Privacy Policy

1. Scope and roles

This Policy explains how AMERCOEX handles personal information through AMERCOEX Finance for business users and representatives in South Africa. It covers account creation, use of the application, financing applications, support and related communications.

AMERCOEX is the responsible party for processing it determines to operate the Platform. Nedbank Limited acts as an independent responsible party for information it receives to assess an application, complete financial and regulatory checks, issue an offer and manage a financial relationship. AMERCOEX does not make the final credit decision.

Processing directed to South Africa is carried out in accordance with the Protection of Personal Information Act 4 of 2013, known as POPIA, and other applicable law.

2. Personal information we handle

3. How we obtain information

• directly from the user when an account is created, fields are completed, business references are selected, documents are captured, support is requested or an application is submitted;
• automatically from the device and application during use, authentication, security, notifications, analytics and attribution;
• from Nedbank when it communicates status or outcome information needed to display progress; and
• from verification, security and fraud-prevention providers where permitted by law and the applicable authorisation.

4. Purposes

We handle information to:

• register and authenticate an account;
• save progress, validate fields and allow an application to be reviewed;
• verify identity, the business, authority and bank account;
• generate a quote and payment schedule from the selected parameters;
• transmit the authorised application to Nedbank and display the status received;
• prevent fraud, abuse, unauthorised access and security failures;
• send codes, operational notices and notifications relating to the account or application;
• provide support and resolve enquiries, complaints and rights requests;
• measure stability, performance, use and campaign effectiveness; and
• meet legal, regulatory, accounting and record-retention duties.

We do not sell personal information. We do not use identity documents, business references, bank information or application information for personalised advertising.

5. Grounds for processing

Depending on the activity, processing is justified by the data subject's consent; steps requested before entering a contract; performance of the Terms; compliance with a legal duty; the protection of legitimate interests in security, fraud prevention, support and service improvement; or a legitimate interest of a third party. Where POPIA requires specific consent, we request it clearly before the processing takes place.

A user may refuse an optional permission. If information is necessary to verify identity, transmit an application or prevent fraud, the relevant function cannot be completed without it.

6. Recipients and operators

We share information only where necessary and with appropriate contractual and technical safeguards:

• Nedbank Limited: to verify, assess, decide and, where applicable, formalise and administer the requested financial service;
• Google Firebase Analytics: to measure application events, stability and use;
• Google Firebase Cloud Messaging: to manage installation tokens and deliver notifications;
• Meta Facebook App Events: to measure events and attribution;
• Adjust: to provide attribution, campaign measurement and advertising-fraud prevention;
• infrastructure, communications, verification, security and support providers: to perform functions on AMERCOEX's instructions; and
• authorities and advisers: where necessary to comply with law, protect rights or respond to a valid process.

Service providers may process information only for authorised purposes and must apply security measures appropriate to the risk.

7. Cross-border transfers

AMERCOEX is domiciled in Bolivia and some technology providers operate in other countries. Information originating in South Africa may therefore be processed outside South Africa. We apply section 72 of POPIA through contracts, appropriate safeguards, consent where applicable or another valid legal mechanism, and limit a transfer to what is necessary for the stated purpose.

8. Technology services and device functions

The technology services below support common functions of AMERCOEX Finance and may also operate when a user accesses business financing services through the application.

We use these services for notifications, usage measurement, statistical and attribution analysis, technical security and product improvement. These providers act only within the scope of their respective technology services. They do not represent AMERCOEX Finance, assess financing applications or make credit decisions.

Each provider processes information under the requirements applicable to its service and its own privacy terms. Additional information is available from the providers:

• Google Firebase privacy and security
• Meta / Facebook Privacy Policy
• Google Privacy Policy
• Adjust Privacy Policy

Device functions

The application also uses system services for the camera, image selection, selection of individual business references and approximate location. Access occurs after a user action and, where required, after the operating system displays a permission request.

9. Retention

We retain information for as long as necessary to operate the account, process an application, maintain security, resolve complaints and comply with legal or contractual duties. The period is determined by the nature and sensitivity of the information, the risk, the status of the account or application, regulatory periods and the need to establish or defend a claim.

When an account is deleted, we delete or de-identify information that is no longer required. Limited records may be retained where required by law, fraud prevention, an investigation, an active financial application or a complaint. When that reason ends, the information is securely deleted or de-identified.

10. Security

We apply access controls, authentication, production transport protections, event logging, separation of responsibilities, supplier review and continuity measures appropriate to the risk. No system removes all risk. We assess incidents and, where POPIA requires, notify the Information Regulator and affected persons.

11. Data subject rights

Subject to POPIA, a data subject may:

• ask whether we hold personal information about them;
• request access, a description of recipients and a copy of the information;
• request correction, updating, deletion or destruction where applicable;
• object to processing on grounds permitted by law;
• withdraw consent without affecting earlier lawful processing;
• request review of a decision subject to the rules on automated processing; and
• complain to AMERCOEX or the Information Regulator.

To exercise a right, write to service@amercoexsrl.com. We may request information reasonably needed to verify identity and authority. We respond within the period required by law.

12. Account and data deletion

A user can start account deletion through Me → Account Management → Delete Account in the application, or request deletion by emailing service@amercoexsrl.com. The request covers the account and associated information that is not required to be retained.

Deleting the AMERCOEX account does not automatically cancel an agreement with Nedbank or delete information that Nedbank handles as an independent responsible party. The user must use Nedbank's own channels for that information.

13. Assessment and decisions

AMERCOEX calculates estimates from selected parameters but does not make the final credit decision. Nedbank independently assesses an application under its policies and legal duties. If a decision with significant legal effects is made solely through automated processing, the responsible party for that decision must provide the safeguards and review routes required by law.

14. Children

The Platform is intended for businesses and authorised representatives who are at least 18 years old. It is not directed to children. If we learn that a child's information was supplied without a lawful basis, we take steps to restrict and delete it as required by law.

15. Policy changes

We may update this Policy because of legal, technical or functional changes. The version and effective date appear at the beginning. Material changes will be communicated through the application or another reasonable channel and, where necessary, renewed permission will be requested.