Privacy Policy

This policy explains what personal data AfriSynapse collects when you visit the site or use the platform, why we collect it, on what legal basis, who receives it, how long we keep it, and the rights you can exercise over it. We have written it in plain language because a policy you cannot understand cannot protect you. It applies together with the Terms of Use and our AML and KYC policy.

Definitions

"Personal data" means information relating to an identified or identifiable person, such as your name, contact details or account activity. "Processing" covers anything done with that data: collecting, storing, viewing, transferring or deleting it. The "controller" decides why and how data is processed; a "processor" handles data on the controller's instructions. "You" are the visitor, registrant or account holder this policy addresses; "we", "us" and "AfriSynapse" mean the operator of this website and platform.

Personal data we collect

We collect the details you give us in the registration form: first name, last name, telephone number and email address. During verification we collect your date of birth, physical address, and identity document details, as described in the AML and KYC policy. When you use the platform we collect transaction records, strategy settings and their changes, and the messages you exchange with support or your personal manager. In short: name, surname, phone, email, and the content of your requests, plus what the site itself observes as below.

Usage data

As you use the site, our systems log technical information: IP address and approximate location derived from it, browser and device type, the pages visited, referring page, and timestamps. This serves security (detecting attacks and fraud), diagnostics (understanding errors) and aggregate statistics. We do not build advertising profiles from this data, and we do not sell it. Where analytics tooling is enabled, it operates under this policy and the analytics section below.

Cookies

The site uses a small number of strictly necessary cookies and similar storage: to keep your session secure after login, to remember security choices such as two-factor preferences, and to protect forms against automated abuse. We also permit an analytics tool whose usage statistics can be declined through your browser settings without affecting site functionality. We do not use third-party advertising cookies. Most browsers let you block or delete cookies; blocking the necessary ones will affect login and form submission, and you can find the exact effect of each category in your account settings.

Controller and processors

AfriSynapse, operating this website, is the controller for the personal data described here. Where third parties process data on our instructions, such as hosting providers, verification providers and communication tools, they act as processors under written agreements that limit what they may do with the data. Contact for any data question: [email protected], or by post to 2 Sandhill Drive, Sandhurst, Sandton, Johannesburg 2196, South Africa.

Collection and use of information

We use your data to: create and operate your account; verify your identity as required; provide, maintain and improve the platform; personalise the analysis tools to your settings; communicate with you about your account, including security alerts; meet legal obligations applicable in South Africa; answer support questions and complaints; and keep the site secure. Within those purposes we use data in aggregated, de-identified form to understand how features are used and where documentation is unclear.

Legal bases for processing

Processing rests on these bases: performance of a contract (operating your account and the services you registered for) for account and transaction data; compliance with a legal obligation for verification, record-keeping and reporting under the applicable South African framework; legitimate interests, balanced against your rights, for site security, fraud prevention, service improvement and aggregate statistics; and your consent, which you may withdraw at any time, for optional marketing communications and for any processing that is neither contractual nor legally required. Where consent is the basis, withdrawing it does not affect earlier processing done on it.

Data retention

Registration details are kept while your account is open and for a reasonable period after closure for dispute handling. Verification records and transaction records are kept for the retention period the applicable South African framework prescribes, including the record-keeping periods associated with the FIC Act, which outlast the account relationship. Support correspondence is retained for up to three years. Usage logs are kept for security and diagnostic purposes for up to eighteen months, then deleted or fully anonymised. When retention ends, data is deleted or irreversibly de-identified.

Data transfers

Our providers may process data in data centres outside South Africa. Where that happens, transfers are covered by appropriate safeguards, including contractual data protection terms with each provider, and the data remains subject to this policy. We select providers with care, keep the list of categories current, and do not transfer data to any jurisdiction where doing so would undermine the protections described here.

Disclosure of data

We disclose personal data to: the licensed entity providing execution services, to the extent needed to operate your account; affiliated companies involved in providing the service; IT providers (hosting, verification, communications) as processors; payment providers for deposits and withdrawals; professional advisers under confidentiality; and regulators, ombud schemes or law-enforcement bodies where the applicable framework requires it. We never sell personal data, and we do not disclose it for third-party advertising.

Security of processing

Technical and organisational measures protect your data: encryption in transit and at rest, access limited to roles that need it, logging of access, segregation of verification records, and incident response procedures described on the Security page. No system is perfectly secure, and if a breach affects your data we will notify you and the relevant authorities as the applicable requirements provide, with an honest account of what happened and what we are doing about it.

Your rights as a data subject

You have the right to access the personal data we hold about you; to have inaccurate data corrected; to have data deleted where no law requires us to keep it; to restrict processing while a dispute about accuracy is resolved; to object to processing based on legitimate interests, including profiling we cannot justify; to withdraw consent for marketing at any time; and to receive a portable copy of data you provided to us, in a common format. Verification-related deletion is limited by the retention duties described above: we will tell you exactly what must be kept and for how long, and delete everything else. Exercising any of these rights never degrades your service.

Service providers

Categories of processors we rely on: cloud hosting and infrastructure; identity verification and liveness checking; email and message delivery; analytics (where enabled); customer-relationship tooling used by support and your personal manager; and payment processing for deposits and withdrawals. Each category receives only the data its function requires, under contractual confidentiality and security obligations, and none of them may use your data for their own purposes.

Analytics

Where analytics is enabled, it shows us which pages are visited, for how long, from what broad device class, and where visitors encounter errors. Statistics are aggregate; we do not use analytics to identify you personally, and analytics storage can be declined in your browser without losing site functionality. If the SEO team later enables a third-party analytics tag, the configuration is set to respect this policy, and any material change to that position will be reflected on this page first.

Advertising and retargeting

We do not run advertising or retargeting pixels from this site. If that ever changes, the relevant technologies, their purposes and the way to decline them will be described here before they are switched on. Marketing emails we send ourselves are covered by the consent section: every message carries an unsubscribe link, and unsubscribing is honoured promptly and completely.

Links to other sites

This site links to external sites, such as exchange and payment-provider websites, whose data practices differ from ours. This policy covers what happens on our site and in our services; once you follow a link, the destination's own policy governs. We encourage you to read those policies before entering credentials, and to verify you are on the official domain as described on the Fraud Warning page.

Children

The site and services are directed at adults. We do not knowingly collect data from anyone under 18, and accounts cannot be opened by minors. If we learn that a registrant is under 18, the account is closed and the registration data is deleted except where a legal obligation requires otherwise. If you believe a child has provided us data, contact [email protected] and we will act on it promptly.

Changes to this policy

This policy may be updated to reflect changes in our processing, providers or applicable requirements. The current version always lives on this page with its effective date, and material changes are announced on the platform notice board and by email before they take effect. Old versions are available on request, so you can always see what changed and when.

Contact us

Questions, requests or complaints about privacy go to [email protected], or by post to 2 Sandhill Drive, Sandhurst, Sandton, Johannesburg 2196, South Africa, attention Client Support and Onboarding. We answer privacy requests within a reasonable period, normally well inside a month, and sooner for access and correction. If you are unhappy with our answer, the complaints procedure, including its external escalation route, applies to privacy matters as well.

Effective date: 1 October 2026.