Information: Information relevant to specific tracing and verification cases, including communication records and verification outcomes

We process personal information for the following purposes:

• Debt Tracing and Recovery: Locating debtors and facilitating debt recovery processes for our authorized clients
• Verification Services: Verifying identity, address, and employment information for client requirements
• Case Management: Managing, tracking, and resolving individual tracing and verification cases
• Invoicing and Financial Reporting: Generating invoices, managing payments, and maintaining financial records
• System Administration: Maintaining system security, preventing fraud, and ensuring operational integrity
• Legal Compliance: Meeting legal and regulatory obligations under South African law

We process personal information on the following legal bases:

• Consent: Explicit consent obtained from data subjects for specific processing activities, where required
• Legitimate Interest: Our legitimate interest in conducting debt recovery and verification services, balanced against your rights and freedoms
• Contractual Obligations: Fulfilling contractual obligations with our clients to provide tracing and verification services
• Legal Obligations: Compliance with legal obligations under South African law, including tax law, National Credit Act requirements, and other applicable legislation
• Public Interest: Performance of functions in the public interest as they relate to debt recovery and fraud prevention

Under the POPI Act, you have the following rights regarding your personal information:

• Right of Access: You may request access to your personal information we hold, including details of how it is being processed
• Right to Correction: You may request correction of inaccurate or incomplete personal information
• Right to Deletion: You may request deletion of your personal information where legally permitted, subject to applicable retention requirements
• Right to Object: You may object to the processing of your personal information on legitimate grounds
• Right to Lodge a Complaint: You may lodge a complaint with the Information Regulator if you believe your rights have been violated
• Right to Request Restriction: You may request restriction of processing in certain circumstances

To exercise these rights, please contact our Information Officer using the details provided in the Contact Information section below.

We retain personal information in accordance with the following retention periods:

• General Personal Data: Retained only as long as necessary for the purpose of processing, typically for the duration of a case and 12 months thereafter
• Financial Records: Retained for a minimum of 5 years in accordance with South African tax law and accounting standards requirements
• Case Records: Maintained for the duration of active case management plus an additional period for potential legal disputes or complaints
• Anonymized Data: Upon request, personal data may be anonymized for statistical and research purposes

After the retention period expires, personal information is securely destroyed or anonymized. You may request earlier deletion or anonymization where legally permitted.

We implement comprehensive security measures to protect personal information from unauthorized access, alteration, disclosure, or destruction:

• Access Controls: Role-based access controls ensuring only authorized personnel can access personal data
• Encrypted Storage: Encryption of sensitive personal information at rest using industry-standard encryption protocols
• Data Masking: Masking of sensitive information such as ID numbers, bank account details, and complete contact information in system displays
• Audit Trails: Comprehensive logging and monitoring of all access to personal information for compliance verification
• Secure Transmission: Encrypted transmission of personal information over secure channels (HTTPS/TLS)
• Regular Testing: Periodic security assessments and vulnerability testing
• Staff Training: Ongoing data protection and privacy training for all personnel with access to personal information

Personal information is shared with third parties only in the following circumstances:

• Authorized Clients: Personal information is shared with our authorized clients solely for the purposes of conducting tracing and verification services they have engaged us to perform
• Service Providers: We may share information with authorized service providers who assist us in delivering our services, subject to strict data protection agreements
• Legal Compliance: We may disclose information when required by law, legal process, or government request
• Law Enforcement: Information may be shared with law enforcement authorities where necessary to prevent or investigate fraud or other illegal activities

We do NOT sell, rent, or trade personal information to any third party.

For all privacy-related inquiries, requests to exercise your rights, or complaints, please contact our Information Officer:

We will respond to all privacy requests and complaints within the timeframes specified by the POPI Act and relevant South African regulations.

We review and update this Privacy Notice periodically to reflect changes in our operations, technology, legal requirements, and other factors. Any material changes will be communicated to affected data subjects where required by law.

Last Updated: February 2026

Effective Date: February 2026

Your continued use of Trace4U following any changes to this policy constitutes your acceptance of the updated policy.