Privacy Policy

1. Who We Are

Vehicle Value (“we”, “us”, “our”) is the trading name of Vehicle Value Financing (Pty) Ltd, a private company incorporated in South Africa (Registration No. 2024/584345/07). Vehicle Value Financing (Pty) Ltd acts as an authorised representative of IDA Risk Management (Pty) Ltd (FSP No. 28260), a Financial Services Provider licensed by the Financial Sector Conduct Authority (FSCA) under the FAIS Act 37 of 2002.

We act as an intermediary between applicants and registered credit providers. We do not provide credit directly.

Responsible Party / Information Officer:
Leilani Duncan
Vehicle Value Financing (Pty) Ltd
leilani@autoimiddelburg.co.za
179 Pongola Drive, Aerorand, Middelburg, Mpumalanga, 1050

2. Why We Collect Your Personal Information

We collect and process your personal information for the following specific, explicit and legitimate purposes, as required by section 13 of the Protection of Personal Information Act 4 of 2013 (“POPIA”):

• To receive, assess and process your finance application;
• To verify your identity in compliance with the Financial Intelligence Centre Act (FICA);
• To match your application with suitable credit providers in our financier network;
• To communicate with you regarding the progress of your application;
• To comply with our legal obligations under the National Credit Act 34 of 2005 (NCA), FAIS Act 37 of 2002, and POPIA;
• To prevent and detect fraud, money laundering and identity theft;
• To maintain records of transactions as required by law (minimum 5 years under NCA).

We will not process your personal information for any other purpose without your additional consent, unless a different lawful basis applies under POPIA section 11.

3. Categories of Personal Information We Collect

Category	Specific Information
Identity	Full name, South African ID number
Contact details	Email address, phone number, residential address
Financial	Gross monthly income, employment status, employer name, loan amount requested, asset type, estimated asset value, settlement amount outstanding, vehicle VIN number
Supporting documents	Certified ID copy, 3 months’ bank statements, latest payslip, proof of residential address
Account credentials	Email address and hashed password for your client dashboard account
Usage data	Log data, session identifiers (no tracking cookies or analytics beyond server logs)

South African ID numbers and bank statements are classified as special personal information under POPIA and are subject to heightened protection. We collect and process this information only with your explicit consent and only to the extent required for your finance application.

4. Lawful Basis for Processing

We rely on the following lawful grounds under POPIA section 11:

• Consent (s11(1)(a)): obtained at registration by your deliberate tick of the POPIA consent checkbox. You may withdraw consent at any time (see section 9).
• Contractual necessity (s11(1)(b)): processing required to perform the service you have requested.
• Legal obligation (s11(1)(c)): processing required to comply with FICA, NCA, FAIS and tax legislation.
• Legitimate interest (s11(1)(f)): fraud prevention and security monitoring, balanced against your rights and interests.

5. Who We Share Your Information With

We share your personal information only as necessary and on a need-to-know basis. Categories of recipients include:

• Credit providers and financiers in our network, for the purpose of evaluating and responding to your application. These are registered credit providers under the NCA.
• Our technology service providers who host or maintain this website (data processing agreements in place).
• Regulatory authorities such as the FSCA, NCR, SARS, or SAPS, where required by law or court order.

We do not sell, rent or trade your personal information to any third party for marketing purposes. We do not share your information with unrelated third parties without your additional consent.

If we share your information with a credit provider located outside South Africa, we will ensure an equivalent level of protection applies, as required by POPIA section 72.

6. Retention and Deletion

We retain your personal information for as long as necessary to fulfil the purpose for which it was collected, or as required by law:

• Active clients: for the duration of the relationship and until your account is closed.
• Completed or declined applications: minimum 5 years from the date of conclusion or rejection, as required by the NCA and FAIS record-keeping rules.
• FICA documents: minimum 5 years after the end of the business relationship, as required by FICA.
• Leads (callback requests): up to 12 months, or until the purpose is fulfilled.

After the retention period expires, personal information is securely deleted or anonymised.

7. Security Measures

We implement reasonable technical and organisational measures to protect your personal information against loss, damage, unauthorised access, alteration or disclosure. These include:

• Passwords are stored as one-way bcrypt hashes — they are never readable by us or any third party.
• All uploaded documents are stored outside the public web root and blocked from direct browser access.
• All forms use CSRF (Cross-Site Request Forgery) protection tokens.
• Access to the admin/CRM system is restricted to authorised personnel only.
• HTTPS is enforced in production.

Despite these measures, no system is completely immune. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the Information Regulator as required by POPIA section 22 within the prescribed time period.

8. Your Rights as a Data Subject

Under POPIA, you have the following rights, which you may exercise by contacting us at leilani@autoimiddelburg.co.za:

• Right of access (POPIA s23): to request a description of the personal information we hold about you and to obtain a copy of it.
• Right to correction or deletion (POPIA s24): to request that inaccurate, incomplete, misleading or out-of-date personal information be corrected or deleted.
• Right to object (POPIA s11(3)): to object to the processing of your personal information on grounds relating to your particular situation (subject to overriding legal requirements).
• Right to withdraw consent: to withdraw consent at any time. Note that withdrawing consent may make it impossible for us to continue processing your application.
• Right not to be subject to automated decision-making that produces legal effects, without human review.

We will respond to access and correction requests within 30 days. We may charge a prescribed fee for access requests where permitted by the Promotion of Access to Information Act (PAIA).

9. Withdrawing Consent

You may withdraw your POPIA consent at any time by sending a written request to leilani@autoimiddelburg.co.za. Please note:

• Withdrawing consent does not affect the lawfulness of processing that occurred before withdrawal.
• Where we are processing your information on grounds other than consent (such as legal obligation), withdrawal of consent does not require us to delete that information.
• Your client dashboard account will be closed and your application records will be retained for the statutory minimum period.

10. Cookies and Tracking

This website uses session cookies only, which are strictly necessary for the operation of the login and application functionality. We do not use advertising cookies, tracking pixels, or third-party analytics. Session cookies expire when you close your browser.

11. Children

Our services are intended for adults aged 18 and over. We do not knowingly collect personal information from persons under 18. If you believe we have inadvertently collected such information, please contact us immediately and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will post the updated version on this page with a new effective date. Material changes will be communicated to registered users by email. Your continued use of our services after the effective date constitutes acceptance of the revised policy.

13. PAIA Manual

Our Promotion of Access to Information Act (PAIA) manual is available on request from our Information Officer at leilani@autoimiddelburg.co.za.

14. Complaints

If you believe we have handled your personal information in violation of POPIA, you have the right to lodge a complaint with the Information Regulator of South Africa:

• Website: inforegulator.org.za
• Email: inforeg@justice.gov.za (general enquiries) or PAIAComplaints@inforegulator.org.za (PAIA complaints) / POPIAComplaints@inforegulator.org.za (POPIA complaints)
• Tel: 010 023 5200
• Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

We encourage you to contact us first so we may attempt to resolve your concern before lodging a formal complaint.