App Privacy Policy – Whoosh Payments

Whoosh Pay App Privacy Policy

Last updated: 16 September 2026

Whoosh Innovations (Pty) Ltd (hereinafter referred to as “Whoosh”) is committed to protecting the privacy of Whoosh Pay App (hereinafter referred to as the “App”) users. This document sets out:

- How we collect personal information;
- What types of personal information we collect and hold;
- The purposes for which we use such personal information;
- Rights with respect to the personal information held by us.

Who we are

When we refer to “we”, “us”, or “our” herein we are referring to Whoosh Innovations (Pty) Ltd (Registration Number 2014/123529/07) and its affiliated group companies, or any of them, as the context requires, as well as our successors in title. Our principal place of business is at Unit 87, Building G, Wapadrand Office Park, 90 Kingbolt Crescent, Wapadrand Security Village, Wapadrand, Pretoria, 0081. We recommend you contact us via telephone at +27 (0) 10 009 6926, or email at info@letswhoosh.com

Whose information we protect

When we refer to “you” or “your” herein we are referring to you, the users of our App and of the services enabled via the App.

How we collect your personal information

We collect information about you directly from you as well from third parties and publicly accessible sources in certain cases. The means and sources we use to collect information about you is as follows:

From you, when you make use of the App, enquire about or subscribe to our services or use our services, as well as when you subscribe to our newsletters or consent to receiving communications from us;
From public registers, credit bureaus, money laundering, fraud prevention and law enforcement agencies;
From our business partners and the persons employed by us to provide services for us, which may include debt collection services, communications services and data hosting, processing and management services;
From such persons or entities which may be legally entitled to provide us with information about you; and
From persons or entities which you may consent to providing us with information about you.

Information we collect and hold about you

We collect and hold the following types of information:

Details of when you contact us and when we contact you, including the IP addresses when you contact us via electronic mail or through our App, email addresses and telephone numbers from which you contact us, as well as the content of the communications between us, which we may record;
All information contained in the forms, requests, or orders you submit to us, via email, our App, or using any other means, including any information about your clients, the services or products you may provide and any amounts chargeable or owing to you in respect thereof;
Details about you or your clients or personnel which you provide to us to register with us or that are collected or arise in the course of the delivery of services, including names, contact details, billing information, account details, identity numbers, and places of business and residence;
Information received pursuant to our enquiries with public registers, credit bureaus, money laundering, fraud prevention and law enforcement agencies; and
Details of your preferences regarding our services and offerings, including which of our services you have made enquiries with us about.

We will retain your personal information only for as long as is reasonably necessary to fulfil the purposes for which it was collected or subsequently processed, including to provide our services, comply with legal, regulatory, accounting or reporting obligations, resolve disputes, enforce our agreements, and maintain business records where we are lawfully permitted or required to do so.

Where a specific retention period is required or authorised by law, contract, or our legitimate lawful business purposes, we will retain the relevant records for that period. Once we are no longer authorised to retain your personal information, we will delete, destroy or de-identify it as soon as reasonably practicable.

The purposes for which we use your personal information

Certain of the information which we collect about you, as identified below, we need to use in order to process your requests for and instructions regarding our services and to exercise our rights under agreements we have with you. If we do not have the right to use such information it will not be possible for you to make use of our services or for us to process requests related thereto. Such information includes:

Your name, contact details, identity number, and place of residence;
Your preferences regarding our services which you make use of or have made enquiries about;
Your bank account details and the client information and financial information which you submit to us in connection with our services;
The information about you which we have received from public registers, credit bureaus, money laundering, fraud prevention and law enforcement agencies;
The information which you and third parties have provided to us which we need to verify that the information which we have received from or about you are accurate, complete and up to date.

Other information about you which we hold and which we do not need for purposes of providing our services to you, and which we make use of based on your consent, will be used by us only for the purposes as agreed to by you. We may also use information we hold about you for purposes required by or as permitted under applicable law.

We collect and will process your information for the following purposes:

To process your application to register with us and making related decisions, including by verifying your identity, credit status, contact details, track record and otherwise ascertaining that you qualify as supplier or subscriber for services from time to time;
To ensure that the information we receive and hold about you and your clients is accurate, complete and up to date;
To prevent, investigate and prosecute fraud, money laundering, terrorism, abuse of our services and other unlawful activities;
To comply with legal and regulatory requirements, for audit purposes and legal proceedings;
To conduct market research and business analysis, understand your preferences, learn more about the products and services that you offer or are interested in and improve the products and services we offer to you;
To inform and provide you with the opportunity to make use of products, services and benefits that we offer and that we believe may be of interest to you to the extent that we are lawfully permitted to do so; and
For such other purposes as you may consent to or as may otherwise be lawfully permitted, including for the purposes of protecting our and/or your legitimate interests and/or that of our suppliers and other customers.

We will not contact you telephonically for unsolicited marketing purposes or send unsolicited marketing communications to you by facsimile, SMS, or electronic mail if you have objected to receiving such communications by way of a public register recognised for such purposes by law or by notifying us of your objection in the prescribed manner. We will provide you with reasonable opportunities to object to receiving marketing communications in the manner prescribed by law, including upon application for our services and on each occasion when we send you such communications.

Sharing your information

Keeping your personal and financial information secure is one of our most important responsibilities. We cannot disclose your information unless legally permitted. Save as set out below, we will not transfer your information to a third party without your consent unless legally obliged. In particular, we do not sell lists or databases with our users’ information and will not provide any of your information to entities outside our group so as to permit them to market their products or services to you. You agree that we may transfer your information to the following people and organisations, who may be located inside or outside South Africa, in pursuit of the data processing purposes set out in this policy:

To all persons in our employ or in the employ of our affiliated companies, including to our directors, employees, contractors, agents, auditors, legal and other professional advisors and of our affiliated companies;
To credit bureaus and fraud prevention agencies, provided that we will notify you in advance before we provide adverse information about you to a credit bureau and, upon request, provide you with a copy of such information as required by law;
To governmental, judicial, regulatory and law enforcement bodies and agencies, including the South African Revenue Services and the National Credit Regulator;
To persons engaged by us at your request to provide services on your behalf, including for presentment of client invoices and payment reminders and collections;
To persons that are engaged by us to assist us in providing services to you or that provide services on our behalf and that adhere to principles similar to ours regarding the treatment of your information, including for client and account verification, system and data hosting, processing and management and transfers of payments;
To our clients that are authorised to make use of the services you provide to us;
To any person to whom we subcontract, cede, delegate, transfer or assign any of our rights or obligations pertaining to the services provided to you or contracts concluded with you;
To any person that acts as your legal guardian, executor of your estate, curator or in a similar capacity;
To such other persons as may be permitted by applicable law or that you may consent to.

Security

We will strive at all times to ensure that your records will always be protected against unauthorised or accidental access, processing, or loss. We maintain this commitment to data security by implementing appropriate reasonable technical and organisational measures to safeguard and secure your information. If we use a third party to host, manage, or process your data on our behalf we will require that such third party also commit to implementing appropriate reasonable technical and organisational measures to safeguard and secure your information. If we are not prevented by a law enforcement or regulatory agency, we will notify you without undue delay if we believe that unauthorised access to your information may have occurred, providing you with such information as you may reasonably require to implement protective measures.

User Authentication and App Analytics

We use Firebase Authentication and Google Analytics for Firebase, services provided by Google LLC, to manage user accounts and understand how our application is being used.

Account Management: When you create an account or sign in, Firebase Authentication collects and stores your email address, username, photoURL, password hash, and account creation dates. To make registration easier, we support third-party sign-in via Google Sign-In and Sign in with Apple. If you choose these options, we securely receive a unique user ID, your email address, and your public profile name from Google or Apple to link and authenticate your profile within our App. This data is strictly used to verify your identity and manage your user account.
Usage Analytics: We use Google Analytics for Firebase to gather information on App performance and user interactions. This includes automatically tracking App instance IDs, screen views, custom event logs, session duration, and coarse location data derived from your IP address. It also utilizes mobile device identifiers (such as Android Advertising ID or Apple’s IDFA) to analyze overall user trends.
This information is transmitted to and processed by Google on our behalf. For more details on how Google handles this data, you can review the Firebase Privacy Overview at https://firebase.google.com/support/privacy/, and Google’s core Privacy Policy at https://policies.google.com/privacy/. You can also learn more about processing frameworks by visiting https://policies.google.com/technologies/partner-sites. For users authenticating via Apple, please also refer to the Apple Privacy Policy at https://www.apple.com/legal/privacy/.

Your rights under the Protection of Personal Information (POPIA) Act

Whoosh collects, processes, and stores personal information in accordance with the Protection of Personal Information Act, No. 4 of 2013 (“POPIA”), which may be accessed at this link: https://www.gov.za/sites/default/files/gcis_document/201409/3706726-11act4of2013protectionofpersonalinforcorrect.pdf
Whoosh collects, processes, and stores your personal information for the primary purpose of fulfilling its contractual obligations, providing services, and managing customer support.
Whoosh undertakes to ensure the integrity and confidentiality of your personal information by implementing reasonable, appropriate technical and organisational measures to prevent unauthorised access, loss, or damage.

In terms of POPIA, you have the the right to:

Access your personal information held by Whoosh.
Request correction or deletion of your personal information.
Object to the processing of your personal information.
Lodge a complaint with the Information Regulator of South Africa.

For any queries regarding your personal information, or to exercise your rights, please contact our Information Officer at info@letswhoosh.com or visit https://letswhoosh.com/contact/.

Account deletion

You have the right to delete your account at any time, by using the Delete Account option in the App profile section once logged in.
Alternatively, please visit this link: https://letswhoosh.com/app-deletion-request/

Complaints

Please notify us at info@letswhoosh.com. If you have any concerns about the processing of your personal information.

If your concerns are not satisfactorily resolved you may lodge a complaint with the South African Information Regulator at complaints.IR@justice.gov.za or +27 (0) 10 023 5200.