Privacy Policy

Last updated: 14 September 2026

Draft — not yet reviewed by a lawyer. This reflects the data Formal actually collects and how it's actually used today, but should be reviewed by qualified legal counsel for compliance with POPIA and any other applicable data protection law before this is treated as final.

1. Introduction

This Privacy Policy explains what personal information Prism Technologies (Pty) Ltd (registration number 2025660397) ("Formal", "we", "us") collects through the Formal app, why we collect it, and the choices you have. It's written to comply with the Protection of Personal Information Act (POPIA) of South Africa.

2. Information We Collect

We collect the following categories of information:

  • Account information: trading/business name, email address, phone number, and a hashed password (we never store your password in plain text).
  • Identity verification documents: a photo of your national ID or passport, and a proof of address document, submitted when you complete identity verification.
  • Banking information: the bank account details you add so we can process withdrawals, including account holder name, bank name, and account number.
  • Transaction data: records of payments received, withdrawals made, and associated amounts, references, and timestamps.
  • Device and login information: device type and operating system, and a history of login times and IP addresses, used to help keep your account secure.
  • App preferences: your notification settings and whether you've enabled biometric unlock (biometric data itself is handled entirely by your device's operating system and is never sent to us).

3. How We Use Your Information

  • To create and manage your account and process the payments and withdrawals you request;
  • To verify your identity, as required before enabling withdrawals;
  • To send you transactional emails (such as a one-time code when you change your email address) and, where you've opted in, notification emails about your account activity;
  • To detect, investigate, and prevent fraud, unauthorized access, and other illegal activity;
  • To comply with our legal and regulatory obligations, including financial recordkeeping requirements.

4. Who We Share Information With

We share information only where necessary to provide the Service:

  • PayFast (our payment gateway), to process customer payments made to you;
  • Our email service provider, to deliver account and verification emails;
  • Regulators, law enforcement, or other third parties where we're legally required to, or where necessary to investigate suspected fraud or illegal activity.

We do not sell your personal information to third parties.

5. Data Security

We take reasonable technical and organizational measures to protect your information, including encrypting data in transit, hashing passwords, and encrypting sensitive data such as PINs at rest. No system is completely secure, and we can't guarantee absolute security of information transmitted to or stored by the Service.

6. Data Retention

We retain your information for as long as your account is active and as needed to provide the Service. After you close your account or request deletion (see our Account & Data Deletion page), we delete personal information within a reasonable period, except where we're required or permitted to retain it — for example, transaction and financial records, which financial recordkeeping laws may require us to retain for a minimum period (typically several years) even after account closure.

7. Your Rights

Under POPIA, you have the right to:

  • Access the personal information we hold about you;
  • Request that we correct inaccurate or outdated information;
  • Request deletion of your information, subject to our legal retention obligations described above;
  • Object to certain processing of your information, and withdraw consent where processing is based on consent (such as marketing notifications).

To exercise any of these rights, contact us at support@prismtech.online.

8. Cookies and Tracking

This website does not use cookies or third-party analytics or advertising trackers. The Formal app itself does not use advertising trackers.

9. Children's Privacy

The Service is intended for business use by adults and is not directed at children. We do not knowingly collect personal information from children.

10. Changes to this Policy

We may update this Privacy Policy from time to time. If we make material changes, we'll notify you through the app or by email before the changes take effect.

11. Contact Us

Questions about this Privacy Policy, or requests relating to your personal information, can be sent to support@prismtech.online.