1. Roles Under POPIA: Responsible Party & Operator
Depending on the context, personal information is processed under distinct legal capacities:
(a) For Borrower and Lending Portfolio Data: The subscribing customer organisation is the Responsible Party that determines the purpose and means of collecting and processing borrower personal information. Circle Core Technologies (Pty) Ltd acts as an Operator, processing that data strictly on the instructions of the organisation to provide the software platform.
(b) For Account, Billing, and Platform Operations Data: Circle Core Technologies (Pty) Ltd acts as a Responsible Party regarding information collected from organisation account holders, billing administrators, and website visitors to manage customer relationships, process subscriptions, maintain cybersecurity, and comply with legal requirements.
2. Information Processed in the Lending Workspace
When an organisation uses Kamela Cloud, it may record and store various categories of personal and financial information concerning borrowers, guarantors, contacts, and employees, including:
• Identity and contact information (names, national identity numbers, registration numbers, addresses, phone numbers, email addresses).
• Financial and credit information (loan amounts, terms, schedules, income, affordability inputs, banking references, security links).
• Operational and transaction history (repayments, receipts, write-offs, restructuring events, communications, audit events).
• Supporting documentation (identity documents, proof of address, contracts, business records).
3. Organisation's Privacy Responsibilities
Subscribing organisations are responsible for ensuring that: (a) they have a lawful basis and appropriate borrower consent to collect, process, and store borrower personal information in the cloud; (b) borrowers are provided with compliant privacy notices explaining how their data is used; (c) borrower requests to access, correct, or delete information under POPIA are addressed; and (d) their employees use appropriate access controls and strong credentials.
4. Technical & Organisational Security Safeguards
Circle Core Technologies (Pty) Ltd maintains technical, administrative, and physical safeguards designed to protect information from loss, unauthorised access, destruction, or disclosure. These measures include: strict tenant data isolation, encrypted communication channels (HTTPS/TLS), role-based capability gating, immutable audit logging for sensitive actions, and private authenticated document delivery.
5. Privacy-Minimised Usage Analytics
For signed-in accounts, the platform records privacy-safe aggregated counts of application engagement (daily app opens, engaged time, and visits to major operational areas). Telemetry explicitly excludes: customer/borrower personal information, national identity numbers, financial amounts, search queries, document contents, request/response bodies, IP addresses, and browser fingerprints. Usage data is used solely to understand platform adoption and ensure service reliability.
6. Data Retention & Document Archives
Organisation and borrower records are retained for the duration of the organisation's active subscription. Documents and audit trails are preserved according to the organisation's operational settings. Organisations may export their portfolios, statements, and reports at any time. Upon verified termination of an account, data is archived and purged in accordance with our retention policy and applicable legal obligations.
7. Third-Party Sub-Processors
Circle Core Technologies (Pty) Ltd engages reputable third-party infrastructure and service providers to support the platform (such as cloud hosting facilities, database providers, transactional email delivery, and payment gateways for subscription billing). Sub-processors are bound by confidentiality and data protection obligations consistent with POPIA.
8. Data Subject Rights & Contact
Data subjects whose personal information is processed on the platform may exercise their rights under POPIA. If you are a borrower, please contact the lending organisation directly as the Responsible Party. For inquiries regarding Circle Core Technologies (Pty) Ltd's processing as an account operator or privacy practices, contact our Information Officer at support@circlecore.co.za.
