Data Subject Rights, Privacy & Deletion Portal

Understanding Your Rights and Our Legal Obligations

At BluCross Capital, we respect your right to privacy and are fully committed to protecting your personal information. Under the Protection of Personal Information Act (POPIA), you possess specific rights concerning how your data is collected, used, stored, and destroyed. However, as a registered credit provider operating in South Africa, our operations are strictly governed by overlapping statutory mandates that regulate financial institutions.

1. The Right to Request Deletion or Destruction

You have the right to request that we correct, update, or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully. You may also request the destruction or deletion of personal records that we are no longer authorized to retain.

2. Mandatory Statutory Retention (Why Some Data Cannot Be Immediately Deleted)

While we want to honor your deletion requests promptly, South African law compels financial institutions to preserve specific categories of records for mandatory statutory periods, overriding general data deletion requests:

• National Credit Act (NCA, Act 34 of 2005): Records relating to credit applications, credit agreements, consumer credit histories, and assessments must be retained for statutory periods to ensure credit bureau reporting accuracy and regulatory compliance.
• Financial Intelligence Centre Act (FICA, Act 38 of 2001): Know-Your-Customer (KYC) documentation, customer identity verification records, and transaction histories must be archived for a minimum of 5 years following the termination of the business relationship.
• The Companies Act & Tax Administration Act: Financial records, ledger entries, and tax-related invoicing documents must be kept for financial auditing and tax accounting purposes.

3. Our Secure Restriction Protocol

Where statutory retention obligations apply, BluCross Capital will restrict processing of your data rather than entirely purging it. Your records will be locked down securely, isolated from active marketing or operational use, and permanently deleted or shredded the exact moment statutory retention periods expire.