Applying · Guide
What happens to your data when you apply for a loan
Applying online means handing over your ID number, your income details and often your bank statements. That is a lot to give a business you have never met. South Africa's Protection of Personal Information Act, known as POPIA, sets the rules for it: why a company may collect your details, who else may see them, how long they may hold them, and what you can ask for. Here are those rules in plain language, the requests that should worry you, and how BetterLoans handles your details.
Why a lender may ask for so much
POPIA allows a company to collect your personal information only for a purpose that is specific, clearly defined and lawful. For a loan application, that purpose is working out whether you can afford the credit and repay it.
Nothing in that rule stops a lender asking for a lot. Your ID number confirms who you are. Your income and expenses let it run the affordability assessment the National Credit Act requires — what lenders weigh up before approving you sets out that side of it. Bank statements show what actually moves through your account, not what you wrote on a form. What POPIA stops is quiet reuse: details gathered to assess a loan cannot later be turned to something unrelated.
It also puts a duty on the collector at that moment. Section 18 says you must be told the purpose, whether answering is voluntary or compulsory, what happens if you do not answer, who else receives the information, your rights to access, correct and object, and that you may complain to the Information Regulator, with its contact details given to you.
A form that asks for everything and explains nothing is already falling short. For what a credit bureau separately holds about you, see how South Africa's credit bureaus work.
Consent is one lawful reason to use your details, not the only one
Ticking a box is not what makes processing lawful on its own. POPIA sets out six separate grounds and a company may rely on any of them, which is why some processing carries on after you change your mind.
The six are consent, necessity for a contract you are party to, a legal obligation on the company, protecting your own legitimate interest, a public-law duty, and the legitimate interests of the company or a third party. A lender keeping a record because credit law tells it to is not relying on your consent at all.
Where consent is the ground being used, POPIA is strict about its quality. It must be voluntary, specific and informed, and in a dispute the company has to prove you gave it. You never have to prove you did not.
You may withdraw consent at any time, but be clear on what that achieves. It stops further processing that rested on your consent, such as ongoing marketing contact. It does not reverse processing that was already lawful, and it does not touch processing standing on the other five grounds.
That also answers a common question: how can a lender check your credit record when you only ticked one box? The National Credit Act sets out when credit bureaus may receive and report your credit information, and that framework works together with POPIA's contract and legal-obligation grounds. It has never rested on a tickbox alone. For the order in which those checks actually happen, see the journey from submitting to an offer.
Who else sees your details, and how long they are kept
Your details go to the parties named when you handed them over, which for a comparison service means the lending partners it introduces you to. How long each may keep them depends on what the law requires of that business.
POPIA's retention rule is a principle rather than a number. Section 14 says records must not be held longer than the purpose needs, unless the law requires or authorises keeping them, a contract requires it, the company reasonably needs them for its lawful functions, or you agreed. After that it must destroy, delete or de-identify them.
Credit law adds a duty for one kind of business. A registered credit provider must keep records of a credit application, the fact it was declined and the reasons why, and a refused application is retained for three years from the date the application was received. Read that carefully: the clock starts when your application arrived, not on the day you were turned down.
That binds credit providers. BetterLoans is an introducer, not a credit provider, so it does not govern how long we hold a lead. Ours falls under the section 14 principle and is set out in our privacy policy.
One word pair is worth knowing. POPIA calls a business that decides why and how information is used a *responsible party*, and one that only processes it for someone else under contract an *operator*. The responsible party is the one accountable to you, so if a company will not say which role it plays, ask. The different ways to reach a lender sets out who is who.
Your rights, and how to use them
POPIA gives you seven rights over your own information, and using them is meant to be free and easy. You do not need a lawyer or a government PDF.
To be told your information is being collected, what it is for and who else receives it. If a site carries no such notice, take that seriously.
To ask what a company holds, and see it. Put the request in writing and say what you want.
To ask for it to be corrected or deleted, where it is wrong, out of date, excessive, misleading or unlawfully obtained, or where the company is no longer entitled to keep it. Send it free of charge on a form substantially similar to the prescribed Form 2, and the company must tell you in writing what it did. This is a right to *ask*: a business inside a retention period the law imposes on it may lawfully refuse.
To object to how your details are used, including for direct marketing. Same free route, on a form substantially similar to Form 1.
To refuse unsolicited electronic marketing. Object in writing and keep a copy.
To complain to the Information Regulator, on POPIA Form 5, through the online form and eServices portal on its website or on paper at its offices. It must acknowledge your complaint and give you a reference number within fourteen days. Someone may complain on your behalf, and the Regulator must assist anyone who cannot put it in writing, including finding someone who speaks their language. It does act, and has issued enforcement notices against large companies, but nobody can promise you an outcome.
To take the matter to court, a separate route to get your own legal advice on.
One detail makes this more usable than people expect. The regulations let you send an objection or correction request free of charge and by hand, fax, post, email, SMS or WhatsApp. A plain WhatsApp message naming you, what you want and why is a valid request.
Separately, if someone unauthorised gets hold of your information, the company must tell both the Regulator and you as soon as reasonably possible. Disputes about a bureau's own record follow their own process, covered in checking your own credit record.
How BetterLoans handles your information
We collect your details for one purpose, which is matching you with NCR-registered lending partners who may be able to offer you a loan. Those partners receive your details so they can assess your application.
A partner may then contact you about your application by phone call, SMS, WhatsApp or email. We handle your information under POPIA and never sell it for unrelated marketing. You can ask us to access or delete your details at any time, and that is deliberately an ask rather than a promise, for the reason set out above.
On the money, since a free service is a fair thing to be suspicious of: a lending partner pays us a commission when your application is completed through us. You never pay us, and it changes neither the rate a partner offers you nor what we publish here. Every credit decision, rate and term comes from the lender. Our who we are and how the service works explains the service and the privacy policy carries the legal detail.
Before any of that, know which requests mean you are not dealing with a real lender at all. A legitimate lender never asks you to pay a fee before your loan pays out. The National Credit Regulator has warned that fake online credit providers typically charge an upfront fee, that the money is not recoverable, and that charging consumers upfront fees is unlawful.
### Requests a real lender does not make
- Any payment before your money pays out, whatever it is called: insurance, admin, release.
- Your online banking password, card PIN or one-time PIN. SABRIC, the banking industry's fraud centre, says banks never ask for these. Nobody legitimate needs them, so treat any lender asking the same way.
- An instruction to move money to another account to keep it safe or verify you. SABRIC warns against that too, and it is our own plain advice as well.
- An offer with no credit check at all. A registered provider cannot lawfully skip the affordability assessment.
Seeing an NCR registration number is not enough on its own, because a fake operation may use a real provider's number. Look it up on the NCR's public Register of Registrants and confirm it belongs to the business contacting you. A listed address that goes nowhere is another warning sign. Our walkthrough of applying online safely covers the other checks worth making.
If you are under debt review you cannot lawfully take on new credit, so your debt counsellor's process is the right first step rather than a new application here.
Reading this page commits you to nothing. When you do want to look at options, one short form introduces you to NCR-registered lending partners who assess your application and decide. We are the introducer, not the lender. You pay us nothing, approval rests on affordability and each partner's own checks, and no offer obliges you to take it.