Who we are
FIClynx is a service of Nuvio (Pty) Ltd (“Nuvio”, “we”). You can reach our Information Officer at privacy@ficlynx.co.za. Full company details are in our PAIA manual.
Our two roles
For people being verified, the organisation that asked you to verify (an estate agent, attorney or lender, for example) is the responsible party. It decides why your information is processed and how long the record is kept. Nuvio is its operator and processes your information on its instructions. Ask that organisation first if you want to see or correct your information.
For our customers’ users and contacts, Nuvio is the responsible party for account, sign-in and billing information.
What we process
For people being verified, depending on the checks the organisation chooses:
- name, South African ID number, date of birth and marital status;
- Home Affairs results, including alive or deceased status and the ID photo;
- photos of an identity document and, if provided, proof of address;
- bank account details, directorships and company records;
- politically exposed person, sanctions and adverse media results;
- a selfie and blink check, or a fingerprint capture;
- consent records, the time, IP address and device used.
For users of FIClynx: name, work email, mobile number, organisation details, role, sign-in and security events, and billing records. Card payments are handled by PayFast; we do not see or store card numbers.
Why we process it
- To help accountable institutions meet their customer due diligence duties under the Financial Intelligence Centre Act 38 of 2001 (FICA).
- To keep the record those institutions must be able to show in an inspection.
- To run, secure and bill for the service.
Client information is not used for marketing and is not sold.
Biometric information
Biometric information is special personal information under POPIA. A selfie or fingerprint is compared 1:1 with Home Affairs records, with the person’s consent, to meet FICA obligations.
Keeping a face or fingerprint template for future re-verification is a separate, optional consent, and refusing it changes nothing about the current verification. We keep only an encrypted template, not the image. It is used only to confirm that person’s identity for the same organisation. It is deleted when the retention period ends (365 days by default), when the relationship ends, or as soon as consent is withdrawn.
Who receives it
- The organisation that asked for the verification.
- The Department of Home Affairs and licensed verification data sources, which provide identity, bank, company, address and screening results.
- Service providers that host the service, store documents, and deliver email and SMS, and PayFast for payments.
- Regulators or authorities, where the law requires it.
Where it is stored
FIClynx is hosted in Ireland in the European Union, including stored documents. This is a transfer outside South Africa, which we make to a country with data protection law that POPIA recognises as adequate protection.
How long we keep it
- Verification records are kept for at least five years, as FICA requires. Our system sets each case’s retention date five years after the case is created, and the organisation stays responsible for any longer period the law requires.
- Captured documents are deleted automatically after their retention date.
- Consent records and audit events are kept as evidence, and contain no biometric data.
How we protect it
Each organisation’s data is kept separate and every query is limited to it. Access depends on role, sign-in requires a second factor for live organisations, biometric templates are encrypted, ID numbers are masked by default, and access to a case is recorded in its audit trail.
Your rights
You may ask to see or correct your personal information, ask for it to be deleted where the law allows, object to processing, and withdraw consent. Withdrawing consent does not undo processing that has already happened, or remove records that FICA requires to be kept.
If you were verified by an organisation, contact that organisation first. For anything else, email privacy@ficlynx.co.za.
You may also complain to the Information Regulator at inforegulator.org.za.
Changes
When we change this notice we publish a new version on this page, with a new version number.