Privacy Notice
How Africa Markets collects, uses, shares and protects your personal information under POPIA and GDPR.
This notice explains how Africa Markets processes personal information when you visit africamarkets.com or pre-register for early access. It is written to meet the Protection of Personal Information Act, 2013 (POPIA) and, for visitors in the European Economic Area and United Kingdom, the GDPR and UK GDPR.
1. Responsible party
The responsible party (data controller) is Africa Markets, operated in partnership with Capital Engine®. Contact our Information Officer at [email protected] or [email protected].
2. What we collect
When you pre-register
| Information | Examples | Why |
|---|---|---|
| Identity and contact | Name, email address, mobile number, country, organisation | To create and verify your early-access registration and contact you about it |
| Role and interests | Investor, company, bank/broker or law firm; investment or fundraising interest | To tailor the onboarding path and communications |
| Verification data | One-time codes sent by SMS and email, timestamps, verification status | To confirm you control the phone number and email address you gave us |
| Consent records | The version of this notice you accepted and when | To evidence your consent (POPIA s.11) |
Automatically, when you browse
- Technical data: IP address (stored only as a one-way hash), browser and device type, referring page, marketing tags (UTM parameters).
- Usage data: pages viewed and steps completed in the pre-registration form.
- Cookies and similar technologies — see section 8.
We do not intentionally collect special personal information (for example, race, health or religious beliefs) or information about children.
3. Why we process it and on what basis
| Purpose | Legal basis (POPIA s.11 / GDPR art. 6) |
|---|---|
| Registering you for early access and verifying your contact details | Performance of a contract / steps at your request |
| Sending you updates about the platform launch and your registration | Consent (you may withdraw at any time) |
| Understanding how the website is used and improving it | Legitimate interests; analytics cookies only with your consent |
| Preventing fraud, abuse and automated sign-ups | Legitimate interests |
| Meeting legal and regulatory obligations, including future KYC and anti-money-laundering requirements | Legal obligation |
4. Who we share it with
We share personal information only with:
- Service providers (operators) who process it on our instructions under written agreements: cloud hosting, email and SMS delivery (e.g. Twilio), bot protection (e.g. Cloudflare), analytics (e.g. Google Tag Manager, Microsoft Clarity — only after you accept analytics cookies).
- Capital Engine®, our technology partner, for operating the platform.
- Regulators, law-enforcement or courts where the law requires it.
- A successor if our business is transferred, subject to this notice.
We do not sell personal information.
5. International transfers
Our servers are currently hosted in the United States. Personal information may therefore be transferred outside South Africa (POPIA s.72) and outside the EEA/UK. We rely on contractual protections with our providers that impose obligations substantially similar to POPIA and, for EEA/UK data, the applicable standard contractual clauses.
6. How long we keep it
- Pre-registration records: until you ask us to delete them, or 24 months after the platform launches if you have not opened an account, whichever is earlier.
- Unverified registrations: deleted 90 days after the verification link expires.
- Consent and verification logs: as long as the registration exists, plus the period required to evidence compliance.
- Analytics events: 26 months, IP addresses hashed at collection.
7. Security
We use encryption in transit (TLS), hashed storage of IP addresses, rate limiting, access controls limited to staff who need it, and audited hosting. No system is perfectly secure; if we become aware of a security compromise affecting your information we will notify you and the Information Regulator as POPIA s.22 requires.
8. Cookies
We use two kinds of cookies:
- Essential — needed to run the site (session, security, your cookie choice). These do not require consent.
- Analytics — Google Tag Manager and Microsoft Clarity, which help us understand how the site is used. These load only if you choose "Accept analytics" in the banner. You can change your choice at any time by clearing cookies for this site.
9. Your rights
Under POPIA (and the GDPR where it applies) you may:
- ask what personal information we hold about you and receive a copy;
- ask us to correct or delete it;
- object to processing, or withdraw consent for marketing at any time (every email has an unsubscribe link);
- ask us not to send you direct marketing;
- lodge a complaint with the Information Regulator (South Africa) — inforeg.org.za, [email protected] — or, for EEA/UK residents, your local supervisory authority.
To exercise a right, email [email protected]. We may need to verify your identity first and will respond within 30 days. Our PAIA and POPIA manual is available on request.
10. Automated decisions
We do not make decisions with legal or similarly significant effects about you based solely on automated processing. Bot-protection tools may block automated submissions.
11. Changes
We will post any changes here with a new effective date. Where a change materially affects how we use your information we will also email registered users.