Legal

Privacy Policy

Last updated: 16 October 2026

Stratum Fintech exists to help members turn everyday spending into shared ownership. That only works on trust. This policy explains, in line with the Protection of Personal Information Act 4 of 2013 (POPIA), how we handle your personal information.

1. Who we are

Stratum Fintech (the "Responsible Party") operates the Stratum ownership platform at api.stratumfintech.co.za on behalf of its clients, partners and the membership body. Our Information Officer can be reached at privacy@stratumfintech.co.za.

2. Information we collect

  • Members: name, contact details, membership number, ID number where required for verification, and the purchases linked to your membership.
  • Merchants and partners: business registration, directors, banking details for settlement and authorised users.
  • Platform use: sign-in records, device and log data, and security events.

3. Why we use it

  • To record eligible everyday purchases and calculate each member's share of ownership value.
  • To process payment instructions through our regulated payment partner (Ozow).
  • To meet our legal duties, including FICA, tax and anti-fraud obligations.
  • To communicate with you about your membership, legacy and account.

We do not sell personal information.

4. Lawful basis and consent

We process information to perform our agreement with you, to comply with law, for legitimate interests such as security, and with your consent where required. Linking a member's purchase history to wealth allocations always requires the member's recorded consent, which you may withdraw at any time.

5. Sharing

We share only what is necessary with: our payment partner Ozow and participating banks; regulated custodians and product providers holding member assets; the membership body for membership administration; auditors, regulators and law enforcement when legally required; and service providers bound by confidentiality. Cross-border transfers happen only where POPIA section 72 safeguards apply.

6. Security

Data is encrypted in transit, access is role-based, administrators must use multi-factor authentication, API secrets are stored only as one-way hashes, and every financial action is written to an audit log.

7. Retention

We keep financial and identity records for at least five years after the relationship ends, as FICA requires, and other information only as long as needed for the purpose collected.

8. Your rights

  • Access the information we hold about you (see our PAIA Manual).
  • Ask us to correct or delete it.
  • Object to processing or to direct marketing.
  • Lodge a complaint with the Information Regulator: enquiries@inforegulator.org.za, inforegulator.org.za.

9. Changes

We will post any changes here and notify members of material changes.