Privacy Policy

This policy explains what personal information Carfin collects, why, who we share it with, how long we keep it and what your rights are. It is our notice to you under the Protection of Personal Information Act, 2013 (POPIA).

1. Who we are

Carfin is a vehicle finance broker. We help you apply for vehicle finance and send your application to banks and finance houses. For the personal information we collect, Carfin is the "responsible party" under the Protection of Personal Information Act, 2013 (POPIA). That means we decide why and how it is used, and we answer to you for it.

• Name: Carfin (Pty) Ltd, registration number 2006/019865/07
• Address: 14 Oaktree Ave, Hazelwood, Pretoria, 0081, South Africa
• Phone: +27 86 122 7346
• Email: admin@carfin.co.za
• NCR registration: NCRCP2341
• Authorised financial services provider: FSP 19735

Our Information Officer

Our Information Officer makes sure we follow POPIA and handles requests about your information. The Information Officer is registered with the Information Regulator.

• Information Officer: Keagan Altenroxel, director
• Email: admin@carfin.co.za, marked for the Information Officer

2. What this policy covers

This policy applies when you:

• visit carfin.co.za;
• pre-qualify or send a full application at app.carfin.co.za, or sign in there to track your application;
• phone, email or WhatsApp us; or
• are named in somebody else's application, for example as their spouse or next of kin.

When we send your application to a bank or finance house, that lender also becomes responsible for your information. It uses it under its own privacy notice, which you can ask the lender for. The same applies to the credit bureau.

3. The information we collect

When you pre-qualify

• Your full name, South African ID number, cellphone number and email address.
• Your gross monthly income, your total monthly expenses and how much finance you want.
• The type of finance you are looking for.
• Your answers to the consent questions, the exact wording you agreed to, and when you agreed.

When you complete a full application

• Title, name, ID number, contact details, marital status and home address.
• Where you live: whether you own or rent, how long you have lived there, and bond or rent details.
• Your work: employer, employer address and phone number, job title, how long you have worked there and pay date.
• Your income: gross and net income, and any other income and where it comes from.
• Your monthly expenses and debts, for example bond or rent, car repayments, loans, cards and accounts.
• Your bank account details.
• The vehicle you want, the price, deposit, dealer and any trade in.
• If you work for yourself: your business name, registration number, trading entity, turnover, assets and premises.
• Documents you upload: a copy of your ID, payslips, bank statements and proof of address, and for a business, business bank statements and financial statements.
• Your declarations under POPIA, the National Credit Act and section 92.

About other people

A full application asks for your spouse's details if you are married (name, ID number, contact details, employer and income) and for a next of kin (name, relationship, phone number and address). Please tell them first. When you submit, you confirm that they know and agree. They have the same rights under this policy as you do.

From a credit bureau

With your consent we get your credit report from a registered credit bureau. It shows your accounts, what you pay each month, arrears, judgements, defaults, debt review status, recent credit enquiries and a credit score. See section 6.

From your device

• Your IP address, recorded with your consent and used to stop abuse of our forms.
• Advertising click IDs and a partner referral code, if you arrived from an advert or a partner's link. See section 9.
• If you go from this website into the app: the advert campaign you came from, the website that sent you (its name only), and which of our pages you landed on and clicked from. These describe an advert and a page, not you, and are stored with your application when you submit it. Not after you choose "Only essential".
• Pages visited and how the site is used, through analytics.
• If you accept cookies on carfin.co.za: our own record of the pages you visit there, the sections you scroll to, the buttons you press towards the app, and the calculator figures you choose rounded into bands (price to the nearest R50,000 below, deposit to R10,000), whether you started the eligibility questions (not your answers), and how you arrived: the advert campaign, the website that sent you (its name only) and the kind of advert click. It is kept under a random number in a cookie, not your name, and is stored by us, not by Google. If you then apply, we link it to your application, so we can see which pages helped. We never record your answers, and we keep it 13 months, then keep only daily totals.
• If you accept cookies, on this website and in our application forms: where on a page you press, how far down you scroll and how long you spend on it, and how long each form box takes and how often it is changed. A box is recorded by its name only (such as "employer phone"), never what you type in it. This has no name or number attached, is not linked to you or your application, and is kept six months.

When you contact us

We keep the emails, WhatsApp messages and portal messages you send us, and notes our consultants make about your application.

4. How we use it, and why we may

We use your information to:

• tell you whether we are likely to be able to help, through the pre-qualification;
• prepare your finance application and send it to banks and finance houses;
• help the lender check that the finance is affordable for you, as the National Credit Act requires;
• confirm who you are and prevent fraud;
• keep you updated on your application by email, phone, SMS or WhatsApp;
• arrange the paperwork for your vehicle, such as quotes, invoices and registration;
• keep the records the law requires us to keep;
• deal with complaints and legal claims; and
• understand how our website and forms are used, so we can improve them.

POPIA (section 11) only lets us use your information for a lawful reason. Ours are:

• Your consent, for example for the credit check and for analytics cookies in the app.
• To take steps you asked for, such as preparing and sending your application.
• Legal obligations, for example under the National Credit Act and financial services law.
• Legitimate interests, for example preventing fraud and keeping our systems secure.

We do not sell your personal information.

5. Do you have to give us your information?

No. Giving us information is voluntary. But we cannot pre-qualify you without your name, ID number, contact details, income, expenses and your consent to a credit check. And banks will not consider an application without the details and documents they ask for. If information is missing or wrong, your application may be delayed or declined.

Some answers are optional, and the form says so.

Laws that require or allow this information to be collected include:

• the National Credit Act, 2005, which requires a credit provider to assess whether you can afford credit (section 81) before it lends to you;
• the Financial Advisory and Intermediary Services Act, 2002 (FAIS), which sets record keeping duties;
• the Financial Intelligence Centre Act, 2001 (FICA), which requires identity verification and records where it applies; and
• POPIA itself.

Please keep your information accurate and tell us if anything changes.

6. Credit checks and automatic decisions

The credit check

With your consent, we check your credit record with a credit bureau registered with the National Credit Regulator. Our pre-qualification does not lower your credit score. We may check again later in your application, for example if your report is out of date. We keep a copy of the report on your file.

How the pre-qualification decides

The pre-qualification gives you an answer straight away, without a person looking at it first. It reads your credit report and decides in one of three ways: we can likely help, a consultant needs to look, or we cannot help at the moment. The things that can lead to a decline are:

• a low credit score;
• a judgement or default listing;
• being under debt review;
• arrears of about three months or more;
• court notices or other adverse listings; or
• an ID number that the bureau cannot verify.

Smaller concerns, such as older arrears or many recent credit enquiries, send your file to a consultant instead. A full application is only declined automatically on the most serious of these facts. A consultant reviews the rest. Banks make their own credit decisions. We do not decide whether you get finance.

If a pre-qualification is declined, you can apply again after six months. The email we send you gives the date.

Your rights about the decision

• Reasons. Ask us in writing and we will tell you the main reason for the decision (National Credit Act, section 62). If it was based on your credit report, we will give you the bureau's contact details.
• A person and your side of the story. You can ask a consultant to look at the decision again and tell us anything you think we missed. We will explain the reasoning behind the automatic decision so you can do this (POPIA, section 71).
• Wrong information on your record. You can dispute it with the bureau. Ask us and we will give you the bureau's contact details.
• Your own report. You are entitled to a free copy of your credit report from each bureau every year.

7. Who we share it with

We only share your information when we need to, and only what is needed. We share it with:

If you came to us through a referral partner's link, we record which partner introduced you.

8. Information sent outside South Africa

Some of our service providers store or process your information outside South Africa:

• Our database and documents are stored by Supabase in Ireland, in the European Union.
• Our app and website run on Vercel. The app runs on servers in Ireland. Vercel is a United States company and serves pages from locations around the world.
• Email is sent through Resend, which stores email records in the United States. Email you send to us, and our replies, are held by Google Workspace, which stores them outside South Africa.
• Analytics, advertising and address search use Google, which processes data in the United States and other countries.
• WhatsApp messages are handled by WhatsApp (Meta).

POPIA (section 72) only allows this when the information stays properly protected. We rely on one or more of these: the provider is bound by law or a binding agreement that protects your information to a standard similar to POPIA (the European Union's General Data Protection Regulation, for example); the transfer is needed to deal with your application; or you consent to it. By using our services you consent to these transfers.

9. Cookies and tracking

Cookies are small files a website stores in your browser. We use a few, listed below. We do not use them to read your application answers.

The app also uses Vercel Analytics and Speed Insights to measure page speed and visits. They do not use cookies, and we remove application references from page addresses before anything is sent.

Your choices. carfin.co.za and the app ask before they set analytics or advertising cookies. Before you choose, and if you choose "Only essential", Google's tags on carfin.co.za run without cookies: nothing is stored on your device, but Google receives a basic page view (your IP address, your browser and the page address) so it can estimate visits. You can also block or delete cookies in your browser settings. Google also offers an opt out at tools.google.com/dlpage/gaoptout and ad settings at myadcenter.google.com. Blocking cookies does not stop you applying.

You can change your cookie choice for carfin.co.za at any time: Cookie settings.

We may add the Meta (Facebook) pixel in future, to measure our Meta adverts. We will update this policy before we do.

10. Marketing

Messages about your own application, such as a reminder to finish it or news of a decision, are not marketing. We send those because you asked us to help you.

We will only send you marketing by email, SMS, WhatsApp or phone call if you agreed to it, or if you are already our customer and it is about similar services of ours (POPIA, section 69). Every marketing message tells you who it is from and how to stop it. You can opt out at any time, free of charge: use the opt out in the message, or email admin@carfin.co.za.

11. How long we keep it

We keep your information for as long as the law requires and for as long as we have a legitimate business need, for example to deal with a complaint or a claim. The law sets minimum periods:

• the National Credit Act requires credit records to be kept for at least three years;
• FAIS requires financial services records to be kept for at least five years; and
• FICA, where it applies, requires identity and transaction records to be kept for at least five years after the relationship or transaction ends.

Our records of the consents you give are never edited or removed while we hold your file, so we can always show what you agreed to.

How long we keep each kind of record. These are the longest periods:

• A pre-qualification that did not lead to a full application: 3 years from the day we received it.
• A full application that did not go ahead (declined, withdrawn or not finished): 5 years from the day it closed.
• Finance that went ahead: 5 years from the day the deal was completed.
• Your credit report, the documents you uploaded, and our messages and notes about your application: as long as the application they belong to.
• Quotes, invoices and payment records: 7 years from the end of our financial year.
• Records of a car we buy from you or sell to you, including identity documents: 5 years from the sale.
• Our records of the consents you gave: as long as the record they relate to.
• Calculator enquiries and applications you started but never sent: 12 months.
• Our record of the pages you visited on carfin.co.za: 13 months, whether or not you applied, then only daily totals that do not identify anyone.

We keep a record longer only while it is needed for a complaint, a dispute or a legal claim, or if the law requires it. When a period ends the record is due to be deleted, or to have everything that identifies you removed so that what is left can only be used for statistics. We are putting automatic deletion in place. Until it runs, a record past its period is kept securely and used for nothing else, and you can ask us to delete yours at any time.

When we no longer need your information and the law no longer requires us to keep it, we will delete it or remove what identifies you. You can ask us to do this sooner (see section 14).

12. How we protect it

POPIA (section 19) requires us to keep your information secure. We:

• encrypt information as it travels between your device and our systems;
• store it with providers that encrypt it at rest;
• keep uploaded documents in private storage, with a backup copy;
• give access only to staff who need it, through individual accounts;
• keep a log of changes made to customer records, showing who made them; and
• protect our forms against automated abuse.

Our service providers (called operators in POPIA) may only use your information on our instructions and must keep it confidential and secure (sections 20 and 21).

If we believe your information has been accessed by someone who should not have it, we will tell you and the Information Regulator as soon as reasonably possible (section 22).

No system is completely secure. Please keep your app password private, and be wary of messages asking for your details.

13. Children and special personal information

Our services are for adults. You must be 18 or older to apply. We do not knowingly collect information about children.

We do not ask for special personal information, such as your race, religion, health, political views or criminal record. Your ID number shows your date of birth, gender and citizenship, which is why we protect it carefully. If a document you send contains special personal information, we only use it to process your application.

14. Your rights

You have the right to:

• know whether we hold information about you, and get a copy of it (POPIA section 23);
• correct information that is wrong, out of date or incomplete (section 24);
• ask us to delete information we are no longer allowed to keep (section 24);
• object to us using your information, where we rely on legitimate interests (section 11(3));
• withdraw your consent at any time. This does not undo what we did before, and we may not be able to continue your application;
• say no to marketing at any time (section 69);
• not be subject to a decision made only by a computer without a chance to respond (section 71, see section 6); and
• complain to the Information Regulator (see section 15).

How to make a request

Email our Information Officer at admin@carfin.co.za, or write to us at the address in section 1. You can use the Information Regulator's forms (Form 1 to object, Form 2 to correct or delete), but a clear email is enough. We will ask you to prove who you are before we act, so that nobody else can get your information.

Confirming whether we hold your information is free. For a copy of records, the Promotion of Access to Information Act, 2000 (PAIA) allows a prescribed fee. We will tell you the fee before we do the work. We aim to respond within 30 days. To request records under PAIA, or for information on how to do so, contact our Information Officer, Keagan Altenroxel, at admin@carfin.co.za.

If the law requires us to keep information you ask us to delete, we will tell you, and we will only use it for that legal purpose.

15. Complaints and the Information Regulator

Please tell us first if you are unhappy with how we handled your information, so we can try to put it right. You can also complain to the Information Regulator at any time:

• Information Regulator (South Africa)
• Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• Phone: 010 023 5200 or toll free 0800 017 160
• General enquiries: enquiries@inforegulator.org.za
• POPIA complaints: POPIAComplaints@inforegulator.org.za
• Website: inforegulator.org.za

A complaint about information on your credit record can also go to the credit bureau first, and then to the National Credit Regulator.

16. Changes to this policy

We will update this policy when our practices or the law change, and show the new date at the top. This policy was last updated on 3 November 2026.

17. Contact us

For any question about this policy or your information:

• Carfin, 14 Oaktree Ave, Hazelwood, Pretoria, 0081, South Africa
• Email: admin@carfin.co.za
• Phone: +27 86 122 7346