Privacy Notice

This notice explains how Africa Markets processes personal information when you visit africamarkets.com, pre-register for early access, open an investor account, verify your identity, use the trading demonstration, or indicate interest in our seed round. It is written to meet the Protection of Personal Information Act, 2013 (POPIA) and, for people in the European Economic Area and United Kingdom, the GDPR and UK GDPR.

1. Responsible party

The responsible party (data controller) is Africa Markets, operated in partnership with Capital Engine®. Contact our Information Officer at [email protected].

2. What we collect

When you pre-register

When you have an investor account

When you verify your identity

Identity verification is carried out on our behalf by Sumsub (Sum and Substance Ltd). Sumsub collects, directly from you:

• a photograph of your identity document and the details on it (name, date of birth, nationality, document number and expiry);
• a proof-of-address document (for example, a utility bill or bank statement) and the address on it;
• a live selfie and a liveness check, which compare your face with the document photo — this is biometric information;
• technical data about the device and session used.

Sumsub also screens your name against sanctions, politically-exposed-person and adverse-media lists. Africa Markets receives and stores only the outcome: your Sumsub applicant reference, your verification and screening status, the reasons a check needs a retry or was declined, any risk labels from screening, and the dates of those decisions. We do not store copies of your documents or selfie on our own systems.

When you indicate interest in the seed round

Name, email address, phone number (optional), country of residence, investor type, intended investment range, any comments you add, and the time you confirmed you are an accredited or qualified investor.

When you subscribe to the newsletter

Your email address, how you subscribed (the form on our website, or the box at sign-up), and when you confirmed, received an issue or unsubscribed. We do not record your IP address for this.

When you use the in-app help assistant

The help assistant sends your question and account context (your getting-started step, verification status and demo balances) to xAI to generate an answer. Conversations are kept for 90 days to improve the service.

Automatically, when you browse

• Technical data: IP address (stored only as a one-way hash), browser and device type, referring page, marketing tags (UTM parameters).
• Usage data: pages viewed and steps completed in our forms.
• Cookies and similar technologies — see section 8.

3. Special personal information

Your face geometry from the selfie and liveness check is biometric information, which POPIA treats as special personal information (s.26) and the GDPR treats as special-category data (art. 9). It is processed only to verify your identity and prevent fraud, only with your consent (given when you start verification), and to comply with anti-money-laundering obligations (POPIA s.27). You can withdraw consent by not completing verification or by asking us to delete your verification record, but you will then not be able to use the features that require it.

We do not otherwise intentionally collect special personal information (for example, race, health or religious beliefs), or any information about children.

4. Why we process it and on what basis

5. Who we share it with

We share personal information only with:

• Service providers (operators) who process it on our instructions under written agreements: cloud hosting; identity verification and screening (Sumsub); email delivery (Resend); SMS delivery and phone verification (Twilio); bot protection (Cloudflare); analytics (Google Tag Manager, Microsoft Clarity — only after you accept analytics cookies); answers from the in-app help assistant (xAI).
• Capital Engine®, our technology partner, for operating the platform.
• Our partner financial services providers, where you ask to invest or trade through them and they need the information to onboard you.
• Regulators, law-enforcement or courts where the law requires it, including reports required under anti-money-laundering law.
• A successor if our business is transferred, subject to this notice.

We do not sell personal information.

6. International transfers

Our servers are hosted in the United States, and some of our service providers (including Sumsub) process information in other countries, including the United Kingdom and the European Union. Personal information may therefore be transferred outside South Africa (POPIA s.72) and outside the EEA/UK. We rely on contractual protections with our providers that impose obligations substantially similar to POPIA and, for EEA/UK data, the applicable standard contractual clauses or adequacy decisions.

7. How long we keep it

• Pre-registration records: until you ask us to delete them, or 24 months after the platform launches if you have not opened an account, whichever is earlier.
• Unverified registrations: deleted 90 days after the verification link expires.
• Account and trading demonstration records: while your account is open, and for up to 12 months after it is closed.
• Identity verification and screening records: for the period anti-money-laundering law requires — under South Africa's Financial Intelligence Centre Act, at least five years after the business relationship ends — at Sumsub and in our own outcome records.
• Seed round indications of interest: up to 24 months after the round closes, unless you become an investor, in which case for as long as the law requires us to keep investor records.
• Consent and verification logs: as long as the related record exists, plus the period required to evidence compliance.
• Analytics events: 26 months, IP addresses hashed at collection.
• Help assistant conversations: 90 days.
• Newsletter subscriptions: while you are subscribed. After you unsubscribe we keep only your email address and the date, so that we never send you the newsletter again; ask us and we will delete that too.

8. Cookies

We use two kinds of cookies:

• Essential — needed to run the site (session, sign-in, security, your cookie choice). These do not require consent. Identity verification also uses cookies set by Sumsub while you complete it.
• Analytics — Google Tag Manager and Microsoft Clarity, which help us understand how the site is used. These load only if you choose "Accept analytics" in the banner. You can change your choice at any time by clearing cookies for this site.

9. Security

We use encryption in transit (TLS), hashed passwords and IP addresses, signed and verified messages from our identity-verification provider, rate limiting, role-based access limited to staff who need it, and audited hosting. No system is perfectly secure; if we become aware of a security compromise affecting your information we will notify you and the Information Regulator as POPIA s.22 requires.

10. Your rights

Under POPIA (and the GDPR where it applies) you may:

• ask what personal information we hold about you and receive a copy;
• ask us to correct or delete it, subject to records we must keep by law (for example, anti-money-laundering records);
• object to processing, or withdraw consent at any time (every marketing email has an unsubscribe link);
• ask us not to send you direct marketing;
• lodge a complaint with the Information Regulator (South Africa) — inforeg.org.za, [email protected] — or, for EEA/UK residents, your local supervisory authority.

To exercise a right, email [email protected]. We may need to verify your identity first and will respond within 30 days. Our PAIA and POPIA manual is available on request.

11. Automated decisions

Identity verification uses automated document and face matching, and screening uses automated list matching. These checks can flag a result for review by a person; we do not refuse you solely on the basis of automated processing without human involvement where the law requires it. You can ask us to reconsider a verification decision and to explain the logic involved, within the limits anti-money-laundering law allows. Bot-protection tools may block automated form submissions.

12. Changes

We will post any changes here with a new effective date. Where a change materially affects how we use your information we will also email registered users.