How It Works For Shoppers For Merchants Products FAQ Blog
Sign Up Free Merchant Demo
Legal

Privacy
Policy

Your privacy matters to us. This policy explains how DuelaPay collects, uses, and protects your personal information under the Protection of Personal Information Act (POPIA).

Last updated: 1 January 2026

1. Who We Are

DuelaPay (Pty) Ltd ("DuelaPay", "we", "us", "our") is a South African company that operates the DuelaPay digital lay-by payment platform. We are the Responsible Party for the personal information we collect and process, as defined under the Protection of Personal Information Act, 4 of 2013 ("POPIA").

Information Officer: The DuelaPay Information Officer is responsible for ensuring compliance with POPIA. You may contact the Information Officer at:

2. What Personal Information We Collect

We collect personal information that you provide directly to us and information generated through your use of the Platform:

  • Identity information: First name, last name, South African identity number (where required for verification).
  • Contact information: Email address, South African mobile phone number.
  • Account information: Username, account preferences, password (stored encrypted).
  • Payment information: Debit/credit card details (tokenised by our PCI-DSS compliant payment processor — DuelaPay does not store full card numbers), bank account details for EFT payments.
  • Transaction information: Lay-by history, payment records, product details, merchant records, installment schedules.
  • Device and usage information: IP address, browser type, operating system, pages visited, session duration, referral source.
  • Location information: Approximate location derived from IP address or, with your permission, precise location from your device.
  • Communication records: Records of your communications with our support team via email, WhatsApp, or in-app chat.

3. Why We Collect It — Lawful Basis Under POPIA

Under POPIA, we must have a lawful basis for processing your personal information. We rely on the following grounds:

  • Contract performance: Processing necessary to provide you with the DuelaPay lay-by service, manage your account, process your payments, and communicate about your lay-bys.
  • Consent: For marketing communications, optional analytics tracking, and certain cookies. You may withdraw consent at any time.
  • Legitimate interest: For fraud prevention, platform security, and improving our services — where our interests do not override your rights and freedoms.
  • Legal obligation: For compliance with FICA, tax obligations, and applicable South African financial regulations.

4. How We Use Your Personal Information

We use your personal information to:

  • Create and manage your DuelaPay account.
  • Process lay-by transactions, payments, deposits, and installments.
  • Communicate with you about your account, lay-bys, and payment schedules via SMS, email, and in-app notifications.
  • Calculate and update your DuelaPay Shopper Rating.
  • Prevent fraud, money laundering, and other illegal activities, including compliance with FICA obligations.
  • Improve the DuelaPay Platform, conduct analytics, and develop new features.
  • Respond to your support requests and complaints.
  • Send you marketing communications about DuelaPay products and services (only if you have opted in, or if we have a legitimate interest basis and you have not opted out).
  • Comply with our legal and regulatory obligations.

5. Sharing With Third Parties

We do not sell your personal information. We may share your information with the following categories of third parties, only to the extent necessary for the stated purpose:

  • Partner merchants: We share relevant transaction details (name, product, payment status) with the merchant from whom you are making a lay-by purchase. Merchants are bound by confidentiality obligations.
  • Payment processors: We use PCI-DSS compliant third-party payment processors to process card and EFT payments. These processors handle payment data under strict security standards and are contractually bound to protect your information.
  • SMS and communication providers: To deliver payment reminders, OTPs, and notifications to your mobile number.
  • Analytics providers: We use analytics tools (including potentially Google Analytics) to understand how the Platform is used. Analytics data is aggregated and anonymised where possible.
  • Legal and regulatory authorities: We may disclose information to law enforcement, regulatory bodies, or other government authorities where required by law, court order, or to protect the rights and safety of DuelaPay or others.
  • Service providers: Cloud hosting, IT infrastructure, customer support tools — all bound by data processing agreements ensuring POPIA compliance.

All third parties with whom we share personal information are required to handle it securely, use it only for the specified purpose, and comply with POPIA requirements.

6. Data Retention

We retain your personal information for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, and reporting requirements. Specifically:

  • Active accounts: We retain your information for the duration of your account and for 5 years after account closure, in compliance with FICA requirements for financial records.
  • Transaction records: Lay-by and payment records are retained for 5 years from the date of the last transaction, as required by South African tax and financial regulations.
  • Marketing consent: Retained until you withdraw consent.
  • Support communications: Retained for 3 years for quality assurance and dispute resolution purposes.

After the applicable retention period, we securely delete or anonymise your personal information.

7. Your POPIA Rights

As a data subject under POPIA, you have the following rights:

Right of Access

Request a copy of the personal information we hold about you.

Right to Correction

Request correction of inaccurate or incomplete personal information.

Right to Deletion

Request deletion of your personal information, subject to our legal retention obligations.

Right to Object

Object to the processing of your personal information on the basis of legitimate interest, including for direct marketing.

Right to Restrict

Request that we restrict the processing of your information in certain circumstances.

Right to Complain

Lodge a complaint with the Information Regulator of South Africa if you believe we have violated your rights.

To exercise any of these rights, contact our Information Officer at privacy@duelapay.com. We will respond within 30 days as required by POPIA.

You may also contact the Information Regulator of South Africa at www.inforegulator.org.za.

8. Cookies

We use cookies and similar tracking technologies to operate the Platform and improve your experience. Cookies are small text files stored on your device when you visit our website.

We use strictly necessary cookies (which cannot be disabled as they are essential for Platform functionality), as well as optional analytics and marketing cookies which require your consent.

For full details, including a cookie table and instructions on managing your cookie preferences, please read our Cookie Policy.

9. Security Measures

DuelaPay takes the security of your personal information seriously. We implement the following technical and organisational security measures:

  • 256-bit SSL/TLS encryption for all data in transit between your device and our servers.
  • Encryption at rest for all stored personal information and payment data.
  • PCI-DSS compliance for all payment card processing. DuelaPay does not store, process, or transmit full card numbers on its own infrastructure — this is handled by our PCI-DSS certified payment processor.
  • Multi-factor authentication for user accounts, including OTP verification for high-risk actions.
  • Access controls limiting access to personal information to authorised DuelaPay employees and contractors on a need-to-know basis.
  • Regular security audits and penetration testing by qualified third-party security professionals.
  • Incident response plan to detect, respond to, and notify users of data breaches as required by POPIA (within 72 hours of becoming aware of a breach).

Despite these measures, no system is completely secure. If you suspect that your account has been compromised, contact us immediately at security@duelapay.com.

10. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. We will notify you of material changes via email or in-app notification at least 14 days before the changes take effect.

The "last updated" date at the top of this policy reflects when the most recent changes were made. Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the revised policy.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

11. Contact the Information Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal information, please contact our Information Officer:

  • Information Officer: DuelaPay (Pty) Ltd
  • Email: privacy@duelapay.com
  • Subject line: POPIA — Privacy Enquiry / Data Subject Request
  • Response time: Within 30 days of receiving your request

If you are unsatisfied with our response, you have the right to escalate your complaint to the Information Regulator of South Africa: