Privacy Policy for Generocity

Generocity is a mobile application that enables individuals and organisations in South Africa to make and receive donations through a secure digital wallet. The platform supports donations, person-to-person transfers, merchant payments using QR codes, and the management of funds held in phone-based wallets.

This Privacy Policy explains how Effortless Payment Solutions (Pty) Ltd (“Generocity”, “we”, “us”, or “our”) collects, uses, stores, shares, and protects personal information when you register for or use the Generocity mobile application and related services.

It is intended to provide clear and transparent information in accordance with the Protection of Personal Information Act (“POPIA”) and the privacy disclosure requirements of the Apple App Store and Google Play Store.

Certain regulated financial services, including digital wallet functionality, identity verification and transaction processing, are provided by our authorised partner, Omnea Pay (Pty) Ltd. Omnea acts as an independent responsible party for the personal information it processes in connection with these services.

This Privacy Policy applies to personal information processed in connection with:

• Registration and use of Generocity donor and recipient accounts
• Identity verification and know-your-customer processes
• Use of the digital wallet, including sending, receiving, spending and withdrawing funds
• Donations, person-to-person transfers and merchant payments
• QR-code payment functionality
• Location-based donor and recipient proximity functionality
• Transactional communications, authentication and customer support
• App security, diagnostics and usage analytics

Generocity is intended only for individuals who are 18 years of age or older.

We verify age as part of the mandatory identity-verification process using government-issued identification documents.

4.1 Registration and Identity-Verification Information

All users, including donors and recipients, must complete identity verification.

When you register for a Generocity account, we collect:

• Your full legal name
• Your South African identity number or passport number
• Your date of birth and gender, as recorded on your identity document
• Your mobile telephone number
• Your email address
• Your residential address
• A recent selfie photograph
• Photographs or electronic copies of your identity document or passport
• Biometric information generated through facial-comparison and liveness-detection technology

We may also assign internal account, wallet and user identifiers to your account.

4.2 Wallet, Transaction and Financial Information

When you use the Generocity wallet or make or receive a payment, donation or transfer, we collect and process:

• Wallet addresses and account identifiers associated with your account
• Your wallet balance
• Transaction amounts
• Sender and recipient details
• Transaction references, dates, times and statuses
• Failed transaction and error information
• Records of pending payouts sent to unregistered mobile numbers
• Your recent payment recipients
• Merchant identifiers and QR-code scan records
• Wallet top-up amounts and statuses
• Withdrawal records
• Preferences you select, such as your default donation amount or preferred payment experience

Your recent payment recipients may be used to provide autocomplete suggestions when you initiate another payment. These suggestions are based on your own transaction history and are not generated through advertising or behavioural profiling.

We operate a private blockchain that functions solely as an independent validation and reconciliation tool. It records selected wallet addresses and transaction amounts so that we can verify balances and transaction information reported by Omnea.

The private blockchain is not the primary settlement or transaction-processing system.

4.3 Payment-Method Information

Generocity does not collect or store full payment-card numbers, card security codes or card authentication information.

Where payment-method details are required, they are provided directly to the authorised payment-services provider responsible for processing the payment. Generocity may receive a payment account reference, transaction amount, status or provider-generated identifier, but does not receive the complete card credentials.

The payment provider processes payment-method information in accordance with its own legal and regulatory obligations and privacy practices.

4.4 Precise Location Information

When a recipient opens the receiving screen, Generocity may request permission to access the device’s precise geographic location.

If permission is granted, the app periodically sends latitude and longitude coordinates to our systems while the receiving screen remains open. The coordinates may be associated with your authenticated account, user identifier, device identifier or active session.

We use precise location information to:

• Support the donor and recipient proximity functionality used during the donation process
• Correlate nearby donor and recipient activity
• Enable and verify relevant donation features
• Prevent misuse, impersonation and fraud
• Investigate transaction or security issues

This location feature does not collect location through the receiving-screen process when that screen is closed.

We do not use precise location information for advertising, direct marketing, product recommendations or cross-app tracking. We do not sell location information to advertisers or data brokers.

You may deny or withdraw location permission using your device settings. Certain proximity-based receiving functionality may not work correctly without location access.

4.5 Usage, Analytics and Technical Information

We collect technical and usage information to operate, secure and improve Generocity.

This information may include:

• An internal user or account identifier
• A stable, randomly generated client identifier created by the app
• Device and session identifiers
• App launches and session activity
• Onboarding steps completed
• Screens or functions used
• Donation, payment or transfer steps initiated or completed
• Errors encountered
• Device type
• Operating system
• App version
• Technical performance information
• Diagnostic information

The client identifier and associated event information may be transmitted to and stored in our systems. Usage events may be linked to your account or device through a user ID, client ID, session ID or similar identifier.

Our event records are designed not to contain sensitive onboarding information such as identity numbers, selfie photographs or identity-document images. They may nevertheless constitute personal information because they can be associated with an account or device.

4.6 Crash and Diagnostic Information

We independently collect crash and diagnostic information when the Generocity app experiences an error, unexpected behaviour, performance problem or failure.

This information may include:

• Crash logs
• Error reports
• Technical events
• Relevant timestamps
• App version
• Operating-system version
• Device characteristics
• Session information
• Network-status information
• Technical identifiers associated with the affected account, device or app session

Crash and diagnostic information may be linked to your account or device where it contains or can be associated with a user ID, client ID, device ID, session ID or similar identifier.

We use this information to:

• Identify and correct technical problems
• Maintain app functionality
• Investigate security incidents
• Improve app performance
• Increase the stability and reliability of Generocity

Crash and diagnostic information is not used for advertising or direct marketing.

We use personal information to:

• Create, verify, secure and manage Generocity accounts and digital wallets
• Authenticate users and administer login, PIN-reset and account-recovery processes
• Perform mandatory identity verification
• Comply with anti-money-laundering, counter-terrorist-financing and sanctions-screening obligations
• Process donations, transfers, wallet top-ups, merchant payments and withdrawals
• Maintain transaction histories and wallet balances
• Operate location-based donor and recipient proximity functionality
• Detect, investigate and prevent fraud, impersonation, money laundering and other unlawful activity
• Send one-time passwords, account-activation messages, invitations, payout links, security alerts and transaction notifications
• Respond to support requests
• Investigate app errors and security incidents
• Analyse the use and performance of app features
• Improve app functionality, security, scalability and reliability
• Maintain financial, regulatory and audit records
• Comply with applicable legal and regulatory obligations

Transactional Communications

We use email addresses and telephone numbers to send communications required to operate the service, including:

• One-time passwords
• Registration and activation messages
• Password or PIN-reset messages
• Payout and account invitations
• Transaction confirmations
• Security notifications
• Account-status messages
• Important service notices

We do not currently use email addresses or telephone numbers to send advertising or promotional campaigns.

Should we introduce direct-marketing communications in future, we will comply with applicable consent and opt-out requirements and update our disclosures where required.

User Preferences

Generocity may apply settings that you select, such as a default donation amount or payment-flow preference.

Applying a preference selected by you does not mean that we use your name, telephone number or purchasing behaviour to create advertising profiles or personalised product recommendations.

We do not use personal information for personalised advertising or cross-app behavioural targeting.

As part of identity verification, we collect and securely store:

• Selfie photographs taken during onboarding
• Photographs or scans of government-issued identity documents or passports

These images and biometric information generated through facial comparison and liveness detection are used only for:

• Identity verification
• Fraud and impersonation prevention
• Account security
• Compliance with financial and regulatory obligations

The information may be processed by Omnea and authorised identity-verification providers. It is not displayed to other Generocity users.

By submitting your selfie and identity documents, you consent to the processing of your biometric information for these specific purposes, subject to your rights under applicable law.

We share personal information only where necessary to provide Generocity, operate its features or comply with legal and regulatory obligations.

The principal recipients include:

Omnea Pay (Pty) Ltd

We share relevant registration, identity-verification, wallet and transaction information with Omnea so that it can:

• Perform identity verification
• Establish and operate digital wallets
• Process transactions
• Maintain regulated financial records
• Comply with its legal and regulatory obligations

Information shared with Omnea may include your name, identity number, date of birth, address, mobile number, selfie, identity-document images, wallet information and transaction information.

Omnea acts as an independent responsible party for the personal information it processes in connection with its regulated financial services.

Twilio

We share mobile telephone numbers and transactional message content with Twilio where necessary to deliver:

• One-time passwords
• Authentication messages
• Payout invitation links
• Account invitations
• Other essential SMS communications

Twilio may process technical delivery information needed to transmit and confirm delivery of these messages.

Identity-Verification Providers

Authorised identity-verification providers may process:

• Selfie photographs
• Identity-document images
• Identity information
• Facial-comparison data
• Liveness-detection results

They process this information for identity verification, regulatory compliance and fraud prevention.

Payment-Service Providers

Where an external payment provider processes a wallet top-up or other payment, it may collect payment-method information directly from you.

Generocity may receive transaction references, account tokens, amounts and payment statuses, but does not receive or store complete payment-card credentials.

Technology and Infrastructure Providers

Contracted hosting, infrastructure, security, monitoring and technical-service providers may process limited account, usage, crash, diagnostic and technical information on our behalf where necessary to host, operate, monitor, secure, troubleshoot and maintain Generocity.

Private Blockchain Network

Selected wallet addresses and transaction amounts are recorded on our private blockchain for independent validation and reconciliation.

The private blockchain is not used for advertising, public cryptocurrency trading or primary settlement.

We do not sell personal information.

We do not share personal information with advertisers or data brokers for behavioural advertising or cross-app tracking.

Service providers acting on our behalf are required to protect personal information and use it only for authorised purposes.

We retain personal information only for as long as necessary to:

• Provide Generocity
• Fulfil the purpose for which the information was collected
• Comply with legal and regulatory obligations
• Maintain financial and audit records
• Investigate fraud or security incidents
• Resolve disputes
• Enforce our agreements

Identity-verification records, including selfies and copies of identity documents, are generally retained for at least five years after the end of your relationship with Generocity, or for a longer period where required or reasonably necessary for compliance.

Transaction records, wallet information and related financial information are retained for the periods required by applicable financial, audit and regulatory requirements.

Precise location records are retained only for as long as reasonably necessary for the operation, verification, security and investigation of the relevant donation or transaction functionality, subject to applicable legal requirements.

Raw usage and event information is retained only for as long as reasonably necessary for operational, analytics, security and troubleshooting purposes. It may subsequently be aggregated or de-identified.

Crash logs and diagnostic information are retained only for as long as reasonably necessary to investigate and resolve technical, operational, performance or security issues. They may subsequently be deleted, aggregated or de-identified unless longer retention is required for legal, security, audit or fraud-prevention purposes.

When personal information is no longer required, we take reasonable steps to delete, destroy or anonymise it securely.

Subject to applicable law, you may:

• Request confirmation of whether we hold personal information about you
• Request access to your personal information
• Request the correction or updating of inaccurate, incomplete or outdated information
• Request deletion or destruction of personal information, subject to legal retention requirements
• Object to certain processing
• Withdraw consent where processing is based on consent
• Lodge a complaint concerning the processing of your personal information

To exercise these rights, contact us at support@generocity.co.za.

We may need to verify your identity before processing a request.

You may also manage device permissions, including location permission, through your mobile device settings.

You may delete your Generocity account directly in the app by going to Profile → Delete Account and following the on-screen instructions. Once your request is submitted, we will process the deletion of your account and associated personal information, subject to any legal, regulatory, financial, fraud-prevention, security, audit or dispute-resolution retention obligations described in this Privacy Policy.

We implement reasonable technical and organisational safeguards appropriate to the nature and sensitivity of the personal information we process.

These safeguards include:

• Encryption of information in transit
• Secure storage practices
• Encrypted storage of wallet private keys
• Identity and access controls
• Authentication measures
• Activity and security logging
• Restricted access to sensitive information
• Periodic security reviews

No digital system can guarantee absolute security. Users should protect their devices, passwords and authentication credentials and notify us promptly if they suspect unauthorised access to their account.

We may update this Privacy Policy when our services, technology, service providers or legal obligations change.

The updated version will be published on our website and will state the date on which it was last updated. Where required by law, we will provide additional notice or obtain consent before materially changing how personal information is processed.

Questions about this Privacy Policy or requests concerning your personal information may be directed to:

Information Officer: A.S. Wilken

Email: support@generocity.co.za

You also have the right to lodge a complaint with the Information Regulator of South Africa if you believe your personal information has been processed unlawfully.