1. Information we collect
We only collect what you give us or what is needed to run the site:
- Details you submit through our forms (Request a Callback, Send us a message) and the FX Risk Scorecard: your name, company, email address, phone number, whether you import or export, and any message or answers you provide.
- Basic technical data your browser sends automatically (such as IP address and device type) and essential site storage needed for pages to work. We do not use advertising, cross-site tracking cookies, or website analytics tools.
The Scorecard collects business-profile information (trading volumes, currency exposure, risk appetite). This is commercial in nature and does not constitute special personal information under POPIA. If you voluntarily share sensitive personal information in a free-text field, we will treat it with additional care and process it only to the extent necessary.
2. How we use it
- To respond to your enquiry and, where you ask, to call you back.
- To provide our foreign exchange risk management services and generate your Scorecard result.
- To send you our market commentary, only if you have asked to receive it.
- To meet our legal and regulatory obligations as an FSCA-licensed provider (including FAIS record-keeping and FICA/AML compliance obligations).
3. Our lawful basis
We process your information based on:
- Your consent — given when you submit a form. You may withdraw consent at any time (see your rights below).
- Legitimate interest — in responding to your enquiry and running our business, where this does not override your rights.
- Legal obligation — where we are required to collect, retain or disclose information by applicable law (including FAIS, FICA and exchange control regulations).
4. Who we share it with
We do not sell your personal information, and we do not share it for anyone else's marketing. We use a small number of trusted service providers (operators under POPIA) who process data only on our instructions:
- Brevo (France / EU) — delivers our emails and stores our contact list.
- Google Workspace (USA) — our business email and productivity platform.
- Groq (USA) — processes your Scorecard answers to generate your written result. Under Groq's terms, data submitted via its API is not used to train its models. See groq.com for their privacy policy.
- Our hosting provider — runs the website infrastructure on our behalf.
- nCino KYC — if you proceed to become a client, your identity and KYC information is verified and stored on the nCino KYC platform in accordance with FICA requirements.
Our market-data provider supplies exchange rates only and receives no personal information. We may also disclose information where required by law, a regulator, or a court order.
5. Cross-border transfers
Several of our service providers operate outside South Africa (including in the EU and USA). Where your information is processed abroad, we use providers that offer a level of protection consistent with POPIA's requirements. Brevo is subject to the EU General Data Protection Regulation (GDPR), which the Information Regulator recognises as providing adequate protection. Groq and Google operate under standard contractual commitments and data-processing agreements.
6. Keeping your information safe
We apply reasonable technical and organisational measures to protect your information against loss, misuse or unauthorised access, including encrypted transmission (HTTPS), access controls, and secure cloud storage. No system is perfectly secure, but we take this seriously and will notify you and the Information Regulator if a breach occurs that is likely to affect your rights.
7. How long we keep it
| Type of record | Retention period |
|---|---|
| Website enquiry / callback request | 1 year from last contact, or until you ask us to delete it |
| Market commentary subscription | Until you unsubscribe |
| FAIS advice and intermediary records | 5 years (as required by the FAIS Act) |
| FICA / KYC / AML records | 5 years from end of business relationship (as required by FICA) |
| Exchange control records | As required by SARB regulations |
After the applicable period, records are deleted or anonymised.
8. Your rights under POPIA
You have the right to ask us to:
- confirm what personal information we hold about you and give you a copy of it;
- correct or update it;
- delete it, where we are not required by law to keep it;
- object to a particular use; and
- withdraw a consent you previously gave.
To exercise any of these rights, contact our Information Officer:
Joel Ramdiyal — Information Officer
Email: compliance@devarconsulting.co.za
Phone: +27 11 791 6477
If you are not satisfied with our response, you have the right to complain to the Information Regulator (South Africa):
| Website | www.inforegulator.org.za |
|---|---|
| PAIAComplaints@inforegulator.org.za / enquiries@inforegulator.org.za | |
| Phone | +27 10 023 5200 |
| Address | JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 |
| Postal | PO Box 31533, Braamfontein, Johannesburg, 2017 |
9. Changes to this policy
We may update this notice from time to time. The latest version will always be on this page, with the "last updated" date above.
10. Contact us
Devar Consulting (Pty) Ltd
Independent FX Risk Management · FSCA-licensed FSP 46282
Company registration: 2012/077924/07
126 Bagley Terrace, Valeriedene, 2195, Johannesburg
General enquiries: info@devarconsulting.co.za | +27 11 791 6477 / 6859
POPIA / PAIA requests: compliance@devarconsulting.co.za (Information Officer: Joel Ramdiyal)
This privacy notice is provided for general information and to meet POPIA's transparency requirements. It does not form part of any advisory mandate. For access to information requests, please refer to our PAIA Manual (available on request).