Privacy Policy
Momo Global (Pty) Ltd · Registration No. 2025/467876/07 · Last updated: 7 July 2026
1. Who we are
Momo Global (Pty) Ltd ("we", "us", "Momo Global") is a South African company based in Pretoria, Gauteng. We operate:
- AffyAssess (affy.co.za), a bank statement analysis platform that produces affordability assessments, income verification, expense categorisation, and statement deviation indicators for credit providers
This policy covers all personal information processed across our products and associated websites.
Information Officer
Brink Olivier
Email: [email protected]
Phone: +27 72 842 1159
2. What information we collect
AffyAssess: consumer bank statement data
When a consumer's bank statement is submitted for assessment, whether uploaded by a credit provider or by the consumer directly via a self-upload link, we process:
- Account holder name, account number, and bank identity
- Transaction history (typically three months): dates, amounts, descriptions, balances
- Derived data: income verification results, expense categories, category spend indicators, affordability calculations, and statement deviation indicators
We do not collect or store bank login credentials.
Website visitors
When you visit our websites, we collect:
- Analytics data via Google Analytics 4 (see our Cookie Policy)
- Contact form submissions: name, email address, company, and message content
3. How we use your information
We process personal information for the following purposes:
| Purpose | Legal basis (POPIA) |
|---|---|
| Produce affordability and statement assessment outputs from a bank statement for the credit provider that supplied it | Contract with, and legitimate interest of, the credit provider; consent where the consumer self-uploads |
| Respond to enquiries submitted via our websites | Legitimate interest |
| Website analytics to improve our services | Consent (cookie consent) |
| Comply with legal and regulatory obligations | Legal obligation |
4. Our role under POPIA
Our role depends on how information reaches us:
- When a credit provider submits data to us: we act as an operator under Section 21 of POPIA. The credit provider is the responsible party and is accountable for obtaining lawful grounds to share the data with us. Our processing is governed by a written operator agreement with each credit provider.
- When a consumer self-uploads via a tokenised link: we collect the data on behalf of the credit provider named in the consent notice presented at the point of upload. The credit provider remains the responsible party for the assessment.
- For website visitors and contact form submissions: we act as a responsible party.
5. Automated processing
AffyAssess uses automated processing to produce assessment outputs from a bank statement: affordability calculations, income verification, expense categorisation, category spend indicators, and statement deviation indicators. Outcome signals (Clear, Caution, or Review) are applied under rules selected and configured by the credit provider. The output includes plain-English reason codes explaining the factors behind each signal.
AffyAssess is a supplementary assessment tool. It does not make credit decisions, lending recommendations, or affordability determinations under the National Credit Act. We surface data from the statement; the credit provider interprets it under its own rules. The subscribing credit provider is solely responsible for any credit decision and must ensure a qualified person reviews all outputs before taking action, in accordance with POPIA Section 71.
You have the right to:
- Request that a person (not an automated system) reconsider any decision made using our output
- Receive information about the logic involved in the automated processing
- Make representations about the output
6. Who we share information with
We share personal information only as follows:
- The credit provider that supplied the statement receives the assessment outputs (affordability, income verification, category indicators, reason codes, outcome signals)
- Contracted service providers (sub-operators) that perform hosting, document extraction, and identity verification for us, each under written agreements no less protective than our client operator agreements. Sub-operators are disclosed to each client credit provider in its operator agreement
- Law enforcement or regulators when required by law
We do not sell personal information. We do not share one credit provider's data with any other credit provider. Each assessment is isolated to the provider that requested it.
7. Data retention
| Data type | Retention period |
|---|---|
| Bank statement data, assessment outputs, and all derived data processed for a credit provider | 90 calendar days from processing (or shorter if the operator agreement with that credit provider requires it), then securely deleted, including copies and backups |
| Processing audit logs (timestamp, provider ID, consent record; no statement content) | 5 years (regulatory compliance) |
| Contact form submissions | 24 months |
| Website analytics | 14 months (Google Analytics default) |
We do not maintain an ongoing database of consumer credit records. Each assessment is a point-in-time analysis of the statement supplied.
8. Cross-border transfers
Our primary processing infrastructure is hosted in South Africa. Certain contracted service providers (document extraction and identity verification) process data on infrastructure outside South Africa. All such transfers take place under written agreements providing an adequate level of protection as required by Section 72 of POPIA, and are disclosed to each client credit provider in its operator agreement.
9. Security
We take reasonable technical and organisational measures to protect personal information against loss, unauthorised access, and unlawful processing (POPIA Section 19). These include encryption in transit and at rest, access controls, and regular security reviews.
No system is completely secure. In the event of a data breach that poses a risk to data subjects, we will notify the Information Regulator and affected individuals as required by POPIA Section 22.
10. Your rights
Under POPIA, you have the right to:
- Access: request confirmation of what personal information we hold about you and receive a copy (see our PAIA Manual for the request procedure)
- Correction: request correction of inaccurate or incomplete information (POPIA Regulations Form 2)
- Deletion: request deletion of your personal information where we no longer have a lawful basis to retain it
- Object: object to processing on grounds of legitimate interest (POPIA Regulations Form 1)
- Automated decisions: not be subject to a decision based solely on automated processing that produces legal effects (see Section 5 above)
To exercise any of these rights, contact our Information Officer at [email protected]. The prescribed forms are available from the Information Regulator's website. We will respond within 30 days.
Where your bank statement was submitted to us by a credit provider, that credit provider is the responsible party for your personal information. We will refer your request to them where required and assist them in responding, as our operator agreement obliges us to do.
11. Complaints
If you believe we have not handled your personal information properly, you may lodge a complaint with:
The Information Regulator (South Africa)
POPIA complaints: [email protected]
General enquiries: [email protected]
Website: inforegulator.org.za
12. Changes to this policy
We may update this policy from time to time. Material changes will be posted on this page with an updated date. We encourage you to review this policy periodically.