How we collect, use, store and share your personal information when you use Instant Fund’s free loan-matching service. Written in plain English. Designed to satisfy Section 18 of the Protection of Personal Information Act.
Version 1.0
Last updated: 22 June 2026
Governs: www.instantfund.co.za
This Privacy Policy explains how Instant Fund (“we”, “us”, “our”) collects, uses, stores and shares your personal information when you use the website at www.instantfund.co.za and our loan-matching service (“the Service”).
We have written it to satisfy Section 18 of the Protection of Personal Information Act 4 of 2013 (“POPIA”), which is the law that gives you the right to know how your information is being handled by South African businesses.
It sits alongside our Terms of Use. The Terms set out the rules for using the Service. This policy tells you what we do with the data you give us when you do.
If anything in this policy is unclear, please contact our Information Officer using the details in section 02 or section 15.
Instant Fund is the operating brand of an independent online loan-matching and comparison service in South Africa. We are the responsible party as defined in POPIA. Our head office is in Sandton, Johannesburg.
Responsibility for our POPIA compliance sits with the InstantFund management team.
Registration of a designated Information Officer with the Information Regulator is in progress; until that is completed, the contact details below are your point of contact for any privacy question, access request, correction request or complaint.
We collect three categories of information from you. The table below covers what we collect and where it comes from.
| Category | What we collect |
|---|---|
| Identity & contact | Full name, South African ID number, date of birth, residential address, email address, cellphone number. |
| Financial & employment | Employment status, employer name, monthly income, payslip information, bank account details (account number, branch code, bank name), copies of recent bank statements. |
| Application context | The loan amount and term you are requesting, the date and time you applied, the form version you submitted, the consent checkboxes you ticked. |
| Uploaded documents | Copies of your SA ID (book or card), recent payslips or three months of bank statements, and a bank-stamped account confirmation if you supply one. |
| Verification information | Results from identity verification and fraud-screening checks run by our verification providers against the details you submit. |
| Technical information | IP address, browser type and version, device type, operating system, pages visited, referring URL, and timestamps. Collected automatically when you use the website. |
| Communications | Any correspondence you send to us (email, contact form, WhatsApp, phone calls), and any notes our team makes when responding. |
We do not knowingly collect special personal information as defined in POPIA (such as health, religious belief, race, political views).
If any such information is contained in a document you upload — for example, on a bank statement — we treat it as ordinary supporting evidence and do not process it for any other purpose.
We collect your information for specific, named purposes. We do not use it for anything else without coming back to you first.
POPIA requires us to have a lawful basis for every processing activity. We rely on the following, depending on the purpose:
You can withdraw your consent at any time by emailing [email protected].
Withdrawal does not affect processing that already happened lawfully — for example, if a lender has already approved your application and paid out funds, that loan agreement is between you and that lender and continues to be governed by it.
We share your information only with the parties below, only for the purposes explained, and only to the extent necessary.
When you submit an application, we share it with one or more NCR-registered South African credit providers on our partner panel so they can consider whether to make you a loan offer.
Each panel lender is bound by its own POPIA obligations as an independent responsible party, and is contractually obliged to process your information only for the purpose of evaluating and, where applicable, funding your application.
If you would like the current list of panel lenders, contact our Information Officer.
We use a small number of third-party operators to run the Service. They process information on our behalf, under written agreements that require them to keep your information confidential and to use it only for the purpose we instruct.
If you accept a lender’s offer, that lender will report your loan and your payment behaviour to the major South African credit bureaus, as every NCR-registered credit provider is required to do.
We ourselves do not report to bureaus, because we are not the lender.
Where we have reasonable grounds to suspect fraud, we may share information with the South African Fraud Prevention Service (SAFPS), the South African Police Service, or any other authority entitled to it under South African law.
We may disclose information where required to do so by a lawful order, subpoena, or formal request from a regulator such as the Information Regulator or the NCR.
We do not sell your personal information to third parties for marketing. We do not pass your information to lenders outside our vetted panel. We do not list-broker your contact details.
Some of the service providers we use are based outside South Africa or process data in data centres outside South Africa. Where that is the case, Section 72 of POPIA requires us to ensure your information continues to receive an adequate level of protection.
We meet this obligation by contracting only with providers that are either (a) located in jurisdictions whose laws give effect to similar information-protection principles to POPIA, or (b) bound by written contracts that impose POPIA-equivalent obligations on them as our operators.
If you would like a current list of operators that process your information outside South Africa, and the jurisdictions involved, contact our Information Officer.
We keep your information only for as long as we need it for the purpose we collected it. After that, we delete or anonymise it.
| Information type | Retention period |
|---|---|
| Applications that resulted in a signed loan | Kept for 5 years after the loan is settled, to comply with FICA and NCA record-keeping obligations. |
| Applications that were declined or abandoned | Kept for 12 months from the application date, then deleted. Aggregated, anonymised statistics may be retained longer. |
| Email and support correspondence | Kept for 3 years from the last reply, unless you ask us to delete it sooner. |
| Website analytics & technical logs | Identifiable logs kept for 30 days. Aggregated analytics kept indefinitely. |
| Consent records (timestamp, form version) | Kept for the life of the related application record, plus the regulatory retention period that applies to it. |
Retention is enforced by a scheduled deletion task that runs monthly. If you believe your information has been kept beyond these periods, please contact our Information Officer.
We use cookies and similar technologies on the website. Some are strictly necessary; others are optional and only run if you agree on the cookie banner.
You can change your cookie preferences at any time by clicking the “Cookie settings” link in the website footer. You can also block cookies directly in your browser, though doing so may break parts of the site.
POPIA requires us to take “appropriate, reasonable technical and organisational measures” to keep your information safe. In practice that means:
No system is perfect. If you believe your information has been involved in a security incident, please email [email protected] so we can investigate.
POPIA gives you specific rights over your personal information. They are:
To exercise any of these rights, email [email protected]. We will respond within 30 days.
We may ask you to verify your identity before we act on the request, to make sure we are not handing your information to someone else.
We send transactional communications about your application (received, in review, offer available, declined) as part of the Service. These are not direct marketing.
We will only send you direct marketing — for example, an email about a new product on the panel — if you have opted in, or if you are an existing user and the message is about a similar service to one you have already used (as Section 69 of POPIA allows).
Every marketing message includes a one-click unsubscribe link. You can also email [email protected] to opt out of all marketing at any time.
The Service is not available to anyone under 18. We do not knowingly collect personal information from children. If we discover that we have collected information from a child without verified parental consent, we will delete it.
We may update this policy from time to time. The “Last updated” date at the top of the page changes whenever we do.
If we make a material change — for example, adding a new category of data we collect, or a new third party we share with — we will post a notice on the home page for at least 14 days before the change takes effect, and email you if you have an active application with us.
We keep previous versions on file. If you would like to see an earlier version, contact the Information Officer.
If you have any question about this policy, or you want to exercise one of your POPIA rights, please contact our Information Officer first. We will acknowledge your request within 5 working days and respond fully within 30 days.
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Regulator of South Africa:
If your complaint relates to one of the matched lenders rather than to us, the Credit Ombud handles those: creditombud.org.za.
Email our privacy team and a person will answer.