Privacy Policy

1. General

‍

The protection of your Personal Information is at the forefront of everything we do at Super Money SA. This Privacy Notice has been designed to explain how Super Money SA collects, uses, and protects your Personal Information when you interact with us via our websites, and our apps. We have written this Privacy Notice with you, our customers, in mind – keeping it simple and informative, to allow you to understand what we do with your Personal Information.

‍

2. Who are we?‍

‍

Super Money SA is a South African-registered financial services provider (FSP NUMBER 53458) committed to enabling secure, transparent, and innovative digital financial solutions. As a licensed financial service provider, Super Money SA is authorized to promote, support, and power ZAR Supercoin, a crypto-native platform designed to facilitate the sending, receiving, and storage of digital assets for individuals and businesses.

‍

ZAR Supercoin is a stable digital currency purpose-built for South Africa and the entire African market. Designed for speed, accessibility, and interoperability, ZAR Supercoin empowers users to send, save, and spend with confidence.

‍

Super Money SA is a company operating under South African regulatory frameworks, including the Financial Sector Conduct Authority (FSCA) and in full compliance with the Protection of Personal Information Act (POPIA), Super Money SA ensures that ZAR Supercoin’s offerings meet the highest standards of legal, financial, and operational integrity.

‍

Through its partnership with ZAR Supercoin, Super Money SA provides the regulatory, financial, and operational infrastructure required to support cross-border crypto transactions, merchant integrations, and compliance with AML/KYC regulations under the Financial Intelligence Centre Act (FICA). This allows users to engage with digital assets confidently, knowing their transactions are secure, compliant, and aligned with global best practices.

‍

Super Money SA’s role as the licensed financial service provider ensures that ZAR Supercoin is not only technologically advanced but also fully compliant, bridging the gap between innovative crypto solutions and regulated financial services in South Africa.

‍

Super Money SA is a proud member of the Super Group (“SGHC”), the holding company for leading global online sports betting and gaming businesses, which is company listed on the New York Stock Exchange.

‍

Super Money SA is a ”Responsible Party”, as defined under the Protection of Personal Information Act (POPIA), of your Personal Information as it relates to your use of our website and services.

‍

3. What is personal information?

‍

By “Personal Information”, we mean any data which can be used to identify you directly or indirectly. “Special Personal Information” is unique information about you, which can include your race, ethnicity, religion, political affiliations and health data. Special Personal Information is more sensitive and needs additional protection. “Criminal Convictions Data” is a separate category but may form part of a larger record that also contains Special Personal Information.

‍

We do not actively collect Special Personal Information from you, but there may be instances where this data is contained within information that you provide us, during your interactions with us.

‍

4. What personal information do we collect about you?

‍

When you use our website or services, we collect Personal Information about you. You are required to provide any Personal Information we reasonably require, to ensure we meet our obligations in connection with the services we provide to you, including any legal and regulatory obligations. Where you fail to provide such information, we may be unable to offer our services to you, or we may terminate the services provided to you with immediate effect.

‍

We have set out below what data we collect, how we collect it, and why we collect it.

‍

The Personal Information we collect will vary depending on how you use our services, but will generally include the following categories of Personal Information:

‍

Customer Information

• Identity: Full name, ID/passport, nationality, date of birth.
• Contact: Email, phone, address.
• Financial: Bank account, card, proof of funds.
• KYC/AML: ID documents, proof of residence, biometrics.

‍

Transactional Information

• Wallet addresses, transaction hashes, counterparties.
• Fiat conversion records.
• Cross-border remittance metadata.

‍

Technical Information

• Device identifiers, IP address, geolocation, cookies.
• Access logs and authentication tokens.

‍

Communications

‍

Your communications with us or our employees, for example, where you contact us via telephone, email, or messages sent through our live chat service, to enquire about our services. This also includes your responses to our communications and promotional campaigns.

‍

Once you have created an account and have become our customer, additional information is processed on an ongoing basis. We will only collect and process your Personal Information where we have a lawful basis to do so. We may rely on one or more of the following lawful bases:

• Consent (GDPR Art. 6(1)(a), POPIA S11(1)(a)) – marketing, optional services.
• Contractual necessity (GDPR Art. 6(1)(b), POPIA S11(1)(b)) – provision of core services.
• Legal obligation (GDPR Art. 6(1)(c), POPIA S11(1)(c)) – AML/KYC, FICA reporting.
• Legitimate interest (GDPR Art. 6(1)(f)) – fraud detection, cybersecurity.
• Public interest (GDPR Art. 6(1)(e)) – cooperation with regulatory authorities.

Where we rely on consent as our lawful basis of processing, we will ensure that the consent is:

• Freely given
• Confirmed by completing a opt in action, such as ticking a box
• Easy for you to understand
• Easy for you to withdraw

5. How do we collect and process your personal information

‍

This section outlines how we collect your Personal Information, and the sources which we may collect it from. We may collect your Personal Information from:

‍

You Directly

‍

For example, the data you give to us to open your account or when you communicate with us.

‍

‍

Publicly Available Resources

‍

We may use data, which is publicly available from resources such as news articles, social media platforms, forums, official records such as the electoral roll. These searches allow us to meet our legal and regulatory obligations and may be used to facilitate the prevention and detection of crime.

‍

‍

Third Parties

‍

We may collect information about you from third-party service providers for various reasons. These may include the purposes of identification, ensuring that our website is safe and secure, to continue to offer services to you and to comply with our legal and regulatory obligations including the requirements of our gambling regulators.

‍

‍

Information We Collect Automatically

‍

We automatically collect some information when you visit our website or when we provide the services to you or send you communications. These automated methods may involve the collection of the following categories of Personal Information:

‍

‍

Online identifiers

‍

Your IP address, MAC address, device ID, location data, and other related technical information collected during your use of the services.

‍

‍

Analytics information

‍

Your browser type and version, browser language, date and time of visit and details of your engagement with and use of the services (e.g. your analytics and traffic information), including the number of visits to our websites, what pages you have visited and what links you have clicked on. For further information, please see our onsite Cookie Notice.

‍

‍

Cookie information

‍

We automatically collect cookie information when you browse our website. When we collect this information, we either do so with your consent or because it is in our legitimate commercial interests to process the information to ensure the services operate effectively. For further please refer to the “Lawful bases for processing” section of this Privacy Notice and our Cookie Notice.

‍

‍

Information we collect indirectly

‍

When we provide the services, we may collect some Personal Information about you indirectly. This information is sourced from our third-party partners, public records or publicly accessible news websites and social media platforms and may include information about your age, identity interests and interactions, political affiliations, credit history, bankruptcy status, sanctions and criminal convictions.

‍

‍

6. How we use your personal information

‍

We use your Personal Information to:

‍

‍

Identify you and verify your customer account

‍

We use the registration and identification information you provide, as well as information we collect indirectly from our third-party partners, to assess your suitability to receive the services. This assessment may involve, data accuracy, identity, age verification, fraud prevention and anti-money laundering checks. These checks may be carried out prior to and during the course of the services being provided to you.

‍

Super Money SA prohibits onboarding individuals under 18 years old and conducts enhanced due diligence for vulnerable persons, in line with FIC and AML directives.

We carry out this processing to comply with our legal and regulatory obligations.

‍

‍

Conduct affordability checks

‍

In certain circumstances, we will use some of your Personal Information, such as your name, address and date of birth, to carry out a credit history check, to assess whether you can afford to use our services. This credit check may leave a search footprint, but please note that this will not affect your credit score. These checks may be carried out prior to and during the course of the services being provided to you.

‍

We carry out this processing to comply with our legal and regulatory obligations.

‍

‍

Provide you with our services and manage and administer your customer account.

‍

We use your registration and transaction information to provide the services to you generally, in accordance with our Terms and Conditions, including creating, managing and administering your customer account.

‍

We carry out this processing to comply with our legal and regulatory obligations and, where necessary to perform our contractual obligations.

‍

‍

Process your payment and wager transactions

‍

We use your registration and transaction information to process your payment, deposit, withdrawal and wager transactions.

We carry out this processing to comply with our legal and regulatory obligations

‍

‍

Personalise the services we provide

‍

We use your registration, online identifiers and analytics information to personalise and tailor the services we provide to you, to ensure you receive the best customer experience on your device and are able to use the services in your current location.

‍

We carry out this processing to pursue our legitimate commercials interests. In particular, we have a legitimate interest in ensuring we tailor our services to reflect your specific needs and interests, so you receive the best customer experience.

‍

‍

Send you direct marketing and promotions

‍

If you give us your consent to send you direct marketing, we will use your registration, transactional, analytics and communication information, to send you promotional material about our services and other products that we feel may be of interest to you, using the communication channels you have authorised us to use.

‍

Where you consent to direct marketing, we will send you promotional material for the period that you remain a customer and for a reasonable period thereafter, unless you notify us that you no longer wish to receive these communications.

‍

You can choose not to receive direct marketing at any time by changing your marketing preferences in your Account section of our website. You can also unsubscribe from SMS and direct marketing email communications by clicking on the unsubscribe option included in every direct marketing message we send. If you opt out of direct marketing, we will take steps to ensure you no longer receive such communications from us.

‍

We will, however, still send you important updates about our services and any changes we make concerning your account.

We carry out this processing with your consent.

‍

‍

Respond to your enquiries and complaints

‍

Where you enquire or complain about our services, we will use your Personal Information to investigate, manage and administer your enquiry or complaint and provide a response to you.

If you have connected with us or contacted us using your social media account, we may also contact you by this method.

We carry out this processing where necessary to pursue our legitimate commercial interests. In particular, we have a legitimate interest in responding to your enquiries and complaints, to ensure the proper function of our services and to continually improve our commercial offerings.

‍

‍

Conduct profiling

‍

We may use your Personal Information, to create new Personal Information about you, that is derived from inferences and predictions that we make about you. We may use a combination of manual reviews and automated detection systems, supported by machine learning, to carry out this processing.

‍

This information will be used for the following purposes:

1. To ensure our services can be provided in your country location.
2. To ensure you use our services safely and responsibly.
3. To develop new features, functionality, products and services that are tailored to you.
4. To ensure the technical support you receive is tailored to the device that you use; and
5. To ensure the promotions you receive are tailored to your preferences.

We carry out the processing listed above under points (a) to (b), to comply with our legal and regulatory obligations.

‍

With regard to the processing listed under points (c) to (d), this is carried out to pursue our legitimate commercial interests, i.e. (i) we have a legitimate interest in ensuring we tailor our services to reflect your specific needs and interests, so you receive the best customer experience and (ii) we have a legitimate interest in ensuring the technical support you receive is tailored to your specific needs.

‍

We only carry out the processing listed above under point (e) with your consent.

‍

‍

Manage risks and operate our business

‍

We use your Personal Information to operate our business generally. This may include enforcing our Terms and Conditions, defending legal claims, conducting internal and external compliance audits, and managing and monitoring information security and financial risks.

‍

We carry out this processing where necessary to pursue our legitimate commercial interests, in particular, this processing is necessary to ensure we manage risks associated with our business and operate our sound system of internal controls.

‍

‍

Comply with legal and regulatory obligations

‍

We use your Personal Information to comply with our legal and regulatory obligations. We are subject to various legal and regulatory obligations, including but not limited to, obligations relating to our gambling licenses and registrations, betting integrity, anti-money laundering, responsible gambling requirements, and other laws requiring us to prevent and detect fraud and other financial crime.

‍

‍

Prevent and detect crime

‍

We use your Personal Information to prevent and detect fraud, or any other financial crime.

‍

We carry out this processing to comply with our legal and regulatory obligations and where necessary, to pursue our legitimate commercial interests. In particular, it is in our legitimate interests and the interests of our customers to prevent and detect fraud and other financial crime to safeguard our services

‍

‍

Diagnose research and develop our services

‍

We use your online identifiers and analytics information to help with internal research and development and testing of our services to help diagnose system issues and make content and service improvements to the website.

‍

We carry out this processing where necessary to pursue our legitimate commercial interests. In particular, we have a legitimate interest in measuring engagement with our services and testing and developing the efficiency of customer journeys to optimise and continually improve our services.

‍

‍

7. Why do we process your personal information?

‍

We need your Personal Information to be able to perform the contract we are about to enter in to, or have entered in to, with you. By opening an account with us you are entering into a contract with us. Without this data, we cannot honour the contract and give you the best possible experience.

‍

We have legal and regulatory obligations which we must comply with, including, but not limited to, anti-money laundering, fraud detection and prevention, responsible gambling requirements and identifying and verifying you as a customer.

‍

Your profile and financial data may be reviewed for the purposes of enforcing our Terms and Conditions, managing our financial liabilities and risk on events and markets. For more information, please see our Terms and Conditions.

‍

‍

8. How do we process your personal information for marketing?

‍

You can update how you wish to receive marketing and/or promotional material at any time by using the marketing preference centre which you can access in your Account section or using options within the marketing messages we send. When you have opted out of receiving marketing communications from us, we will take all reasonable steps to ensure you no longer receive promotional material about us. If you opt out of receiving marketing communications, you will still receive transactional emails or service messages, relating to the maintenance of, service of, and changes to, your account.

‍

Our marketing may contain information about the following:

• Our services and products
• Promotional information
• Marketing information about other great brands within the Super Group

To obtain feedback on our processes, products, and services, we may send you surveys. You can opt out of receiving surveys within the correspondence we send. Please be aware, if you opt out of marketing, you are not automatically opted out of receiving surveys – you will need to opt out of each independently.

‍

‍

Social Media Marketing

‍

We may also use information you provide to us to show you relevant advertising and personalised content about us on certain third-party social media platforms (e.g., Facebook, Twitter).

‍

We do not control the way these platforms operate and collect your information. You should read their respective privacy policies online to understand how they use your Personal Information and how to opt out of their marketing strategies.

‍

‍

Marketing Communications from within the wider Super Group

‍

You will only receive marketing communications from the wider Super Group if you have opted in. On our website, you may be invited to opt-in to receive marketing communications about products and offers from our wider group structure. If you decide to opt-in, your information will be passed to other entities within the wider Super Group and treated in accordance with their own Privacy Notices as available on their websites.

‍

‍

9. Who do we share your personal information with?

‍

We may share your information with the categories of third-parties outlined below. These third-parties may be “Responsible Parties” or “Operators” in respect of your Personal Information, for the purposes explained above.

‍

‍

Within Super Group

‍

Your data may be shared within the wider Super Group if we have a legal obligation to do so, or if we have an appropriate lawful basis such as consent for marketing.

‍

‍

With Trusted Third-Parties

‍

We may share your data with certain trusted third-party companies such as credit reference and fraud prevention agencies, as well as our service providers, who help us to deliver services essential for offering our products, to you. These third-parties may include:

• third parties handling Super Money SA data must sign Data Processing Agreements (DPAs) with GDPR/POPIA clauses.
• Crypto merchant counterparties undergo compliance vetting (AML, sanctions screening, data security reviews).

Super Money SA maintains an Onward Transfer Register to demonstrate accountability for cross-border sharing.

‍

‍

With Statutory Authorities

‍

In some circumstances, we are legally obligated to provide your Personal Information to statutory authorities, these include:

• Government authorities, such as the police
• Regulators and governing bodies

‍

International Transfers

‍

Super Money SA routinely transfers data outside South Africa for settlement and compliance purposes. Safeguards include:

• POPIA Section 72 compliance – transfer only where adequate protection or binding agreements exist.
• Standard Contractual Clauses (SCCs) for EU data transfers.
• Binding Corporate Rules (BCRs) – under development for intra-group transfers.
• Data Privacy Framework adherence for U.S. recipients.
• Onward Transfer Controls – vendors contractually bound to equivalent standards.

If you require further information concerning these safeguards, please contact our Information Officer.

‍

‍

Other Circumstances

‍

We may send anonymised data to third-parties to evaluate new technologies and improve service levels.

‍

We may share your Personal Information in connection with, or during, negotiations of any potential sale or investment in Super Money SA or the wider Super Group, in support of the transaction (e.g., a sale of a substantial part of our respective businesses, merger, financing, restructuring, consolidation, acquisition, corporate divestiture, dissolution transaction or other proceeding involving the sale, transfer, divestiture or disclosure of all, or a portion of, our business or assets). In the event of an insolvency, bankruptcy, or receivership, your Personal Information may also be transferred as a business asset. If this happens, we will contact you and explain your options regarding your Personal Information. However, if your Personal Information is transferred in these circumstances it will continue to be used in accordance with this Privacy Notice.

‍

‍

We will also disclose information where necessary to enforce our terms of use, as stated in our Terms and Conditions.

‍

‍

10. How we keep your personal information safe

‍

We have implemented and maintain appropriate security measures to prevent your Personal Information from loss, unauthorised use, access, alteration, or disclosure, including:

• Encryption of personal and transaction data at rest and in transit.
• Cold and hot wallet segregation for digital assets.
• Multi-factor authentication for user and admin access.
• Intrusion detection & monitoring.
• Vendor security audits.
• Data breach response plan – aligned with POPIA S22 and GDPR Art. 33 (72-hour regulator notification).

Where appropriate, we employ encryption, pseudonymisation (for example, by using your customer ID rather than full name) and anonymisation solutions to reduce the impact of any security incident to Personal Information. Although, the nature of the internet means that transmission and storage of information may not be totally secure, we have deployed end to end encryption to protect your Personal Information in transit and static encryption to protect your Personal Information at rest.

‍

In addition, we limit access to your Personal Information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your Personal Information on our instructions, and they are subject to a duty of confidentiality.

‍

‍

Managing security incidents relating to Personal Information:

‍

We have procedures to deal with any suspected Personal Information breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

If you have any reason to believe that your Customer Account information may no longer be safe, please contact our customer support staff immediately.

‍

‍

Keeping your Customer Account safe:

‍

When you create a Customer Account with us, we ask you to choose a password. We use password protection to ensure your Customer Account always remains safe and secure and can only be accessed by you.

‍

You must choose a password that is strong and unique (not used elsewhere); you should frequently change your password. You must not share your username and password with anyone. If you suspect your password has been disclosed, change it immediately to ensure your Customer Account remains safe.

‍

If you use a passkey (unique code or password) or biometric identification (such as fingerprint, face-scan or screen lock) to verify your identity on your device to access our products or services, this data is never shared with Betway. The passkey itself is stored on your local computer or mobile device, which will ask for your screen lock biometrics or PIN to confirm your identity. Biometric data is never shared with Betway or any of our third parties.

‍

When you choose to make payments using Google Pay or Apple Pay, we do not receive or store any Personal Information or payment card details from these services. All sensitive information is handled directly by Google or Apple in accordance with their own privacy policies.

‍

‍

11. Retention of your personal information

‍

We retain your Personal Information for the period you remain an active customer with us. When you are no longer an active customer, we will continue to retain your Personal Information for as long as is necessary to comply our legal and regulatory obligations, such as those imposed under taxation, financial accounting, gambling, anti-money laundering or statute of limitation laws. For example:

• Financial and KYC records – minimum 5 years (FICA obligation).
• Transactional records – up to 7 years (tax and regulatory compliance).
• Marketing and consent-based data – until withdrawal or inactivity.

Secure deletion and anonymization protocols apply at end of lifecycle.

‍

Data deletion is not an absolute right and there may be times where we must retain your data, even after you’ve enacted your rights.

‍

‍

12. Your data subject rights

Your Personal Information belongs to you, and current data protection laws give you rights in relation to this data:

• Access (POPIA S23, GDPR Art. 15).
• Rectification (POPIA S24, GDPR Art. 16).
• Erasure (GDPR Art. 17; subject to FICA retention duties).
• Restriction of processing (GDPR Art. 18).
• Objection to processing (POPIA S11(3), GDPR Art. 21).
• Data portability (GDPR Art. 20).
• Withdrawal of consent (POPIA S11(2), GDPR Art. 7(3)).

These rights can be exercised at any time and free of charge.

‍

In certain circumstances when you exercise your rights, we may need to request further information, such as identification, from you to validate your request. We will aim to satisfy your request within one calendar month of receipt, but where this isn’t possible, we will contact you directly to provide an explanation.

‍

For any further queries related to your rights, please contact our Information Officer.

‍

‍

Contacting us about this Privacy Notice

‍

If you have any questions or comments about this Privacy Notice, or how we use your Personal Information, please contact our Information Officer.

‍

Super Money SA – Privacy & Compliance Office

‍

Address: Super Money SA (Pty) Limited 1 Waterview Close, Century City, Cape Town, South Africa

‍

If you have a data protection complaint, please contact us using the details above and we will do our best to resolve this with you directly. If you are not satisfied with our response, you have the right to complain to a data protection regulator.

• Information Regulator, South Africa – [email protected].
• EU/UK Supervisory Authorities – per jurisdiction.
• U.S. Recourse Mechanism – via Privacy Shield/DPF arbitration channels.

‍

13. Changes to this notice

‍

We reserve the right to amend this Privacy Notice at any time. As a minimum, it will be reviewed annually or upon major regulatory change. Amendments will be published and notified to stakeholders.

‍

‍

Policy Adoption Date: 2025/10/01

‍

Version: 1.0