PRIVACY POLICY
FinToolbox — a division of Ziyanda Capital
Website: www.fintoolbox.online
Effective Date: 1 June 2025 | Version: 1.0

IMPORTANT NOTICE

This document constitutes a legally binding agreement between you and Ziyanda Capital, a division of Ziyanda Investment Enterprises (Pty) Ltd, operating FinToolbox at www.fintoolbox.online. By accessing or using this platform, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy in its entirety. If you do not agree, you must immediately cease use of the platform. This Privacy Policy applies to all users regardless of geographic location

1. INTRODUCTION & SCOPE

Ziyanda Capital (“we”, “us”, “our”, or the “Company”) is a structured finance consultancy operating FinToolbox (the “Platform”), an online financial calculation and insights toolbox accessible at www.fintoolbox.online. FinToolbox is a division of Ziyanda Capital and does not constitute a separate legal entity. 

This Privacy Policy describes how we collect, use, store, protect, transfer, and disclose information about individuals (“you”, “your”, or “User”) who access or use the Platform.

This Privacy Policy is designed to comply with all applicable data protection and privacy legislation in every jurisdiction in which we operate, including:

– South Africa: Protection of Personal Information Act 4 of 2013 (POPIA) — Primary jurisdiction
– United Kingdom: UK GDPR and Data Protection Act 2018
– Botswana: Data Protection Act 2018 (Act No. 32 of 2018)
– Zambia: Data Protection Act No. 3 of 2021
– Lesotho: Computer Crime and Cybersecurity Act 2021
– Mozambique: Law No. 7/2017 and Decree No. 19/2021
– Namibia: Namibia Data Protection Act (anticipated — see Section 13.7)                          

– European Union – Regulation (EU) 2026/679 (the General Data Protection Regulation

– United States of America – US Data Protection Expectations  

– Canada – PIPEDA and Provincial Legislation 

References to “Applicable Laws” mean all relevant data protection, privacy, consumer protection, financial services, electronic communications, and related legislation in each such jurisdiction, as amended or replaced from time to time. Where local laws impose more stringent requirements than the general provisions of this Policy, such local requirements shall apply. In the event of any irreconcilable conflict between this Policy and mandatory Applicable Law, the mandatory legal requirement shall prevail.

2. NATURE OF THE PLATFORM — NO FINANCIAL ADVICE

IMPORTANT DISCLAIMER: THE PLATFORM IS A FINANCIAL INSIGHTS AND CALCULATION TOOL ONLY. NOTHING ON THE PLATFORM CONSTITUTES FINANCIAL ADVICE, INVESTMENT ADVICE, TAX ADVICE, LEGAL ADVICE, OR ANY OTHER REGULATED PROFESSIONAL ADVICE. ALL CALCULATIONS, OUTPUTS, TEMPLATES, AND MODELS ARE PROVIDED FOR INFORMATIONAL AND EDUCATIONAL PURPOSES ONLY — TO ASSIST USERS IN ENGAGING MORE EFFECTIVELY WITH THEIR OWN QUALIFIED PROFESSIONAL ADVISORS. USERS MUST SEEK INDEPENDENT PROFESSIONAL ADVICE BEFORE MAKING ANY FINANCIAL DECISION.

FinToolbox provides self-service calculation tools including, without limitation: mortgage payment calculators, loan repayment calculators, compound interest calculators, retirement savings planners, business breakeven analysis tools, three-statement financial models, personal budget templates, and tax estimation calculators. These tools process data entered by the User solely to generate mathematical outputs requested by the User.

The Company is not a bank, financial institution, credit provider, financial services provider, investment manager, tax practitioner, or any other regulated entity in any jurisdiction in which it operates. Registration or use of the Platform does not create any advisory, fiduciary, professional, or client relationship between you and Ziyanda Capital or FinToolbox.

Ziyanda Capital provides structured finance consultancy services as a separate line of business. Access to and use of the FinToolbox platform does not constitute engagement of Ziyanda Capital’s consultancy services, and no consultancy relationship shall arise from use of the Platform.

3. INFORMATION WE COLLECT 

3.1 Information You Provide Directly

When you register for or use the Platform, you may provide:

– Account registration information: name, email address, username, and password;
– Profile information: country of residence, preferred currency, and language settings;
– Financial inputs entered into the Platform’s calculation tools, including income figures, debt amounts, interest rates, savings goals, business revenue and cost data, tax-related inputs, and similar numerical data;
– Template data and financial model data saved by you on the Platform;
– Communications: emails, support requests, feedback, and survey responses submitted to us;
– Payment information (if applicable): billing details processed via our third-party payment processors. We do not store full card numbers on our systems.

3.2 Information Collected Automatically

When you use the Platform, we automatically collect technical and usage data, including:

– Device information: device type, operating system, browser type and version, screen resolution, and device identifiers;
– Log data: IP address, access timestamps, pages viewed, features used, error logs, and referring URLs;
– Usage analytics: frequency and duration of sessions, features interacted with, and navigation paths;
– Cookies, web beacons, pixel tags, local storage objects, and similar tracking technologies (see Section 9);
– Location data: approximate geographic location inferred from IP address. We do not collect precise GPS location without your explicit consent.

3.3 Information From Third Parties

We may receive information about you from third parties, including authentication providers if you log in via a third-party identity service, analytics and fraud prevention partners, and publicly available databases where permitted by law.

3.4 Sensitive Personal Information

We do not intentionally collect special categories of personal information (such as health data, racial or ethnic origin, political opinions, religious beliefs, or biometric data). Financial input data you voluntarily enter into the Platform’s tools is treated with heightened protection. You should avoid entering information that could directly or indirectly identify a third party who has not consented to sharing their information with us. 

Where any such information is inadvertently provided, you authorise us to treat it as “sensitive personal information” and apply enhanced safeguards, and you accept that you do so at your own risk and without expectation of confidential treatment beyond the measures described in this Policy

4. LEGAL BASIS FOR PROCESSING

We process your personal information only where we have a lawful basis to do so. Depending on the activity and applicable jurisdiction, our processing is based on one or more of the following grounds:

– Performance of a contract: to provide you access to the Platform and its features pursuant to our Terms of Service;
– Legitimate interests: to operate, maintain, secure, and improve our Platform, prevent fraud, enforce our policies, and develop new features, where such interests are not overridden by your fundamental rights and freedoms;
– Compliance with a legal obligation: to meet our obligations under tax, financial reporting, anti-money laundering, record retention, or other mandatory legal requirements;
– Consent: where required by law, we will ask for your explicit, freely given, specific, informed, and unambiguous consent before processing — particularly for marketing communications, non-essential cookies, and any processing of sensitive data;
– Protection of vital interests: in rare circumstances where processing is necessary to protect life;
– Public task or public interest: where applicable under local law.

You may withdraw consent at any time where processing is consent-based, without affecting the lawfulness of prior processing. Withdrawal of consent may affect your ability to use certain features of the Platform. To withdraw consent, contact us at privacy@fintoolbox.online.

5. HOW WE USE YOUR INFORMATION

5.1 Providing the Platform

– Creating and managing your user account;
– Processing calculation inputs and returning results;
– Storing saved templates, models, and calculation histories associated with your account;
– Authenticating your identity and maintaining session security;
– Processing payments and managing subscriptions where applicable.

5.2 Platform Improvement and Development

– Analysing aggregated, de-identified usage data to improve features and user experience;
– Conducting research and analytics to understand how the Platform is used;
– Testing new tools and calculation methodologies;
– Debugging, error tracking, and performance monitoring.

5.3 Security and Fraud Prevention

– Detecting, preventing, and responding to fraud, abuse, security incidents, and unauthorised access;
– Verifying identity and preventing impersonation;
– Monitoring for unusual activity and enforcing our Terms of Service.

5.4 Communications

– Sending transactional messages such as account confirmations, password resets, and service updates;
– Responding to your support requests and enquiries;
– Sending marketing or promotional communications where you have opted in or where permitted by law, with an opt-out mechanism provided in every such communication.

5.5 Legal and Compliance

– Complying with applicable laws, regulations, court orders, and lawful requests from governmental authorities;
– Exercising or defending legal claims;
– Meeting financial record-keeping and audit obligations.

6. DISCLOSURE OF YOUR INFORMATION

We do not sell your personal information to any third party.

6.1 Service Providers

We engage trusted third-party service providers who process personal information on our behalf, subject to appropriate data processing agreements and confidentiality obligations. Categories include: cloud hosting and infrastructure providers; payment processors; analytics providers; customer support platforms; cybersecurity and fraud prevention services; and email delivery services.

6.2 Business Transfers

In the event of a merger, acquisition, sale of assets, reorganisation, or similar corporate transaction, your personal information may be transferred as part of such transaction. We will notify you via email and/or prominent notice on the Platform prior to your information becoming subject to a materially different privacy policy, and will use reasonable efforts to ensure the acquirer provides equivalent privacy protections.

6.3 Legal Requirements and Safety

We may disclose personal information if required or permitted to do so by Applicable Law, including to respond to subpoenas, court orders, or lawful governmental requests; to enforce our Terms of Service; to protect the rights, property, or safety of the Company, our users, or the public; to prevent or investigate fraud or security incidents; or to meet regulatory reporting obligations.

6.4 Aggregated and De-identified Data

We may share aggregated or de-identified information that cannot reasonably be used to identify you with third parties for research, marketing, or analytics purposes. Such information is not personal information for the purposes of this Policy.

7. CROSS-BORDER TRANSFERS OF PERSONAL INFORMATION

As a multi-jurisdictional platform, we may transfer personal information across national borders. We implement the following safeguards depending on the applicable transfer:

– Standard Contractual Clauses or equivalent approved transfer mechanisms (UK IDTA where applicable);
– Transfers to countries recognised as providing an adequate level of protection by relevant data protection authorities;
– Binding corporate rules or equivalent intra-group transfer agreements;
– Your explicit consent where required for specific transfers.

Jurisdiction-specific transfer requirements are addressed in Section 13. In particular, cross-border transfers from South Africa comply with section 72 of POPIA; transfers from the UK comply with Chapter V of the UK GDPR; and all other jurisdictions’ transfer requirements are addressed individually in Section 13.

8. DATA RETENTION

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. Our general retention guidelines are:

– Account and profile data: retained for the duration of your account and for up to 7 years after account closure, to comply with financial record-keeping laws across our operating jurisdictions;
– Financial input data entered into calculation tools: retained for the duration of your session unless you elect to save it to your account, in which case retained until you delete it or your account is closed;
– Log and technical data: typically retained for 12 to 24 months, subject to security and legal requirements;
– Communications and support records: retained for up to 5 years from the date of the last interaction;
– Legal hold: we may retain data beyond standard periods where required by ongoing legal proceedings, regulatory investigations, or applicable law.

Following the expiry of the applicable retention period, personal information will be securely deleted or irreversibly anonymised in accordance with industry-standard practices.

9. COOKIES & TRACKING TECHNOLOGIES 

We use cookies and similar technologies to operate the Platform, remember your preferences, analyse usage, and (where you have consented) deliver relevant content. Categories of cookies we use:

– Strictly necessary cookies: essential for the Platform to function. These cannot be disabled without impairing core functionality;
– Functional cookies: enable personalisation features such as language and currency preferences;
– Analytics cookies: help us understand how the Platform is used (e.g. pages visited, time on site);
– Marketing cookies: used to deliver relevant communications where you have opted in. Always consent-based.

You may manage your cookie preferences at any time through the Cookie Preference Centre accessible from the footer of the Platform, or through your browser settings. Where applicable law requires prior consent for non-essential cookies (including the UK PECR and equivalent regulations in other jurisdictions), we will obtain such consent before placing those cookies.

10. INFORMATION SECURITY

We implement appropriate technical and organisational measures to protect personal information against unauthorised access, disclosure, alteration, destruction, or accidental loss. These measures include:

– Encryption of data in transit using TLS 1.2 or higher;
– Encryption of data at rest using AES-256 or equivalent standards;
– Access controls, role-based permissions, and multi-factor authentication for staff accessing systems containing personal information;
– Regular penetration testing, vulnerability scanning, and security audits;
– Incident response procedures and data breach notification processes compliant with Applicable Laws.

No method of transmission over the Internet or electronic storage is completely secure. While we strive to protect your personal information, we cannot guarantee absolute security. You access the Platform at your own risk and are responsible for maintaining the confidentiality of your account credentials.

In the event of a personal information breach likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, affected individuals in accordance with the timeframes prescribed by Applicable Law.

11. YOUR RIGHTS

Depending on your jurisdiction, including the European Union under the GDPR, you may have some or all of the following rights in relation to your personal information. We endeavour to honour the most comprehensive set of rights available to you under all Applicable Laws, including the GDPR, POPIA, UK GDPR, and other national data protection legislation.

Depending on your jurisdiction, you may have some or all of the following rights in relation to your personal information. We endeavour to honour the most comprehensive set of rights available to you under all Applicable Laws:

– Right to be informed: to receive clear and transparent information about how your data is used (fulfilled by this Policy);
– Right of access: to request a copy of the personal information we hold about you;
– Right to rectification: to request correction of inaccurate or incomplete personal information;
– Right to erasure / right to be forgotten: to request deletion of your personal information, subject to legal retention obligations;
– Right to restriction: to request that we limit the processing of your personal information in certain circumstances;
– Right to data portability: to receive your personal information in a structured, commonly used, machine-readable format where applicable;
– Right to object: to object to processing based on legitimate interests or for direct marketing purposes;
– Right not to be subject to solely automated decision-making: the Platform does not use solely automated decision-making that produces legal or similarly significant effects on you;
– Right to withdraw consent: to withdraw consent at any time where processing is consent-based;
– Right to lodge a complaint: to lodge a complaint with the applicable data protection supervisory authority in your jurisdiction (see Section 15).

To exercise any of these rights, please contact us at privacy@fintoolbox.online. We will respond within the timeframe required by Applicable Law (generally 30 days, extendable in certain circumstances). We may require verification of your identity before processing your request and will not charge a fee unless your request is manifestly unfounded or excessive.

12. CHILDREN & MINORS 

The Platform is not directed to individuals under the age of 18 years (or the applicable age of majority in your jurisdiction, whichever is higher). We do not knowingly collect personal information from minors. If you are a parent or guardian and believe that a minor has provided us with personal information without your consent, please contact us immediately at privacy@fintoolbox.online so that we may delete such information without undue delay.

13. JURISDICTION-SPECIFIC PROVISIONS

13.1 South Africa — POPIA (Protection of Personal Information Act 4 of 2013)

Ziyanda Capital processes personal information in compliance with the eight conditions for lawful processing set out in POPIA: accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards, and data subject participation. The Company has appointed an Information Officer as required by POPIA. Data subjects in South Africa have the right to lodge a complaint with the Information Regulator of South Africa at www.inforegulator.org.za.

13.2 United Kingdom — UK GDPR & Data Protection Act 2018

For users in the United Kingdom, personal information is processed in compliance with the UK GDPR and the Data Protection Act 2018. Users in the UK have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk. The Company complies with the Privacy and Electronic Communications Regulations (PECR) in respect of electronic marketing and cookies. 

Online marketing and electronic communications in the EU are also subject to applicable ePrivacy‑style rules, to the extent that such laws apply to our services.

13.3 Botswana — Data Protection Act 2018 (Act No. 32 of 2018)

For users in Botswana, we process personal data in compliance with the Data Protection Act 2018, including the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, and integrity and confidentiality.

13.4 Zambia — Data Protection Act No. 3 of 2021

For users in Zambia, we process personal data in accordance with the Data Protection Act No. 3 of 2021 and applicable guidelines issued by the Zambia Information and Communications Technology Authority (ZICTA).

13.5 Lesotho

For users in Lesotho, we comply with applicable laws governing personal information, including the Computer Crime and Cybersecurity Act 2021 and any relevant consumer protection provisions. We commit to adhering to any data protection legislation enacted in Lesotho from time to time.

13.6 Mozambique — Law No. 7/2017 & Decree No. 19/2021

For users in Mozambique, we comply with Law No. 7/2017 on the Protection of Personal Data and associated implementing regulations. Data subjects may exercise rights and lodge complaints with the relevant national authority.

13.7 Namibia (Anticipated)

Although FinToolbox does not currently operate in Namibia, this Privacy Policy is drafted to anticipate future operations in that jurisdiction. Upon launch in Namibia, we will comply with the Namibia Data Protection Act (as enacted or amended) and any applicable regulations. This Policy will be updated prior to or upon commencement of operations in Namibia, and affected users will be notified accordingly. 

13.8 European Union – General Data Protection Regulation (GDPR)

For users located in the European Economic Area (EEA) or the European Union, personal information is processed in compliance with Regulation (EU) 2016/679 (the General Data Protection Regulation, or “GDPR”), and any applicable national implementing laws.
Under the GDPR, you have the rights listed in Section 11 and may also, where applicable, appoint a data protection representative in the EU. We will respect the GDPR’s requirements relating to lawful basis, transparency, data minimisation, retention, cross‑border transfer safeguards, and data breach notification. Any cross‑border transfers from the EEA/EU to other jurisdictions will be subject to appropriate safeguards such as Standard Contractual Clauses or adequacy decisions, as required by the GDPR.

13.9 United States – US Data Protection Expectations 

Although the United States does not have a single omnibus federal data protection law, we respect the principles of notice, choice, and data security. For users in the United States, this Privacy Policy fulfils our transparency obligations and informs you about how we collect, use, and safeguard your personal information. Where specific state laws (such as the California Consumer Privacy Act, CalOPPA, or similar) apply, we will comply with their notice and choice requirements to the extent that our services are made available to residents of those states. This includes providing clear information about data collection practices and respecting opt‑out requests for targeted advertising where applicable.

13.10 Canada – PIPEDA and Provincial Privacy Legislation 

For users in Canada, personal information is processed in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation, where they apply. We will seek meaningful consent where required, limit collection and use of personal information to what is reasonably necessary, ensure accuracy, and provide ready access to and correction of your personal information upon request. Canadian data subjects may also exercise the rights described in Section 11, including the right to access and request correction of their personal information.

14. CONTACT US & INFORMATION OFFICER

If you have any questions, concerns, or requests relating to this Privacy Policy or our processing of your personal information, please contact our Information Officer:

Privacy & Information Officer
FinToolbox — a division of Ziyanda Capital 
Website: www.fintoolbox.online
Email: privacy@fintoolbox.online
Postal Address: 1st Floor, Maroun Square, Cnr. Winnie Madikizela-Mandela Drive & Broadacres Street, Dainfern, Johannesburg, 2197, Republic of South Africa 

We commit to acknowledging receipt of your request within 5 business days and resolving it within the timeframe required by Applicable Law. If you are not satisfied with our response, you have the right to escalate your complaint to the relevant supervisory authority listed in Section 15, or seek recourse through the courts of competent jurisdiction in your country of residence.

15. DATA PROTECTION SUPERVISORY AUTHORITIES

You have the right to lodge a complaint with the supervisory authority in your jurisdiction:

South Africa
Information Regulator of South Africa
www.inforegulator.org.za

United Kingdom
Information Commissioner’s Office (ICO)
www.ico.org.uk

Botswana
Data Protection Commissioner
Via official Government of Botswana portal

Zambia
Zambia Information and Communications Technology Authority (ZICTA)
www.zicta.zm

Lesotho
Relevant national authority as designated under applicable law

Mozambique
INAGE or relevant national authority
Via official Mozambican government channels

Namibia
Namibian Data Protection Authority (upon establishment)

16. CHANGES TO THIS PRIVACY POLICY

We reserve the right to amend this Privacy Policy at any time to reflect changes in our practices, the features of the Platform, or Applicable Laws. When we make material changes, we will provide notice by one or more of the following means: updating the “Effective Date” at the top of this Policy; displaying a prominent notice on the Platform; or sending you a notification to your registered email address.

Your continued use of the Platform after any such change constitutes your acceptance of the updated Privacy Policy, to the extent permitted by Applicable Law. If you do not agree to the amended terms, you must stop using the Platform and may request deletion of your account and personal information in accordance with Section 11.

We maintain an archive of prior versions of this Privacy Policy, which is available on request from our Information Officer at privacy@fintoolbox.online.

17. GOVERNING LAW & DISPUTE RESOLUTION

Without limiting your rights under Applicable Law in your jurisdiction, this Privacy Policy and any dispute arising from it shall, in the first instance, be interpreted in accordance with the laws of the Republic of South Africa. Where mandatory local law in your jurisdiction requires the application of local law, such law shall apply to the extent required.

We encourage you to first contact our Information Officer to resolve any complaint informally. If we are unable to resolve a dispute, you may escalate to the relevant supervisory authority listed in Section 15, or seek recourse through the courts of competent jurisdiction in your country of residence.

18. MISCELLANEOUS

Severability
If any provision of this Privacy Policy is found to be invalid, illegal, or unenforceable under Applicable Law, that provision shall be modified to the minimum extent necessary to make it valid and enforceable, and the remaining provisions shall continue in full force and effect.

Entire Agreement
This Privacy Policy, together with our Terms of Service and Cookie Policy, constitutes the complete and exclusive agreement between you and the Company regarding the subject matter hereof and supersedes all prior understandings or representations.

No Waiver
Our failure to enforce any provision of this Privacy Policy shall not constitute a waiver of that provision or any other provision.

Language
This Privacy Policy is drafted in English. In the event of any conflict between an English version and any translated version, the English version shall prevail to the extent permitted by Applicable Law.

Approved and adopted by Ziyanda Capital, a division of Ziyanda Investment Enterprises  (Pty) Ltd — FinToolbox division
Effective Date: 1 June 2025 | Version 1.0
www.fintoolbox.online | privacy@fintoolbox.online