Privacy Policy

Last updated: 16 May 2026 · Operated by FAST Software (Pty) Ltd in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA").

1. About FAST

FAST ("Finance Application Structuring Tool") is a web-based platform that assists Finance & Insurance ("F&I") professionals at South African motor dealerships with pre-qualifying customers for vehicle finance. FAST does this by ingesting documents that the customer has provided to the dealership — typically bank statements, payslips, the signed finance application and any settlement letters — and producing a structured assessment of the customer's affordability, the recommended deal structure and the equity load required.

FAST is owned and operated by FAST Software (Pty) Ltd, a private company incorporated in the Republic of South Africa ("we", "us", "our", "FAST").

2. About this Privacy Policy

This Privacy Policy explains how we collect, use, store, share, protect and otherwise process personal information when:

• you, as a user of FAST (typically a Finance & Insurance manager, business manager, dealer principal or administrator at a South African motor dealership), register for and use the FAST platform; and
• you, as a customer of a motor dealership, have provided personal information to that dealership in connection with a vehicle finance application, and the dealership has uploaded that information to FAST for the purposes of pre-qualification and deal structuring.

This Privacy Policy is published in accordance with our obligations under POPIA and should be read together with our Terms of Service.

3. Who is responsible for your personal information

The motor dealership that collects your personal information from you and uses FAST to process it acts as the responsible party under POPIA in respect of your personal information. FAST Software (Pty) Ltd processes your personal information on behalf of, and on the documented instructions of, that dealership and accordingly acts as an operator under POPIA.

Where FAST collects personal information directly — for example when a user registers an account, when we issue an invoice, or when we provide customer support — FAST Software (Pty) Ltd is the responsible party for that information.

4. Information Officer

Our Information Officer is responsible for ensuring our compliance with POPIA and for engaging with the Information Regulator on our behalf. Our Information Officer is in the process of being registered with the Information Regulator. Until that registration is finalised, the head of the responsible party — the Chief Executive Officer of FAST Software (Pty) Ltd — fulfils the role of Information Officer by operation of section 56 of POPIA.

Contact: accounts@fastapp.co.za (please mark for the attention of the Information Officer).

5. What personal information we process

The personal information we process falls into the following broad categories:

5.1 Identifying and contact information

• Full names, identity number or passport number, date of birth, gender, marital status, marital regime, number of dependants;
• Residential and postal address, contact telephone numbers, email address.

5.2 Employment information

• Employer name and contact details, occupation, position, length of service;
• Information appearing on payslips, including gross and net income, deductions, allowances and pay frequency.

5.3 Financial information

• Bank account details and bank statement contents (account holder, account number, balances, transactions, debit orders, deposits, credits and EFTs);
• Declared income and declared monthly expenses as recorded on the finance application;
• Existing credit obligations, including settlement amounts on existing vehicle finance, instalments on existing credit facilities, and similar information appearing on settlement letters or the finance application.

5.4 Vehicle and transaction information

• Details of the vehicle being financed (make, model, derivative, year, mileage, retail and trade values);
• Details of any trade-in vehicle, deposit, requested finance term, balloon arrangements, fees and vehicle extras (such as tracker, paint protection, tyre & rim, service plan);
• The bank or banks to which the application is submitted and the outcomes of those submissions, where the dealership chooses to capture this back into FAST.

5.5 User account information

• For FNI / dealership users: full name, work email address, role, dealership and dealer group, login credentials in hashed form, account activity logs and audit logs;
• Billing and account information for the dealership entity (company name, registration number, VAT number, billing contact, billing address).

5.6 Technical information

• IP address, device and browser type, operating system, session timestamps, pages visited, actions taken, and similar technical information collected automatically when you access the platform.

We do not knowingly collect or process "special personal information" as contemplated in section 26 of POPIA (such as information about health, biometrics, religion, race, or criminal behaviour) other than where this is incidentally disclosed by the customer in the finance application form, and only to the extent strictly necessary for the underwriting process.

6. Where we obtain personal information from

We obtain personal information from:

• The dealership / FNI user, who uploads the customer's documents to FAST having collected them directly from the customer for the purpose of a vehicle finance application;
• The user directly, when they register an account, configure their dealership, communicate with us, or otherwise interact with the platform;
• Automatically, when you access and use the platform (technical and session information).

7. Why we process personal information

We process personal information for the following purposes, each of which is lawful under one or more of the bases set out in section 11 of POPIA (consent, performance of a contract, compliance with a legal obligation, legitimate interest, or for the proper performance of a public-law duty):

• Pre-qualification and deal structuring: to read and reconcile the customer's income, expenses, existing credit obligations and other financial information, to compute affordability, to load equity correctly, to recommend a deal structure, and to surface relevant facts about the client's profile to the FNI;
• Restructuring declined deals: to recompute a structured deal in response to a decline so that the dealership can present an alternative structure to the customer;
• Operating user accounts: to authenticate users, control access on a least-privilege basis, manage dealership and dealer-group hierarchies, and meter usage against the dealership's credit balance;
• Billing and accounts: to invoice for credits purchased, to allocate usage between dealerships in a group, to maintain accounting records and to comply with tax obligations;
• Reporting and analytics for the dealership: to produce performance and conversion reports for the dealership's own use, on the basis of data that dealership has uploaded;
• Platform improvement: to monitor performance, diagnose errors, prevent fraud and abuse, and improve the accuracy and usefulness of FAST's engines over time, in each case using personal information only to the extent necessary;
• Legal and regulatory compliance: to comply with our obligations under POPIA, the National Credit Act, the Financial Intelligence Centre Act and other applicable laws, including responding to lawful requests from regulators and law-enforcement agencies;
• Communications: to send transactional communications (invoices, account notices, security alerts, platform announcements) and, where you have agreed to receive them, marketing communications.

8. Who we share personal information with

We share personal information only as necessary to deliver the FAST service or as permitted by law. Categories of recipients include:

• The dealership that uploaded the information and authorised users within that dealership (and, where applicable, the dealer group);
• The financial institutions to whom the dealership submits the application — disclosure to these institutions is made by the dealership itself, not by FAST, but the structured outputs of FAST are intended to be used in that submission;
• Infrastructure providers who host the FAST platform and provide cloud computing, storage, email delivery, identity, monitoring and similar services. Each such provider is bound by a written agreement that contractually obliges them to process personal information only on our instructions and to safeguard it in accordance with POPIA;
• Professional advisors (such as our auditors and legal advisors), bound by professional duties of confidentiality;
• Regulators, law-enforcement agencies and courts where we are required to do so by law or pursuant to a valid legal process.

We do not sell personal information to any third party.

9. Cross-border transfers

Personal information processed through FAST is hosted on infrastructure that complies with the security and data-protection requirements of POPIA. Where any processing or storage of your personal information occurs outside the Republic of South Africa, we ensure — in accordance with section 72 of POPIA — that the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection.

10. How long we keep personal information

We retain personal information only for as long as is necessary for the purposes set out in this Privacy Policy or as required by law, after which it is deleted or de-identified. In particular:

• Documents uploaded for the purposes of pre-qualification (bank statements, payslips, application forms, settlement letters) are retained for the period reasonably required by the dealership to support the underwriting decision and any subsequent audit, and in any event for no longer than is permitted under the National Credit Act and related law;
• Structured deal records (the outputs of FAST's engines) are retained for the dealership's reporting purposes for the period agreed with the dealership;
• User account information is retained for as long as the account is active and for a reasonable period thereafter to support audit, billing reconciliation and dispute resolution;
• Billing records are retained for the period required under tax and company law (typically a minimum of five years).

Dealerships may request earlier deletion of records that they have uploaded, subject to any overriding legal-hold or audit obligation.

11. Security safeguards

We take appropriate, reasonable technical and organisational measures to secure the integrity and confidentiality of personal information, as required by section 19 of POPIA. These measures include:

• Encryption of personal information in transit using industry-standard transport-layer security;
• Encryption at rest of stored documents and database records;
• Strict, role-based access controls so that users only access information they are authorised to see — including segregation between dealerships and between dealer groups;
• Multi-factor authentication for administrative access;
• Audit logging of access to personal information and of sensitive actions;
• Regular review of access rights, security configurations and dependency vulnerabilities;
• Confidentiality and data-protection obligations imposed on all employees, contractors and operators;
• A documented procedure for identifying, containing and reporting security compromises in accordance with section 22 of POPIA.

12. Your rights under POPIA

Subject to the conditions and exceptions set out in POPIA, you have the right to:

• Be notified when your personal information is collected and when there has been a security compromise affecting your information;
• Access the personal information we hold about you;
• Request correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully;
• Object to the processing of your personal information on reasonable grounds and to object to processing for direct marketing purposes;
• Withdraw consent where processing is based on consent (without affecting the lawfulness of processing carried out before withdrawal);
• Submit a complaint to the Information Regulator (see section 17 below).

If you are a vehicle finance applicant and you wish to exercise these rights in respect of information processed through FAST, please contact the dealership that uploaded your information. Where appropriate, you may also contact our Information Officer using the details in section 4. To formally exercise rights of access or correction you may use the prescribed POPIA forms published by the Information Regulator.

13. Direct marketing

We will only use your personal information for the purpose of direct marketing by electronic means with your consent or where you are an existing customer and the marketing relates to similar products and services. Every direct marketing communication will give you a simple, free means of opting out. You can also opt out at any time by emailing accounts@fastapp.co.za.

14. Cookies and website data

The FAST platform uses strictly necessary cookies and similar technologies to operate the service — for example to keep you signed in, to remember your dealership context, and to protect against cross-site request forgery. We do not use third-party advertising cookies or behavioural tracking. We collect aggregated, non-identifying analytics on how the platform is used to help us improve it.

15. Children

FAST is not intended for use by children. We do not knowingly collect personal information from children except where it is incidentally provided in connection with a customer's finance application (for example, ages of dependants disclosed in the affordability section), and only to the extent strictly necessary for the underwriting purpose.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we make a material change, we will revise the "Last updated" date at the top of the policy and, where appropriate, notify dealership administrators by email. We encourage you to review this page periodically.

17. Complaints

If you have a concern about how we have handled your personal information, please contact our Information Officer first using the details in section 4. We will investigate and respond.

You also have the right to lodge a complaint with the Information Regulator (South Africa):

JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 · PO Box 31533, Braamfontein, Johannesburg, 2017 · Tel: +27 (0)10 023 5200 · Complaints email: POPIAComplaints@inforegulator.org.za

18. Contact us

FAST Software (Pty) Ltd
Republic of South Africa
Email: accounts@fastapp.co.za