Privacy Policy

Samba Co-operative Limited

Policy version: 12 November 2026

1. About this policy

Samba Co-operative Limited (“Samba”, “we”, “us”, “our”) respects your privacy and is responsible for personal information it processes in providing its membership, financial and related services. Samba is an authorised financial services provider (FSP 18212) and a registered credit provider (NCRCP 1270).

This policy explains how we collect, use, disclose, protect, retain and delete personal information. It applies to prospective, current and former members and customers, product applicants, and people who communicate with us or use our website and services. Section 10 specifically covers the Samba Lifestyle Mobile App, including versions listed as Samba on the app stores.

We process personal information in accordance with the Protection of Personal Information Act, 2013 (“POPIA”) and other legislation applicable to our services. Product-specific notices may explain additional processing relevant to a particular application or service. This consolidated policy replaces earlier versions of Samba's general privacy policy.

2. Contacting our Information Officer

For privacy questions, requests about your information, complaints or mobile-account deletion, contact:

Information Officer — Samba Co-operative Limited
Email: CEO@sambakoop.com (mark your message “Attention: Information Officer”)
Telephone: +27 (0)51 448 0111
Website: www.sambakoop.com

Please identify the service or request concerned and provide a way for us to contact you. Do not send passwords or one-time verification codes. We may reasonably verify your identity before releasing information or acting on a request affecting your account.

3. Information we collect and where it comes from

The information we process depends on your relationship with Samba and the services you use. It can include:

  • identification, member, contact and address details;
  • membership and account records, transactions, statements, payment and banking information;
  • credit applications, credit history, finance agreements, insurance information and supporting documents;
  • enquiries, complaints, service requests, referral information and correspondence;
  • recorded telephone or electronic communications and relevant CCTV or other recordings where these are used in our operations; and
  • technical, device and service-use information associated with our digital services, as explained further for the App in section 10.

We obtain information from you through applications, forms, our offices, telephone and electronic communications, our website and the App. We may also obtain information from existing Samba records and from parties lawfully involved in providing or verifying a requested service, including credit bureaux and relevant business partners.

If you supply another person's information, including a referral, you must be authorised to provide it and should make that person aware that you have done so.

4. How and why we use personal information

We use relevant information to:

  • verify identity, assess applications and establish or administer membership;
  • provide requested products, facilities and services and manage our contractual relationship with you;
  • maintain accounts, process transactions and provide statements and service communications;
  • assess credit applications, manage credit agreements and exchange permitted information with registered credit bureaux;
  • arrange requested insurance or other partner services;
  • investigate enquiries, complaints, disputes and service requests;
  • detect or prevent fraud, money laundering, unauthorised access and other misuse;
  • support administration, auditing, operational analysis, statistical work, market research and record keeping;
  • communicate relevant offerings where direct marketing is permitted; and
  • comply with applicable legal and regulatory duties and enforce or defend lawful rights.

Depending on the circumstances, processing is based on consent, steps needed for or performance of a contract, a legal obligation, or another ground permitted by applicable law. We explain material additional uses and seek specific consent where required. Merely installing the App, visiting our website or submitting information does not provide blanket consent to unrelated processing or optional marketing.

You may withdraw consent or object to processing where applicable. Withdrawal does not invalidate processing already lawfully undertaken, and some processing may continue where another lawful ground applies. If you do not provide information necessary for a particular service, or if necessary processing cannot lawfully continue, we may be unable to provide that service. We will explain the relevant consequence.

5. Credit-bureau information

Where you apply for credit, we may obtain credit-history information as authorised or otherwise permitted by applicable law. Credit bureaux may keep a record of the enquiry and make it available to other authorised enquirers.

We may provide a registered credit bureau with information about a credit application, agreement, payment or account history, termination or non-compliance where permitted or required. You may approach the relevant bureau to access your credit record or dispute inaccurate information.

6. Direct marketing and your choices

We may contact you about Samba services and offerings where applicable law permits it, obtaining consent where required. You may object to direct marketing or withdraw marketing consent by emailing info@sambakoop.com or using an available unsubscribe facility.

An objection to optional marketing does not prevent necessary account, security or contractual communications. Turning off push notifications controls delivery on that device; to object to marketing across communication channels, contact us. We do not sell personal or sensitive information collected through the App.

7. Sharing information and processing outside South Africa

We share information only where there is an appropriate purpose and lawful basis, including with:

  • authorised personnel and service providers supporting hosting, administration, communications, security, technical services and document handling;
  • relevant insurance providers, financial-service partners and other business partners where needed for a service you request;
  • registered credit bureaux, as explained in section 5; and
  • regulators, courts, law-enforcement bodies or other parties where disclosure is lawfully required or permitted.

We limit disclosures to information relevant to the purpose and require appropriate protection from parties processing information on our behalf. Where another organisation provides a service under its own responsibility, its applicable privacy notice also applies. Section 10 identifies the principal third-party services used by the App.

Some service providers process information outside South Africa. Where this occurs, we apply the safeguards required by applicable data-protection law. You may ask our Information Officer about the relevant recipients, processing arrangements and safeguards.

You may raise an objection or concern about a disclosure with our Information Officer. Certain disclosures may nevertheless be necessary for a requested service or required by law; we will explain any resulting limitation on the service or your request.

8. Security and retention

We use reasonable and appropriate technical and organisational safeguards to protect information against unauthorised access, loss, misuse, disclosure or alteration. Digital safeguards include authentication, access restrictions and encrypted HTTPS communications between the App and Samba's services. Password credentials are protected using password hashing, and biometric-login tokens use the device's secure-storage facilities. No system or transmission can be guaranteed completely secure.

We retain personal information only for as long as it is needed for the disclosed purpose, an ongoing service relationship, or a legitimate legal, regulatory, security, fraud-prevention or dispute-management requirement. Retention is determined by record category and purpose. Information no longer needed is deleted or irreversibly de-identified. We do not retain information indefinitely merely because you have not objected.

Membership, transaction, credit, insurance and submitted business-service records may need to remain available after a mobile account is deleted because the underlying service, agreement, obligation or lawful retention requirement continues. These are not grounds to retain every item of App information. Section 10.6 explains what mobile-account deletion removes and which underlying records may remain.

Security records and restricted disaster-recovery backups remain protected during their applicable retention periods. Backup copies are removed as they expire under the backup retention process. If information is restored from a backup, relevant deletion requests must be reapplied. Where a provider processes associated information on our behalf, we request deletion when it is no longer needed and no applicable retention requirement permits or requires it to remain.

You may ask our Information Officer which categories of information are retained, their purposes and the applicable retention periods.

9. Access, correction, deletion and other privacy requests

Subject to applicable law, you may request access to personal information we hold about you, ask us to correct incomplete or inaccurate information, request deletion or restriction of information, or object to processing. Please help us keep your information current by notifying us of relevant changes.

Send requests to the Information Officer using section 2. We process verified requests without undue delay and explain the outcome, any lawful restriction, or any further information reasonably needed to complete the request. Certain records cannot immediately be deleted where an ongoing service or lawful retention requirement applies. We will explain the reason rather than treating all information as exempt from deletion.

For deletion of a mobile-app account, follow the specific in-app or email routes in section 10.6. Deleting a mobile account and ending the underlying Samba membership are separate matters.

10. Samba Lifestyle Mobile App

10.1 App information and purposes

The Samba Lifestyle Mobile App (“App”) is Samba's Android and iOS application, including versions listed as Samba on the app stores. It provides mobile access to existing membership and financial information and allows users to submit relevant enquiries and service requests.

In addition to the information described above, the App handles the following where relevant to the features you use:

  • Registration and authentication: member number, identification details used to verify registration, contact and verification information, password credentials and authentication tokens.
  • Account information: existing membership details, balances, transactions, statements, available facilities and finance-agreement information retrieved from Samba's records.
  • Applications and requests: information entered in product, finance, insurance or service requests; banking details or supporting documents where required; enquiries, messages and authorised referrals.
  • Device and service information: installation and push-subscription identifiers, push tokens, device model, operating system, app version, language, notification permission status, IP address, approximate location derived from IP, sessions, and notification delivery or interaction information. Our systems also process operational and security logs.
  • Optional location: approximate or precise device coordinates when you permit the store-finder feature to use your position.

We use this information to authenticate you, display your account, process requests, deliver communications, show participating stores, maintain security and investigate service problems. Required information is associated with the relevant feature; declining an optional permission may limit that feature without cancelling your membership.

10.2 Location and file permissions

When you use “Where can I buy”, the App can request your current location. If you permit it, coordinates are sent to Samba to find participating stores and calculate distances. The App does not request background-location permission for this feature. You may refuse or withdraw permission and use the available search functions without location-based distances.

When you choose to upload or save a document, the App uses the relevant file-selection or download facilities for that action. Making a referral does not require access to your whole address book. You can manage permissions through your device settings.

10.3 Push notifications and registered devices

The App uses OneSignal, Google Firebase Cloud Messaging on Android and Apple Push Notification service on iOS. Relevant device identifiers and tokens, notification content, technical information and delivery or interaction events are processed to register devices, route notifications and maintain the service.

Samba links each registered device's subscription identifier to the relevant mobile account. A notification for a member account may be sent to each enabled device registered to that account. Preferences apply per device; enabling or disabling notifications on one phone does not necessarily change another phone's preferences.

You can disable push delivery in the App's Settings or your operating-system notification settings. Doing so does not delete your account, erase existing messages or necessarily stop other communication channels. The notification software may still process technical or session information when the App opens even when push delivery is disabled.

Account notices and permitted promotions may appear in notifications. Content may be visible on a locked screen; use your device's preview settings if you wish to hide it. Section 6 explains how to object to optional marketing across channels.

10.4 Biometric sign-in and device storage

Biometric sign-in is optional. If you enable fingerprint, facial or other supported device authentication, the device's operating system performs the check. Samba does not receive or store fingerprint images, facial images or biometric templates for this sign-in feature.

The App stores authentication tokens and preferences on the device. The token used for biometric sign-in is held through secure-storage facilities. Disabling biometric sign-in removes the App's saved biometric-login credentials; it does not remove biometric information enrolled with the device manufacturer. Password sign-in remains available.

Protect your device and do not disclose your password or verification codes. Logging out, disabling biometrics or uninstalling the App does not itself request deletion of the mobile account.

10.5 App service providers

The notification providers in section 10.3 process the information needed for notifications. When Google Maps is opened in the store finder, Google also processes technical and map-interaction information. Other providers may support hosting, technical services, security, verification emails and documents as described in section 7.

Relevant information may also be supplied to a financial, insurance or other partner when you request that service. Additional processing is explained in the applicable service or application notice. We do not authorise service providers to sell personal or sensitive information collected through the App.

Provider information is available in OneSignal's privacy policy and Google's privacy policy. Their notices supplement this policy; Samba remains responsible for its own processing and provider arrangements, including applicable international-transfer safeguards.

10.6 Deleting your mobile-app account

You can permanently delete your mobile-app account from within the App:

  1. Sign in and open Settings.
  2. Select Delete Mobile Account.
  3. Read the explanation of what is deleted and what is retained.
  4. Enter your current password and confirm deletion.

When deletion completes successfully, your mobile authentication account and its login credentials are removed, authentication sessions are revoked, linked notification subscriptions are removed, and mobile-only activity records and private mobile-only messages are deleted. You are signed out. This is permanent account deletion rather than temporary account deactivation.

You can also request deletion without installing or signing into the App. Email CEO@sambakoop.com, for the attention of the Information Officer, with the subject “Delete Samba Lifestyle mobile account”. Provide your member number and a way for us to contact you. We may reasonably verify your identity before completing the request. Do not send your password or verification codes. We process verified requests without undue delay, confirm the outcome and explain any information that must be retained.

What may remain: deleting the mobile-app account does not itself terminate your underlying Samba membership, cancel a finance or insurance agreement, settle a balance or withdraw an existing business-service request. Associated membership, transaction, financial, contractual, enquiry, referral or service records may remain only where there is a continuing legitimate purpose or applicable retention requirement under section 8. We retain only the information needed for that purpose and assess separate requests for access, correction or deletion under section 9.

We request relevant service providers to delete associated App information held on our behalf where no applicable retention requirement permits or requires it to remain. Restricted security records and backup copies are handled under section 8. These exceptions do not permit blanket retention of all mobile-account information after deletion.

Uninstalling the App or turning off notifications does not delete the mobile account. If you later wish to use the App again, you will need to complete mobile registration and verification again.

11. Complaints

If you believe we have handled your information incorrectly, contact our Information Officer using section 2. We will investigate and respond to your concern.

You also have the right to lodge a complaint with South Africa's Information Regulator. Current complaint channels and contact details are published at inforegulator.org.za.

12. Changes and availability

We may update this policy as our services, processing activities or legal requirements change. We will publish the revised policy with an updated version date and provide additional notice or obtain renewed consent where required.

The current policy is available on Samba's public website and through the App. The mobile-account deletion instructions in section 10.6 can be used without access to the App by following the email-request route.