South Africa Privacy Centre

Introduction

This privacy notice provides information about how we use and share consumers' personal information for our clients' marketing purposes. You can find more detailed information at the TransUnion Privacy Center or in other privacy information you may have received.

This notice covers the following topics:

1. Who we are and how to contact us
2. How we use personal information
3. The kinds of personal information we use and where we get personal information
4. How long we keep personal information
5. Our legal basis for handling personal information
6. Who we share personal information with
7. Where we store and send personal information
8. Your rights concerning your personal information
9. Where to lodge a complaint
10. Changes to this notice

1.  Who we are and how to contact us

Information for Good^®

We are in an era of rapid digital transformation where consumers demand more access to seamless, personalised products and services online. But the currency of personal data that fuels this platform economic boom poses threats to individuals and endangers corporate security.

Now more than ever — and likely more so in the future — consumers and corporates need new levels of trust and transparency.

As a global information and insights company, TransUnion seeks to make trust possible. We do this by curating an accurate and comprehensive picture of each consumer, so they are safely and reliably represented in the marketplace. This enables businesses and consumers to transact with confidence and achieve great things. We call this Information for Good.

We are a group of companies with registered offices at TransUnion, 10th Floor, 11 Alice Lane, Sandton, Johannesburg 2196. Although we are part of a larger group, this notice covers only the activities of TransUnion companies within the Republic of South Africa.

Jointly responsible parties

TransUnion companies sometimes cooperate with other TransUnion companies when sharing and making decisions about your personal information. When this happens, all employees across the group ensure each company involved complies with data protection rules.

Contact details

Contact us about personal information issues, including the contents of this notice via:

Post: PO Box 4522 Johannesburg 2000

Telephone:   Contact Centre: 0861 482 482

Email: TUAPrivacy@transunion.com

2.  How we use personal information

We process personal information for the following marketing-related purposes:

Direct marketing

If you give your consent or law permits it, we may use your personal information for direct marketing purposes. We may access, use, process and analyse personal information provided by you, your consumer credit information, Internet information and marketing data to provide personalised offers from TransUnion.

Opting out

Should you no longer wish to receive such communications, you may opt out at any time by clicking the unsubscribe link included in our marketing communications, or by contacting us at TUAPrivacy@transunion.com and requesting to be removed from our marketing distribution lists.

Alternatively, you may manage your communication preferences by visiting transunion.co.za, logging into your account, navigating to your profile settings, and updating your marketing preferences accordingly.

Digital marketing

Our digital marketing services enable our business partners to communicate with consumers about relevant products and services. These businesses use our data and technology to devise, create, deploy and measure targeted advertising programs. We also aggregate and de-identify data for analytical purposes to provide statistical reporting and performance measurements.

Market research

If you choose to take part in market research, we may use your information to improve our products and services. If we engage third parties to assist, they can use non-personal aggregated data, but they use all personal information for our research purposes only.

Consumer engagement

Subject to your consent, we may process your personal information to present you with additional products, services, and promotional offers from TransUnion, its affiliates, and selected marketing partners. Where necessary to fulfil your request, limited personal information, such as your name and email address, may be shared with relevant third parties, subject to appropriate confidentiality and data protection safeguards.

Where you do not provide identifiable information, such as your identity number, we will not collect personal information that directly identifies you during your general use of the TransUnion website. However, certain non-personal or anonymised information may be collected through cookies and similar technologies. For further information, please refer to our Cookie Policy available on our website.

Client data enhancement

In certain instances, TransUnion clients may provide personal information collected under their own privacy notices and request that we enhance such data. In these circumstances, the client acts as the responsible party for ensuring that the personal information has been collected and is processed lawfully and fairly.

Data subjects are encouraged to refer to the relevant client’s privacy notice for information regarding the categories of personal information collected, the purposes of processing, and the applicable mechanisms to exercise their data subject rights.

For further information on how TransUnion processes personal information in this context, please refer to our General Privacy Notice available at: Privacy Center | TransUnion South Africa

Development and testing

We may process personal information to develop, improve, monitor, and optimise our marketing products, services, campaigns, and related technologies. This includes assessing campaign effectiveness, enhancing audience targeting, and improving customer engagement strategies.

Where reasonably practicable, we apply appropriate safeguards, including anonymisation, pseudonymisation, and aggregation, to minimise the use of identifiable personal information.

Consumer queries

We may process your personal information to respond to and manage your enquiries, requests, or complaints, as well as to comply with applicable legal and regulatory obligations.

Legal compliance with laws and regulations

We may process, access, use, or disclose personal information without consent where permitted or required by applicable law, and where such processing is necessary to:

• Comply with legal obligations or legal processes served on us;
• Respond to lawful requests from regulatory authorities, law enforcement agencies, or government bodies;
• Protect and enforce our rights, property, or contractual obligations;
• Safeguard the public interest;
• Protect the vital interests, safety, or security of our employees, customers, or members of the public; or
• Rely on other lawful grounds for processing as recognised under applicable data protection laws.

Such processing is undertaken in accordance with the National Credit Act, the Protection of Personal Information Act, and other applicable legislation.

3.  The kinds of personal information we use and where we get personal information

We collect personal information from a variety of sources, including directly from data subjects, as well as from our clients, business partners, suppliers, website users, and individuals who subscribe to or make use of our products or services.

For marketing purposes, we may process various categories of personal information, including:

• Marketing and engagement data: consumer, household, and business-related information, as well as non-identifiable aggregated data and advertising campaign performance metrics;
• Demographic information: such as age, gender, income, occupation, education level, and marital status;
• Life event information: including significant events such as a recent relocation or property acquisition;
• Publicly available information: including census data, geographic information, and property-related data obtained from publicly accessible records; and
• Firmographic information: including business type, size, years of operation, and professional roles or job titles.

All personal information is collected and processed in accordance with applicable data protection laws and for the specific purposes outlined in this Privacy Notice.

4.  How long we keep personal information

We retain personal information processed for marketing purposes only for as long as necessary to fulfil the purposes for which it was collected, including the management and delivery of marketing communications, campaigns, and related services.

Personal information may be retained for a reasonable period thereafter in order to:

• Demonstrate compliance with applicable legal and regulatory requirements, including ensuring that appropriate processes are in place to manage enquiries, preferences, and opt-out requests;
• Respond to requests from data subjects or regulatory authorities regarding our marketing practices and processing activities; and
• Establish, exercise, or defend legal rights, including in relation to regulatory actions or potential claims.

Retention periods are determined in accordance with applicable law, internal policies, and the nature of the personal information and processing activities concerned.

5.  Our legal basis for handling personal information

This section outlines the basis on which we process personal information for marketing purposes.

Legitimate interests

We may process personal information where such processing is necessary for our legitimate business interests or those of a third party, provided that such interests are not overridden by your rights and freedoms as a data subject.

Our legitimate interests include:

• Conducting and improving our marketing activities and services;
• Enhancing the accuracy and quality of marketing data, including updating or correcting contact information;
• Ensuring the effectiveness, security, and integrity of our systems and services; and
• Supporting commercial objectives, including the provision of products and services to our clients.

Where we rely on legitimate interests, we ensure that such processing is proportionate, limited to what is necessary, and does not result in undue impact on data subjects.

For further information, please refer to our General Privacy Notice available at: Privacy Center | TransUnion South Africa

Consent

In accordance with POPIA, we will only process personal information for purposes of direct marketing by means of unsolicited electronic communications (including email, SMS, and automated calling) where:

• You have provided voluntary, specific, and informed consent; or
• You are an existing customer, and the requirements of POPIA have been satisfied (see below).

Consent will be obtained in a manner that ensures that:

• You are aware of the nature and purpose of the marketing at the time of collection;
• You are given a reasonable opportunity to refuse or withhold consent; and
• Your consent is properly recorded and can be withdrawn at any time.

You may withdraw your consent at any time by using the opt-out mechanisms provided in our communications or by contacting us directly.

Existing Customer

Where you are an existing customer, and your contact details were obtained in the context of the sale of a product or service, we may use your personal information to send direct marketing communications relating to our own similar products or services, provided that:

• You were given a reasonable opportunity to object to such use of your personal information at the time it was collected; and
• You are given the opportunity to opt out of receiving such communications in each subsequent marketing message.

6.  Who we share personal information with

Our group of companies

As stated, we share personal information among TransUnion companies as appropriate. We have set out a list of current such companies below.

Clients and resale partners

We may share personal information with our clients for the purposes described in this Notice. Our clients maintain their own privacy notices, which provide further information on how they process the personal information we make available to them.

Our clients typically operate across a range of sectors, including:

• Financial services (including banking, lending, credit, mortgages, pensions, investments, and savings);
• Insurance;
• Retail (including motor vehicle sales, leasing, and e-commerce);
• Telecommunications;
• Marketing and advertising agencies acting on behalf of other organisations;
• Automotive dealers;
• Commercial enterprises; and
• Collections and debt recovery services.

Where our clients appoint intermediaries or service providers to act on their behalf, such parties may also receive access to personal information, subject to appropriate contractual and confidentiality safeguards.

We may also appoint authorised data distribution or resale partners to facilitate the provision of our data products and services to third parties, in accordance with applicable data protection requirements.

Service providers

We and our clients may share personal information with third-party service providers who assist us in achieving the purposes described in this Notice. These service providers perform services on our behalf and under our instructions.

Such service providers may include, but are not limited to:

• Providers of data hosting and database management services;
• Printing and distribution service providers responsible for the delivery of direct marketing communications and other correspondence;
• Market research and analytics providers who support insights and customer understanding; and
• Cloud-based technology providers (such as Microsoft Office 365) that support our business operations.

All service providers are contractually bound to implement appropriate technical and organisational measures to protect personal information and are not permitted to process such information for their own purposes or on behalf of third parties, except where you have provided consent or where permitted by law.

7.  Where we store and send personal information

We may, from time to time, make use of service providers located outside of South Africa, including in jurisdictions such as India, the United Kingdom, and the United States.

Where personal information is transferred across borders, we ensure that such transfers are conducted in accordance with applicable data protection requirements. We will not transfer personal information to a jurisdiction that does not provide an adequate level of data protection unless appropriate safeguards are in place. These safeguards may include contractual arrangements requiring the recipient to implement measures that ensure a level of protection substantially equivalent to that required under applicable data protection laws in South Africa.

8.  Your rights concerning personal information

We outline your rights regarding the personal information we hold about you below.

Access: Refer to the PAIA Manual on how to access what personal information we hold about you.

Correction/Destruction/Deletion: If the information we hold about you is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, you have the right to ask us to correct or delete it.

Objection to processing: You may object (on reasonable grounds) to processing your personal information unless legislation provides for such processing.

Objection to direct marketing: You may object to us using your personal information for direct marketing, and if you do, we will stop.

9.  Where to lodge a complaint

We strive to deliver the highest levels of customer service. However, if you are ever unhappy with us,

Location: 10^th Floor, 11 Alice Lane, Sandton, 2196

Postal Address: PO Box 4522, Johannesburg, 2000

Telephone: 0861 482 482

You can also contact our Information Officer or Deputy Information Officer at TUAPrivacy@transunion.com

You may complain to the Information Regulator:

Physical Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg

Postal Address: P.O. Box 31533, Braamfontein, Johannesburg, 2017

Email: POPIAComplaints@inforegulator.org.za.

Site: www.inforegulator.org.za

10.  Changes to this notice

We reserve the right to amend or update this Marketing Services Privacy Notice from time to time to reflect changes in our processing practices, legal or regulatory requirements, or operational needs. Any updated version will be made available on our website, and where appropriate, we will take reasonable steps to notify you of material changes. You are encouraged to review this Notice periodically to remain informed about how we process and protect your personal information.

Last updated: June 2026