1.1. Flare FX (Pty) Ltd, registration number 2023/202257/07, trading as “FlareX” (“FlareX”, “we”, “us” or “our”), is a private company duly incorporated in accordance with the laws of the Republic of South Africa.
1.2. FlareX conducts regulated financial markets and financial services activities in South Africa pursuant to two distinct regulatory authorisations.
1.3. FlareX is:
1.4. Where FlareX provides any other regulated services, the processing of personal information associated with those services is also governed by this Policy, subject to the applicable legal and regulatory requirements.
2.1. FlareX FX respects the privacy of individuals and juristic persons whose personal information it processes. This Privacy Policy explains, in clear terms, what personal information we collect, why we collect it, how we use and protect it, when we disclose it, how long we retain it, when information may leave South Africa, and how a data subject may exercise rights under POPIA.
2.2. This Policy is intended to satisfy the transparency and notification requirements of POPIA and should be read together with FlareX’s agreements, notices, PAIA Manual, records-retention arrangements and other applicable policies.
3.1. This Policy applies to personal information processed by FlareX in connection with its business and services, including information relating to clients, prospective clients, authorised representatives, beneficial owners, directors and officers, employees, applicants, introducers and business partners, service providers, website users and other persons whose information FlareX lawfully receives.
3.2. It applies to information collected electronically, in paper records, through telephone or other communications, through FlareX’s website or platforms, and from third parties or public and regulatory sources.
| Term | Meaning |
|---|---|
| “Data subject” | the person to whom personal information relates. Depending on the circumstances, this may include a natural person or a juristic person. |
| “Personal information” | information relating to an identifiable, living natural person and, where applicable, an identifiable existing juristic person, including information such as identification, contact, financial, employment and transaction information. |
| “POPI Act” | means the Protection of Personal Information Act, No. 4 of 2013, as amended; |
| “Processing” | any operation or activity concerning personal information, including collection, recording, organisation, storage, updating, retrieval, use, disclosure, transfer, restriction, destruction or deletion. |
| “Responsible party” | FlareX, where it determines the purpose of and means for processing personal information. |
| “Operator” | a person or entity that processes personal information for a responsible party in terms of a mandate, without coming under the direct authority of that responsible party. |
| “Special personal information” | categories of information regulated more strictly by POPIA, including information concerning race or ethnic origin, political persuasion, religious or philosophical beliefs, trade-union membership, health or sex life, biometric information and certain criminal-behaviour information. |
| “Information Officer” | the person designated by FlareX to perform the functions required under POPIA and PAIA. |
| “Information Regulator” | the Information Regulator established under POPIA and responsible for, among other things, administering POPIA and PAIA. |
5.1. FlareX is accountable for ensuring that personal information is processed in accordance with POPIA. In particular, we apply the eight conditions for lawful processing by ensuring that personal information is processed responsibly, lawfully and reasonably; collected for specific, explicitly defined and lawful purposes; limited to information that is adequate, relevant and not excessive; kept accurate and up to date where reasonably practicable; handled transparently; protected by appropriate security safeguards; and subject to data-subject participation rights.
5.2. FlareX will maintain appropriate internal governance, policies, procedures, controls and training to support compliance. Where processing is outsourced, FlareX will use appropriate contractual and operational safeguards and require operators to maintain confidentiality and security measures appropriate to the nature of the information.
6.1. The information collected depends on the relationship with FlareX and the service or transaction involved. It may include:
7.1. FlareX may collect personal information directly from the data subject, from authorised representatives, through its website or platforms, through forms and agreements, during communications with the data subject, or from third parties where lawful and reasonably necessary for a legitimate business or regulatory purpose.
7.2. Where information is collected directly from a data subject, FlareX will, as required by POPIA, take reasonable steps to make the data subject aware of the information being collected, the purpose of collection, whether provision is voluntary or mandatory, the consequences of failing to provide it, and relevant legal or regulatory requirements. Where information is obtained from another source, FlareX will apply the requirements and exceptions applicable to indirect collection under POPIA.
8.1. FlareX processes personal information only for a specific, explicitly defined and lawful purpose related to its functions and activities. Depending on the relationship and applicable law, purposes may include:
9.1. POPIA does not permit FlareX to process personal information merely because the information is useful or commercially convenient. Processing must be justified under the applicable provisions of POPIA. Depending on the circumstances, FlareX may rely on one or more of the following grounds:
9.2. Where consent is relied upon, it will be requested in a manner that is voluntary, specific and informed, and the data subject may withdraw consent. Withdrawal of consent does not invalidate processing that was lawful before withdrawal, and withdrawal will not necessarily result in deletion where FlareX is legally required or otherwise permitted to retain the information.
10.1. FlareX recognises that POPIA imposes additional restrictions on special personal information and personal information relating to children. FlareX will not process special personal information or children’s information unless a lawful exception or authorisation applies, and the processing is necessary and proportionate to the relevant purpose.
10.2. Where special personal information is encountered as part of Client Due Diligence, AML, fraud, employment, regulatory or other processes, FlareX will apply enhanced access, security, retention and governance controls appropriate to the information. FlareX will not knowingly collect or process a child’s personal information for ordinary client onboarding unless the processing is permitted by POPIA and appropriate safeguards are in place.
11.1. FlareX will take reasonably practicable steps to ensure that personal information is complete, accurate, not misleading and updated where necessary, having regard to the purpose for which it is collected or further processed. FlareX will seek to collect information that is adequate, relevant and not excessive for the relevant purpose and will avoid using personal information for incompatible purposes unless POPIA permits further processing.
11.2. Data subjects should promptly notify FlareX if information supplied to FlareX is inaccurate, incomplete or out of date.
12.1. FlareX may disclose personal information where necessary and lawful, including to:
12.2. FlareX will not sell personal information as a general commercial practice. Where an operator processes information on FlareX’s behalf, FlareX will require appropriate confidentiality and security measures and will take reasonable steps to ensure compliance with POPIA.
13.1. Where FlareX appoints an operator to process personal information on its behalf, FlareX will enter into appropriate written arrangements requiring the operator to process information only with FlareX’s authorisation, keep the information confidential, implement appropriate security safeguards, notify FlareX of security compromises without undue delay, and comply with applicable data-protection requirements.
13.2. Where a third party determines its own purposes and means of processing, that party may be a separate responsible party rather than an operator. FlareX will assess the relationship and apply appropriate contractual and governance arrangements accordingly.
14.1. FlareX takes appropriate, reasonable technical and organisational measures to protect personal information
against loss, damage, unauthorised destruction, unlawful access, unauthorised processing and other
foreseeable risks. Measures may include:
14.2. No method of transmission or storage can be guaranteed to be completely secure. FlareX will nevertheless continually assess and improve safeguards in response to changes in technology, threats, operational risks and identified deficiencies.
15.1. If FlareX has reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, FlareX will assess and manage the incident under its incident-response procedures and POPIA. Where section 22 of POPIA applies, FlareX will notify the Information Regulator and the affected data subject(s) as soon as reasonably possible after discovery of the compromise.
15.2. A notification may include the nature of the compromise, the personal information reasonably believed to have been accessed or acquired, the identity of the unauthorised person where known, the measures taken or proposed to address the compromise, and measures recommended to data subjects to mitigate possible adverse consequences.
16.1. Personal information may be processed or stored outside South Africa where FlareX uses international service providers, group entities or other service arrangements. FlareX will only transfer personal information across borders in circumstances permitted by section 72 of POPIA, including where the recipient is subject to an adequate level of protection, the relevant data subject has consented after being informed of the transfer where consent is relied upon, the transfer is necessary for a contract, or another statutory exception applies.
16.2. Where appropriate, FlareX will use contractual, technical and organisational safeguards to protect information transferred outside South Africa. Data subjects may contact the Information Officer for information about material categories of international recipients relevant to their relationship with FlareX.
17.1. FlareX will comply with POPIA requirements applicable to direct marketing. Electronic direct marketing, including marketing by email, SMS, messaging applications or other electronic communications, will only be undertaken where a lawful basis under section 69 applies.
17.2. Where consent is required, FlareX will obtain it in an accessible manner and will provide a simple and free opportunity to withdraw or object. Where FlareX relies on the existing-customer exception in section 69, it will limit marketing to its own similar products or services and provide the required opportunity to object at the time information is collected and in each marketing communication.
17.3. A data subject may opt out of marketing at any time by using the unsubscribe mechanism provided or contacting the Information Officer. An opt-out from marketing does not prevent FlareX from sending service, security, contractual, regulatory or other non-marketing communications that FlareX is required or permitted to send.
18.1. FlareX’s website and digital platforms may use cookies, device identifiers, log files, IP addresses and similar technologies for security, functionality, analytics, performance and, where applicable, marketing. Where these technologies involve personal information, FlareX will process the information in accordance with POPIA and any applicable cookie notice or consent mechanism.
18.2. Users can manage certain cookie settings through their browser or device. Disabling certain cookies may affect the functionality or security of parts of the website.
19.1. FlareX may use automated tools for identity verification, sanctions screening, fraud detection, transaction monitoring, cybersecurity, risk assessment and operational processes. Where a decision contemplated by section 71 of POPIA is based solely on automated processing and has legal consequences for a data subject or affects the data subject to a substantial degree, FlareX will apply the safeguards and exceptions required by POPIA.
19.2. Where applicable, those safeguards may include measures to allow an opportunity for human intervention, representation by the data subject and a mechanism to challenge the outcome, subject to legal, security and regulatory constraints.
20.1. FlareX will retain personal information only for as long as necessary for the purpose for which it was collected or subsequently processed, or for as long as required or permitted by applicable law, regulation, contractual obligations, regulatory requirements, audit requirements, dispute resolution or the establishment, exercise or defence of legal claims.
20.2. Retention periods may therefore differ depending on the type of information and the applicable legal or regulatory obligation. When information is no longer required, and there is no lawful basis for continued retention, FlareX will securely delete, destroy or de-identify it in a manner that prevents reconstruction in accordance with its records-retention procedures.
21.1. Subject to the conditions, exceptions and limitations in POPIA and other applicable law, a data subject may exercise rights including:
21.2. Requests should be made to the Information Officer using the contact details in section 24. FlareX may require sufficient information to verify the identity and authority of the requester. Access requests are subject to POPIA and PAIA procedures, applicable exemptions and any lawful fees.
22.1. FlareX will maintain procedures for receiving, recording, verifying, assessing and responding to requests and complaints concerning personal information. Requests will be handled within the timeframes and in accordance with the procedures prescribed by applicable law.
22.2. Where FlareX cannot comply with a request, it will provide the data subject with an appropriate explanation to the extent required by law. Nothing in this Policy limits a data subject’s statutory rights or the powers of the Information Regulator.
23.1. Requests for access to records, including requests for access to personal information contemplated by POPIA, may be subject to PAIA and FlareX’s PAIA Manual. The PAIA Manual contains information about FlareX’s records, the procedure for making requests and the applicable statutory requirements. The latest version should be made available to requesters in accordance with applicable law.
24.1. FlareX may amend this Policy from time to time to reflect changes in legislation, regulatory requirements, technology, business activities, processing operations, security measures or best practice. Material changes will be communicated through appropriate channels, and the latest approved version will be made available on the FlareX website or otherwise on request.
24.2. This Policy will be reviewed at least annually and whenever there is a material change to the way FlareX collects, uses, stores, discloses or transfers personal information.
25.1. The Information Officer is responsible for supporting FlareX’s compliance with POPIA and PAIA and for handling privacy-related enquiries and requests.
| Information Officer | Matthew Morgan |
| Physical address | Sasol Building 50 Katharine Street Sandton Johannesburg 2196 |
| Matthew@flarex.com | |
| For the attention of | Matthew Morgan |
| Privacy requests | Requests, corrections, objections, consent withdrawals and privacy complaints may be submitted to the Information Officer using the above email address |
26.1. A data subject who believes that FlareX has infringed their rights under POPIA may lodge a complaint with the Information Regulator in accordance with the applicable complaint procedure. The Regulator’s current contact details and electronic services should be obtained from its official website.
26.2. Information Regulator of South Africa
| Document owner | Information Officer |
| Version | 2.0 |
| Effective date | 23 September 2026 |
| Review frequency | At least annually and sooner there is a material legal, regulatory, operational or technology change |
| Primary legislation | Protection of Personal Information Act 4 of 2013 (POPIA) |
| Approved by | Chief Compliance Officer |