Effective Date: 01 January 2025

Version: 1.0

This Privacy Policy describes how Duzo, a service operated by Zen Capital (Pty) Ltd (Registration No. 2022/814043/07, FSP No. 54453), collects, uses, stores, and protects your personal information. This policy complies with the Protection of Personal Information Act, 2013 (POPIA) and other applicable laws in South Africa.

By using the Duzo platform, you consent to the collection and processing of your personal data as described in this policy.

1. Definitions

For purposes of this Privacy Policy:

1.1 “Duzo” refers to the crypto services platform operated by Zen Capital (Pty) Ltd.

1.2 “POPIA” refers to the Protection of Personal Information Act, 2013.

1.3 “FICA” refers to the Financial Intelligence Centre Act, 2001.

1.4 “Personal Information” means any data that can be used to identify a natural or juristic person, including names, contact details, financial information, and compliance records.

1.5 “You” or “User” means any individual or business using Duzo’s services.

1.6 “We”, “Us”, or “Our” means Zen Capital (Pty) Ltd.

1.7 “Data Subject” means the individual or entity to whom the personal information relates.

1.8 “Processing” includes collection, storage, modification, use, disclosure, and deletion of personal data.

1.9 “Information Regulator” refers to the authority established under POPIA to monitor and enforce compliance with data protection laws in South Africa.

2. Information We Collect

We may collect the following categories of personal information:

• Identification details: full name, ID number, passport number, date of birth
  
  
• Contact information: email address, phone number, residential address
  
  
• Financial data: bank account details, source of funds, income verification
  
  
• Usage data: device information, IP address, session logs, cookies, interaction history
  
  
• Transaction data: wallet addresses, transaction volumes, deposit and withdrawal activity
  
  
• Compliance documentation: KYC forms, identity verification, sanctions checks, declarations
  
  
• Communication records: support tickets, chat transcripts, and email correspondence
  
  

We only collect the minimum data necessary to provide our services and comply with legal obligations.

3. Why We Collect Your Information

We process your personal information for the following purposes:

• To register and verify your Duzo account
  
  
• To process transactions, conversions, and withdrawals
  
  
• To meet legal obligations under FICA and FSCA
  
  
• To prevent fraud, financial crime, and market abuse
  
  
• To provide support and communicate important updates
  
  
• To improve service functionality and security
  
  
• To maintain internal audit trails and regulatory reporting logs

4. Legal Basis for Processing

Our legal bases for processing personal data include:

• Consent, where explicitly given during account creation or updates
  
  
• Performance of a contract, to deliver services you’ve requested
  
  
• Legal obligations, particularly under FICA, FSCA, and FATF frameworks
  
  
• Legitimate interest, such as fraud prevention and platform optimisation
  
  

5. Who We Share Your Information With

We may share personal data with authorised third parties, including:

• Identity verification providers and sanctions screening vendors
  
  
• Banking partners and payment processors
  
  
• Legal, compliance, and regulatory consultants
  
  
• Government agencies such as the FSCA and Financial Intelligence Centre (FIC)
  
  
• Law enforcement when legally compelled
  
  
• Infrastructure providers (e.g. cloud hosting, analytics) under strict data protection terms

We do not sell your personal information.

6. International Transfers

Where our service providers are located outside South Africa, we ensure that:

• Their jurisdiction offers equivalent data protection standards, or
  
  
• Binding legal agreements are in place to ensure POPIA-compliant processing

7. Data Storage and Security

Your data is stored securely using encryption, layered access controls, and internal audit trails. Access to personal information is limited to authorised staff.

We retain personal data:

• For at least five (5) years after account closure, as required by FICA
  
  
• For longer periods where legally required or subject to investigation

8. Your Rights Under POPIA

You have the right to:

• Access a copy of your personal data
  
  
• Request corrections or updates
  
  
• Object to processing (where applicable)
  
  
• Withdraw consent (subject to legal limits)
  
  
• Lodge a complaint with the Information Regulator of South Africa
  
  

To exercise these rights, please email [email protected].

9. Cookies and Tracking

Duzo may use cookies and similar technologies to:

• Maintain session security
  
  
• Customise user experience
  
  
• Analyse user behaviour and improve functionality
  
  

You may disable cookies in your browser settings, though some services may be limited as a result.

10. Changes to This Policy

We may update this Privacy Policy to reflect legal, regulatory, or operational changes.

You will be notified of material changes through the platform or by email.

Continued use of the platform implies acceptance of the updated terms.

11. Contact Information

Zen Capital (Pty) Ltd

5th Floor Fredman Towers

13 Fredman Road

Sandton, South Africa

Email: [email protected]