South Africa Privacy Centre

Introduction

This privacy notice provides information about how we use and share personal information relating to consumers who contact us with an enquiry, request or complaint. You can find more detailed information at the TransUnion Privacy Centre or in other privacy information you may have received.

In Brief

When you contact us with a request, complaint or enquiry, we will use your personal information in order to help us to respond to you.

Sometimes this will mean sharing personal information with third parties. For example, if you dispute the accuracy of information on your credit report, we may need to contact the organisation who provided us with that information to check whether it is correct.

This notice covers the following topics:

1. Who we are and how to contact us
2. How we use personal information
3. The kinds of personal information we use and where we get personal information
4. How long we keep personal information
5. Our legal basis for handling personal information
6. Who we share personal information with
7. How we protect personal information
8. Where we store and send personal information
9. Your rights concerning your personal information
10. Where to lodge a complaint
11. Changes to this privacy notice

1.  Who we are and how to contact us

Information for Good^®

We are in an era of rapid digital transformation where consumers demand more access to seamless, personalised products and services online. But the currency of personal information that fuels this platform economic boom poses threats to individuals and endangers corporate security.

Now more than ever — and likely more so in the future — consumers and corporates need new levels of trust and transparency.

As a global information and insights company, TransUnion seeks to make trust possible. We do this by curating an accurate and comprehensive picture of each consumer so they are safely and reliably represented in the marketplace. This enables businesses and consumers to transact with confidence and achieve great things. We call this Information for Good.

We are a group of companies with registered offices at TransUnion, 10th Floor, 11 Alice Lane, Sandton, Johannesburg, 2196.  Although we are part of a larger group, this notice covers only the activities of TransUnion companies within the Republic of South Africa.

Contact details

Contact us about personal information issues, including the contents of this notice via:

• Post: PO Box 4522 Johannesburg 2000
• Telephone:   Contact Centre: 0861 482 482
• Email: TUAPrivacy@transunion.com

2.  How we use personal information

Enquiries

We use your personal information to deal with any issue or complaint you have raised (which we refer to as an “enquiry”). This might include contacting you for more information or tell you the outcome of your enquiry. Typical enquiries include:

• Requests for access to personal information, to challenge the accuracy of personal information, or to request the erasure of personal information
• Support requests for our consumer products
• Complaints of any nature
• General enquiries

Identity verification

When you contact us, we may need to verify your identity to ensure we do not provide personal information to unauthorised parties.

Example: identity verification

If someone contacts us and asks us for a copy of your credit report, we will check that is you (or someone authorised by you) asking for it. We may ask for evidence of identity such as copies of your driving license or a bank statement.

It is important to do this because the information in your credit report is valuable and could be used to impersonate you if it were to fall into the wrong hands.

Feedback

We may ask you to provide us with feedback or to leave a review about the service you received. Your feedback helps us to improve our services.

Products and services

We use aggregated statistics about enquiries, requests and complaints to help manage our services and identify potential problems. Some enquiries lead to changes to the personal information we use in our products and services.

Constant improvement

We use information from complaints and requests to help understand what went wrong, fix any problems, and improve how we deal with similar issues.

Legal and regulatory purposes

We may use personal information for legal and regulatory purposes. This might include responding to complaints or enquiries from you or a regulator about how we have handled your enquiry or used your personal information.

3.  The kinds of personal information we use and where we get personal information

We obtain and use information from various sources summarised in the following table:

4.  How long we keep personal information

Simply put, we keep personal information for as long as necessary. More technically, we retain it to fulfil the purpose(s) of its provision, to comply with applicable laws, and for as long as your consent to such purpose(s) remains valid after termination of our relationship.

You are free to choose whether you give us your personal information. However, if you do not provide the information we need, this may limit our ability to help.

5.  Our legal basis for handling personal information

Legitimate interests

The Protection of Personal Information Act (POPIA) allows personal information usage where necessary for legitimate purposes without undue adverse impact. We base most of our processing activities on the legitimate interests listed below.

Other legal bases

Legal - Regulators, government bodies and courts can order us to provide information and we may have to comply.

6.  Who we share personal information with

Our group of companies

Where appropriate, we share personal information among TransUnion companies in South Africa to respond to consumer enquiries, requests, or complaints and to fulfil related business and regulatory requirements. The current TransUnion RSA companies include:

Access to personal information within the group is restricted to authorised personnel who require it to manage and resolve enquiries or complaints.

Service providers

We and, where applicable, our clients may share personal information with trusted third‑party service providers who assist us in responding to enquiries, requests, or complaints. These service providers are required to process personal information only in accordance with our instructions and to implement appropriate safeguards to protect it, as required under POPIA.

Data suppliers and other third parties

If an enquiry or complaint relates to information supplied to us by a third party, we may share relevant personal information with that data supplier or third party to investigate and resolve the matter. For example, where a consumer disputes the accuracy of information on their credit report, we may contact the organisation that supplied that information to verify its accuracy.

Such third parties may not use personal information for their own purposes or on behalf of other organisations unless the consumer has agreed otherwise or the law permits it.

7.  How we protect personal information

We take appropriate and reasonable technical and organisational measures to protect the personal information of consumers who contact us with an enquiry, request, or complaint. These measures are designed to prevent loss, unauthorised access, misuse, disclosure, or alteration of personal information. Access is limited to authorised personnel who require the information to respond to the enquiry or resolve the matter, and we regularly review our safeguards to ensure ongoing protection and compliance with applicable data protection laws, including POPIA.

8.  Where we store and send personal information

We may, from time to time, make use of service providers located outside South Africa, including in countries such as India, the United Kingdom, and the United States, to assist us in managing and resolving enquiries, requests, or complaints. Where personal information is transferred outside South Africa, we ensure that such transfers comply with POPIA. This means we will not transfer personal information to a country that does not provide an adequate level of protection unless appropriate safeguards are in place, including contractual agreements that require the recipient to protect personal information to a standard substantially similar to that required under POPIA.

9.  Your rights concerning personal information

We outline your rights regarding the personal information we hold about you below.

Access: You can access all information that we hold about you by contacting us through TUAPrivacy@transunion.com

Correction/Destruction/Deletion: If the information we hold about you is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, you have a right to ask us to correct it or delete it.

Objection to processing: You may object (on reasonable grounds) to processing your personal information unless legislation provides for such processing.

Objection to direct marketing: You may object to us using your personal information for direct marketing, and if you do, we will stop.

10.  Where to lodge a complaint

We strive to deliver the highest levels of customer service. However, if you are ever unhappy with us, please contact us so we can investigate.

Location: 10^th Floor, 11 Alice Lane, Sandton, 2196

Postal Address: PO Box 4522, Johannesburg, 2000

Telephone: 0861 482 482

You can also contact our Information Officer or Deputy Information Officer at TUAPrivacy@transunion.com

You may complain to the Information Regulator:

Physical Address:  Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg 

Postal Address: P.O. Box 31533, Braamfontein, Johannesburg, 2017

Email: POPIAComplaints@inforegulator.org.za.

Site: www.inforegulator.org.za  

11.  Changes to this privacy notice

We may update this Privacy Notice from time to time to reflect changes in our practices, legal requirements, or operational needs. Where material changes are made, we will take reasonable steps to inform individuals, which may include updating this notice on our website or communicating changes through appropriate channels.

The most current version of this Privacy Notice will always be available, and the effective date at the bottom of the notice indicates when the latest version came into effect.

Effective date: May 2026