Privacy notice

Thumbeza Leasing (Pty) Ltd, trading as Msaada

Last updated: 27 September 2026

This notice explains how we process personal information when you use the Msaada website, apply for or hold a credit agreement with us, supply goods or services to us, or contact us. It applies to Thumbeza Leasing (Pty) Ltd, registration number 2023/805204/07, a registered credit provider (NCRCP20118). "We" and "us" mean that company. "You" means a customer, applicant, supplier, or website visitor, as the context requires.

We process personal information in line with the Protection of Personal Information Act, 2013, and, where you apply for or hold credit, the National Credit Act, 2005. If a term in this notice conflicts with a mandatory rule of those Acts, the Act prevails.

Please read this notice before you send us personal information. If you do not agree to the processing described here, do not submit an application. We will not be able to assess or provide credit without the information the law and the agreement require.

1. Who to contact

2. What we collect

Depending on your relationship with us, we collect:

• Identity and contact details: name, date of birth, identity number, passport number or asylum-document number, photograph of you with that document, phone number, email address, and physical address.
• Financial and affordability information: bank account details, bank statements, payslips, income and expense figures, and, where you authorise it, earnings and payment activity on a work platform such as a delivery or ride-hail platform.
• Agreement and payment records: the goods, the quotation, the credit agreement, instalments, debit-order or DebiCheck mandates, payment references, and how the account is conducted.
• Device-management information where a handset is under remote management: device identifiers and the status needed to secure, restrict, lock, or wipe the handset if it is lost or stolen, or while the account is in default, as set out in the credit agreement.
• Correspondence: what you or someone acting for you sends us, including email and WhatsApp.
• Website and technical information: IP address, browser and device type, and pages requested, in ordinary server logs. The cookie notice describes what is stored on your device.

We do not take fingerprints or voiceprints. We do not offer credit to anyone under 18, and we do not knowingly collect personal information of children.

If you give us someone else's personal information (for example a next of kin, an account holder, or, if you are a supplier, an employee or director), you must have their authority to do so and must tell them that we will process it as described here.

3. Where it comes from

You give it to us on a form, on the website, by phone, email, or WhatsApp, or through an agent or introducer acting for you. We also receive it from payment providers when a debit order or card payment is processed, from a work platform where you have authorised that sharing, from the device-management provider, and from a registered credit bureau where we submit or enquire as described below. We may use an automated tool to read identity documents, bank statements, and payslips and to extract the figures needed for the affordability assessment. A person still makes the credit decision.

4. Why we use it

We use personal information to:

• assess an application, including an affordability assessment under the National Credit Act, and decide whether to offer credit;
• provide the goods and the credit agreement, run the account, collect instalments, and tell you about changes to the agreement;
• verify your identity;
• register and use a DebiCheck or other debit-order mandate you have given;
• secure the handset and the account through device management, as the credit agreement allows;
• prevent and investigate fraud, and trace and collect amounts that are due;
• keep records the National Credit Act, tax law, and other laws require;
• send service messages about an application or agreement by email, SMS, phone, or WhatsApp;
• improve the website and our processes; and
• respond to a lawful request from a regulator, a court, the National Credit Regulator, or a law-enforcement body.

Where the National Credit Act requires it, we submit prescribed information about the credit agreement and how you pay it to a registered credit bureau. That information forms part of your credit record. If we make a credit-bureau enquiry when assessing an application, that enquiry is also recorded.

We send electronic marketing only about our own similar goods or credit, and only to an existing customer, and each message will include a free way to opt out. We do not send electronic marketing to anyone else unless they have agreed to receive it. Opting out of marketing does not stop service messages about an application or agreement.

5. Who we share it with

We do not sell personal information. We share it with:

• payment and debit-order providers, so that instalments can be collected;
• the provider that hosts our systems, and the provider that reads application documents, who may process it outside South Africa;
• the device-management provider and, where needed to perform the agreement, a network operator;
• a work platform, where you have authorised us to receive earnings information from that platform;
• a registered credit bureau, to the extent described above;
• an agent or introducer acting for you, and a delivery provider where goods are sent to you;
• a professional adviser, debt collector, or prospective buyer of the business, under a duty to protect the information; and
• a regulator, court, or other person when the law requires it, or when it is necessary to protect our rights, your rights, or the rights of another person.

If a supplier outside South Africa processes personal information for us, we require that supplier to protect it to a standard comparable to the Protection of Personal Information Act.

If you refuse a disclosure that the credit agreement or the National Credit Act requires, we may be unable to enter into or continue the agreement.

6. How long we keep it

We keep personal information for as long as you have an application or agreement with us, and afterwards for the period required by the National Credit Act, tax law, and any related complaint or legal claim. When that period ends, we delete it or de-identify it.

7. Security

We use reasonable technical and organisational measures to protect personal information against unauthorised access, loss, and alteration. No internet transmission is completely secure. Keep your passwords and one-time codes to yourself. Give us accurate and complete information. If it is wrong or incomplete, we may be unable to assess the application or administer the agreement.

8. Your rights

You may ask us to confirm whether we hold personal information about you, to provide a copy, to correct it, or to delete it where the law allows. You may object to processing that is not required to perform the agreement or to comply with the law, and you may opt out of marketing at no charge.

Write to the Information Officer at the details above. If you are not satisfied with our response, you may complain to the Information Regulator at POPIAComplaints@inforegulator.org.za.

A credit agreement also gives you rights under the National Credit Act, including complaints to the National Credit Regulator. Those rights are set out in the agreement and are not limited by this notice.

9. Cookies

What we store on your device is described in the cookie notice.

10. Other websites

Our website may link to payment pages, Google reviews, or other third-party sites. Their privacy practices are their own.

11. Changes

We may update this notice when our services, systems, or legal duties change. The version on this page, with its last-updated date, is the current one. Where a change materially affects how we use information we already hold, we will take reasonable steps to bring it to your attention.