PROTECTION OF PERSONAL INFORMATION (POPIA) POLICY

Document	Detail
Policy title	Protection of Personal Information (POPIA) Policy
Applies to	National Debt Advisors, its employees, agents and operators
Version	1.0
Effective date	1 June 2026
Next review date	1 June 2027
Approved by	Information Officer

1. Introduction and Purpose

National Debt Advisors (“we”, “us”, “our”, “NDA” or “the Company”) is a debt counselling firm registered with the National Credit Regulator (NCR) under registration number NCRDC2351. We provide debt review and debt counselling services to over-indebted consumers in South Africa in terms of the National Credit Act 34 of 2005 (“NCA”).

To deliver these services we necessarily collect and process significant amounts of personal information, including sensitive financial information. We are committed to protecting your privacy and to handling your personal information lawfully, fairly and transparently.

This Policy explains how we collect, use, store, share and protect your personal information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”), the related Regulations, and other applicable South African law. It applies to information collected through our website, telephone, email, application forms and any other interaction you have with us.

By submitting your personal information to us — whether through our website contact and assessment forms, by telephone, or in the course of your debt review — you acknowledge that you have read and understood this Policy.

2. Key Definitions

The following terms are used throughout this Policy and carry the meanings given to them in POPIA:

Term	Meaning
Personal information	Information relating to an identifiable, living natural person and, where applicable, an identifiable existing juristic person — for example name, ID number, contact details, financial information and credit history.
Special personal information	Information concerning a data subject’s religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health, sex life, biometric information or criminal behaviour.
Processing	Any operation concerning personal information, including collection, receipt, recording, storage, updating, use, dissemination, distribution, erasure or destruction.
Data subject	The person to whom the personal information relates — in most cases, you, our client or prospective client.
Responsible party	The party that determines the purpose of and means for processing personal information. National Debt Advisors is the responsible party.
Operator	A person who processes personal information on behalf of the responsible party in terms of a contract or mandate — for example our payment distribution agency or IT service providers.
Information Officer	The person responsible for ensuring NDA’s compliance with POPIA, as registered with the Information Regulator.
Information Regulator	The independent statutory body established under POPIA to monitor and enforce compliance with the Act and PAIA.

3. Information Officer

National Debt Advisors has appointed an Information Officer who is responsible for the development, implementation and monitoring of this Policy and for ensuring our compliance with POPIA. The Information Officer is registered with the Information Regulator as required by section 55 of the Act.

Any questions about this Policy, requests relating to your personal information, or complaints should be directed to:

Information Officer	Contact Details
Name	Jana Beyers
Postal / physical address	1^st Floor, 9 Long Street, Cape Town, Western Cape, 8000
Email	info@nda.co.za
Telephone	0210541788

4. Our Commitment — The Eight Conditions for Lawful Processing

We process your personal information in line with the eight conditions for lawful processing set out in POPIA:

Accountability — we take responsibility for, and can demonstrate, our compliance with POPIA.
Processing limitation — we collect and process your information lawfully and in a reasonable manner that does not infringe your privacy.
Purpose specification — we collect your information only for the specific, explicitly defined and lawful purposes set out in this Policy.
Further processing limitation — we do not process your information in a way incompatible with the purpose for which it was collected.
Information quality — we take reasonable steps to ensure your information is complete, accurate, not misleading and kept up to date.
Openness — we are transparent about what we collect and why, as set out in this Policy and our collection notices.
Security safeguards — we secure the integrity and confidentiality of your information through appropriate technical and organisational measures.
Data subject participation — we respect and facilitate your rights to access, correct and object to the processing of your information.

5. The Personal Information We Collect

To assess your eligibility for debt review and to provide debt counselling services, we may collect and process the following categories of personal information:

Identity information: full name, identity or passport number, date of birth, gender and marital status;
Contact information: residential and postal address, telephone numbers and email address;
Financial information: income, expenses, bank account and bank statement details, assets, and details of your debts, accounts and credit agreements;
Credit information: information from credit bureaux and your credit profile, used to assess over-indebtedness and to compile your repayment proposal;
Employment information: employer details, occupation and proof of income;
Interaction information: records of correspondence, telephone calls (which may be recorded), emails and your interactions with our website;
Technical information: IP address, browser type, device information and cookie data collected when you use our website (see section 11).

Special personal information: We do not generally require special personal information. Where information about your financial difficulties touches on matters such as health, we will only process it where it is necessary for the debt review, where you have consented, or where the law permits.

Children’s information: Our services are intended for persons 18 years and older. We do not knowingly collect the personal information of children except where permitted by law and with the consent of a competent person.

6. How We Collect Your Information

We collect personal information:

directly from you when you complete our online assessment or contact forms, telephone us, email us, or submit a debt review application;
from credit bureaux and credit providers, where you have authorised us to obtain your credit information for the purpose of the debt review;
from your credit providers and the relevant court or tribunal during the debt review process; and
automatically through cookies and similar technologies when you use our website.

Where it is reasonably practicable, we collect information directly from you. Where we collect it from another source (such as a credit bureau), we do so on a basis permitted by POPIA.

7. Why We Process Your Information (Purpose)

We process your personal information for the following purposes:

to assess whether you are over-indebted and whether you qualify for debt review;
to provide debt counselling and debt review services in terms of the National Credit Act, including preparing and submitting a debt restructuring proposal;
to communicate and negotiate with your credit providers and a payment distribution agency on your behalf;
to refer the matter to a magistrate’s court or the National Consumer Tribunal where required;
to comply with our legal and regulatory obligations, including those under the NCA, POPIA, FICA and the rules of the NCR;
to manage your account, process payments, and provide ongoing client support and statements;
to verify your identity and to detect and prevent fraud; and
for direct marketing of our own related services, subject to the conditions in section 10.

8. The Lawful Basis for Processing

We rely on one or more of the following lawful bases recognised by POPIA when we process your information:

Contract: the processing is necessary to conclude or perform a contract to which you are a party (your debt review mandate);
Legal obligation: the processing is necessary to comply with an obligation imposed on us by law, including the National Credit Act and FICA;
Consent: you have given your voluntary, specific and informed consent — for example, consent to obtain your credit information or to receive marketing;
Legitimate interest: the processing protects a legitimate interest of you, of NDA or of a third party (such as your credit providers), balanced against your rights.

Where we rely on your consent, you may withdraw it at any time by contacting our Information Officer. Withdrawal will not affect the lawfulness of processing carried out before withdrawal, and may mean we can no longer provide certain services.

9. Who We Share Your Information With

We treat your information as confidential and do not sell it. We may share your personal information with the following parties, only as far as is necessary for the purposes set out above:

Credit providers: your credit providers, in order to negotiate and restructure your debt;
Payment Distribution Agency: a registered Payment Distribution Agency (PDA) that collects and distributes your monthly payments to your creditors;
Credit bureaux: registered credit bureaux, to obtain your credit profile and to record your debt review status as required by the NCA;
Regulators and courts: the National Credit Regulator, the National Consumer Tribunal and the magistrate’s courts, where required for the debt review process;
Operators: trusted operators who process information on our behalf — such as IT, hosting, communication and administrative service providers — under written contracts that require them to protect your information and process it only on our instructions; and
Legal disclosures: law enforcement or other parties where we are required or permitted to do so by law.

9.1 Cross-Border Transfers

Some of our service providers may store or process information outside South Africa (for example, cloud hosting providers). Where we transfer your personal information to a foreign country, we do so only where POPIA permits — for example where the recipient is subject to laws or binding agreements that provide an adequate level of protection, where the transfer is necessary to perform your contract, or where you have consented.

10. Direct Marketing

We may contact you by electronic communication (such as email or SMS) to tell you about our services where you are an existing client and the marketing relates to similar services, or where you have consented to receive such communications.

Every marketing communication will give you a free and simple way to opt out. You may unsubscribe or object to direct marketing at any time by using the opt-out facility provided or by contacting our Information Officer, and we will stop sending you marketing communications.

11. Our Website and Cookies

When you visit our website, we may automatically collect certain technical information and use cookies and similar technologies to operate the website, remember your preferences, analyse traffic and improve your experience.

Strictly necessary cookies that are required for the website to function;
Analytics cookies that help us understand how visitors use the website; and
Functional cookies that remember your choices.

You can set your browser to refuse some or all cookies, or to alert you when cookies are being used. If you disable cookies, some parts of the website may not function properly. Our website may also contain links to third-party websites; we are not responsible for the privacy practices of those sites.

12. How We Protect Your Information

We take the security of your personal information seriously and have implemented appropriate, reasonable technical and organisational measures to safeguard it against loss, damage, unauthorised access and unlawful processing. These measures include:

secure storage of physical and electronic records;
access controls that limit access to personal information to authorised staff who need it to perform their duties;
encryption and secure transmission of sensitive information where appropriate;
confidentiality obligations on our employees and contracts with our operators requiring them to maintain equivalent safeguards; and
ongoing review of our security measures in line with generally accepted information security practices.

Where we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify you and the Information Regulator as soon as reasonably possible, as required by section 22 of POPIA.

13. How Long We Keep Your Information

We retain your personal information only for as long as is necessary to fulfil the purposes for which it was collected, or for as long as we are required to keep it by law (for example, record-keeping obligations under the NCA and FICA), or to establish, exercise or defend a legal claim.

When information is no longer required and we are not legally obliged to retain it, we will securely destroy, delete or de-identify it.

14. Your Rights as a Data Subject

Subject to POPIA, you have the following rights in relation to your personal information:

The right to be informed — to be notified that we are collecting your information, and when it has been accessed without authorisation;
The right of access — to request confirmation of whether we hold information about you and to request access to that information;
The right to correction — to request that we correct or update information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;
The right to deletion — to request that we delete or destroy information that we are no longer authorised to retain;
The right to object — to object, on reasonable grounds, to the processing of your information, and to object to direct marketing;
The right to withdraw consent — to withdraw consent where our processing is based on consent; and
The right to complain — to lodge a complaint with the Information Regulator.

To exercise any of these rights, please contact our Information Officer using the details in section 3. We may ask you to verify your identity before acting on a request. Requests for access, correction or deletion may need to be made on the prescribed POPIA forms, and we will respond within the time periods required by law (generally within 30 days). Access to certain information may be subject to the procedures and grounds for refusal set out in PAIA.

15. Access to Information (PAIA)

POPIA must be read together with the Promotion of Access to Information Act 2 of 2000 (“PAIA”). Requests for access to records held by NDA are dealt with in terms of PAIA and our PAIA Manual, which is available on request from our Information Officer.

16. Complaints to the Information Regulator

If you believe that we have not handled your personal information in accordance with POPIA, we ask that you first contact our Information Officer so that we can try to resolve the matter. You also have the right to lodge a complaint directly with the Information Regulator:

Information Regulator (South Africa)	Details
Postal address	P.O. Box 31533, Braamfontein, Johannesburg, 2017
Physical address	JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
General enquiries	enquiries@inforegulator.org.za
POPIA complaints	POPIAComplaints@inforegulator.org.za
Website	www.inforegulator.org.za

17. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or in the law. The current version will always be available on our website, and the effective date will be shown at the top of the document. We encourage you to review it periodically.

18. How to Contact Us

If you have any questions about this Policy or about how we handle your personal information, please contact our Information Officer:

National Debt Advisors	Contact Details
NCR registration number	NCRDC2351
Attention	The Information Officer
Address	1^st Floor. 9 Long Street, Cape Town, Western Cape, 8000
Email	info@nda.co.za
Telephone	0210541788
Website	www.nationaldebtadvisors.co.za

This document is a template policy. National Debt Advisors should confirm the bracketed details, have it reviewed by a qualified legal advisor, and align it with its internal data-handling practices before publication.