Privacy Policy

1. Purpose and scope

1.1 Purpose

This policy explains how Omnea (Pty) Ltd (“Omnea”, “we”, “us” or “our”) collects, uses, shares and protects personal information that we obtain through our website, www.omnea.co.za, and through the enquiry, contact and newsletter channels linked to it. It is the notification required by section 18 of the Protection of Personal Information Act 4 of 2013 (POPIA) for that processing.

Words used in this policy have the meaning given to them in POPIA unless they are defined in section 3 below. This policy stands on its own and does not depend on any other website terms.

1.2 Scope

This policy applies to:

• visitors to www.omnea.co.za;
• people who contact us through the website, by email or by telephone, request information, or subscribe to our communications; and
• representatives of prospective clients, partners and suppliers whose details reach us through those channels.

It does not cover personal information we process when providing payment services to our clients and their end users, or information about our employees. Those are governed by PI-01 Protection of Client Information Policy, the applicable client agreements, and PI-02 Protection of Employee Information Policy.

1.3 Who we are

Omnea (Pty) Ltd (registration number 2019/478958/07) is a South African payment facilitator authorised by the Payments Association of South Africa as a Third-Party Payment Provider and System Operator, and forms part of the XEA Capital group. Omnea is the responsible party for the processing described in this policy.

Back to top

3. Definitions

• Personal information: information relating to an identifiable, living natural person or an identifiable, existing juristic person, as defined in section 1 of POPIA. This includes online identifiers such as IP addresses and cookie identifiers where they can be linked to a person.
• Usage data: technical information about how the website is accessed and used, such as IP address, browser type and version, device type, pages visited, referring site, and date and time of the visit.
• Cookies: small data files placed on your device by a website. Strictly necessary cookies are needed for the website to work or to keep it secure. Analytics cookies help us understand how the website is used and are only set with your consent.
• Operator: a person who processes personal information for Omnea under a contract or mandate, without coming under Omnea’s direct authority (POPIA section 1).
• Direct marketing: approaching a person to promote or offer goods or services, as defined in section 1 of POPIA.

Back to top

5. How we handle your information

5.1 Information we collect

We do not use the website to collect special personal information (such as health, religious or biometric information) or information about children. Please do not send us such information through the website.

5.2 Why we use it and our lawful basis

Where we rely on legitimate interest, you may object to the processing at any time (see section 5.9). We do not use the website to make decisions about you based solely on automated processing, as contemplated in section 71 of POPIA.

5.3 Cookies and analytics

When you first visit the website, a cookie banner asks whether you accept analytics cookies. Until you accept, only strictly necessary cookies are set. You can change your choice at any time through the “Cookie settings” link in the website footer, or block or delete cookies in your browser settings.

We do not use advertising or cross-site tracking cookies on the website.

5.4 Direct marketing

We send electronic direct marketing (email, SMS or similar) only in line with section 69 of POPIA:

• if you are not an Omnea client, only where you have actively opted in, for example by ticking an unticked box on a website form; or
• if you are an existing Omnea client, only about our own similar products or services, and only where you were given the chance to opt out when your details were collected.

Every marketing message tells you who it is from and includes a simple way to unsubscribe. We act on unsubscribe requests without undue delay and keep a record of the opt-out so that we do not contact you again. We do not sell, rent or trade personal information.

5.5 Who we share it with

We share personal information only where necessary for the purposes in section 5.2:

• Operators that provide services to us, such as website hosting and administration, analytics, and email and customer-relationship platforms. Each operator processes the information only on our instructions, under a written agreement requiring appropriate security measures (POPIA sections 20 and 21).
• XEA Capital group companies, where needed to respond to your enquiry or provide a service you asked about, and subject to the same protections as this policy.
• Regulators, law enforcement agencies and courts, where we are required or permitted by law to disclose information.
• Professional advisers (such as auditors and legal advisers), under a duty of confidentiality.

5.6 Cross-border transfers

Some of our operators may store or process personal information outside South Africa, for example in cloud hosting or analytics services. We transfer personal information outside South Africa only where section 72 of POPIA permits it. In particular, the recipient must be subject to a law, binding corporate rules or a binding agreement that gives a level of protection substantially similar to POPIA, or the transfer must be necessary to perform a contract with you or be based on your consent.

5.7 Security

We protect personal information with appropriate, reasonable technical and organisational measures, as required by section 19 of POPIA. These are maintained within Omnea’s information security management system, which is aligned with ISO/IEC 27001. Measures include encryption of information sent to and from the website (TLS), access controls, logging and monitoring, and supplier security requirements. If we have reasonable grounds to believe your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as required by section 22 of POPIA.

5.8 How long we keep it

We keep personal information only for as long as needed for the purpose for which it was collected, or as required by law (POPIA section 14). After that it is deleted, destroyed or de-identified.

5.9 Your rights

Under POPIA you have the right to:

• ask whether we hold personal information about you and request access to it (section 23). Requests are handled through PI-11 PAIA Manual, published on our website. There is no request fee when you ask for your own personal information;
• ask us to correct or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (section 24), using Form 2 under the POPIA Regulations;
• object to processing based on legitimate interest, and to direct marketing (sections 11(3) and 69), using Form 1 under the POPIA Regulations, or by unsubscribing;
• withdraw your consent at any time, including for analytics cookies and marketing, without affecting processing that took place before you withdrew it; and
• lodge a complaint with the Information Regulator (section 74).

Send requests to the Information Officer using the details in section 5.11. We may ask you to verify your identity before acting on a request. The POPIA forms are available from the Information Officer or the Information Regulator’s website.

5.10 Children and links to other websites

The website is not directed at anyone under 18, and we do not knowingly collect their personal information. If a parent or guardian believes a child has given us personal information, they may contact us to have it deleted.

The website may link to websites we do not operate. We are not responsible for their content or privacy practices, and we recommend reading their privacy policies.

5.11 Contact us and the Information Regulator

If you are not satisfied with how we have handled your personal information or a complaint, you may contact the Information Regulator (South Africa):

5.12 Changes to this policy

We may update this policy from time to time. The current version, with its effective date, is always published on the website. Where a change materially affects how we process your personal information, we will draw attention to it on the website before it takes effect.

Back to top