Privacy Policy

Last updated: September 19, 2026. Applies to visitors and subscribers in South Africa.

This Privacy Policy explains what personal information Kredua collects when you visit the South African pages of this website (pages under /za/ and posts whose address begins with “za-“), answer one of our quizzes, subscribe to our emails or contact us; how we use and share it; and the rights you have under the Protection of Personal Information Act 4 of 2013 (“POPIA”), the Electronic Communications and Transactions Act 25 of 2002 (“ECT Act”) and the Consumer Protection Act 68 of 2008 (“CPA”).

1. Responsible party and Information Officer

The responsible party is RR Digital (trading as Kredua), a company registered in Brazil under CNPJ , with its registered address at Rua Balbino Bento da Silva, 02, União dos Palmares/AL, 57800-000, Brazil (“Kredua”, “we”, “us”). Although we are not domiciled in South Africa, we process personal information of people in South Africa by automated means, so POPIA applies to that processing under section 3(1)(b).

Our Information Officer for POPIA purposes can be reached at [email protected]. This is the channel for questions about this policy and for exercising your rights.

2. Personal information we collect

  • Information you give us: your name, your email address and, only where we ask for it expressly and you choose to give it, your cellphone number, when you complete a quiz, subscribe to our recommendations or use the contact form. Also the answers you give in the quizzes (for example what matters most to you in a card, whether you travel often, the amount you need or how you describe your credit status). We do not ask for your ID number, bank account details, card numbers or any special personal information as defined in section 26 of POPIA.
  • Information collected automatically: IP address, approximate country, device and browser type, pages visited, the source of your visit (UTM parameters) and identifiers stored in cookies or similar technologies, as described in section 10.
  • Email interaction data: opens, clicks and unsubscribes, when you receive our emails.

We do not access any credit bureau (TransUnion, Experian, XDS, VeriCred or others) and hold no credit information about you. Information you enter on a bank’s website when applying for a product is processed by that bank, not by Kredua.

3. Why we process it and on what basis

POPIA requires a lawful justification for each purpose (section 11). Ours are:

  • Showing you the site and calculating your quiz result — necessary to provide the service you asked for.
  • Sending you email recommendations about cards, loans and money topics — your consent, given when you tick the box in the quiz or form. This is direct marketing by electronic means under section 69 of POPIA and section 45 of the ECT Act; you can withdraw consent at any time and every email contains an unsubscribe link.
  • Answering your messages — necessary to respond to a request you made.
  • Security, fraud prevention and abuse detection — our legitimate interest in keeping the site and our subscribers safe.
  • Aggregated statistics to improve the site — our legitimate interest; the data is not used to identify you.
  • Advertising and measuring its performance, including personalised advertising by third parties — your consent, given through the cookie banner; you can refuse or change it without losing access to the content.
  • Complying with the law and with lawful requests from authorities — a legal obligation.

4. Automated decisions

The quizzes apply simple rules (for example, the amount you select determines which review we show you). They do not produce decisions with legal or similarly significant effects, and no product is approved or declined by Kredua; the credit decision is always made by the credit provider under the National Credit Act. Advertising platforms may build profiles to personalise ads only where you have accepted the corresponding cookies.

5. Who we share it with (operators and third parties)

We do not sell your personal information. We share it only with service providers acting as operators under section 20 of POPIA, under written agreements and on our instructions:

  • Email delivery: MailerSend and our own email automation system, which stores your name, email address and interactions with our messages.
  • Hosting and infrastructure: OVH (servers in Europe and Canada) and Cloudflare (content delivery, security and DNS).
  • Measurement and advertising: Google (Google Ad Manager and AdSense, Google Analytics, Google Tag Manager) and Meta (pixel and Conversions API), only when you accept the corresponding cookies. When we send a conversion event to these platforms from our server, your email address is hashed with an irreversible function before transmission.
  • Public authorities, including the Information Regulator, where a law or a valid request requires it.

The banks and credit providers whose websites we link to are independent responsible parties. When you press “Go to the official website” you leave Kredua and the institution’s privacy notice applies. We do not send your information to them.

6. Transfers outside South Africa

Kredua is established in Brazil, and our operators (Google, Meta, Cloudflare, MailerSend, OVH) process information in the United States, Canada, Brazil or the European Union. Section 72 of POPIA allows such transfers where the recipient is bound by an agreement that provides substantially similar protection to POPIA, or where you have consented. We rely on written agreements with our operators that impose those protections, and on your consent for the email communications you subscribe to.

7. How long we keep it

  • Subscriber data (name, email, phone, quiz answers, email interactions): for as long as you remain subscribed, and for 12 months after you unsubscribe so that we can prove your consent history and honour the opt-out; then deleted or anonymised.
  • Contact messages: 24 months after the last exchange.
  • Server and security logs: up to 12 months.
  • Analytics data: aggregated and non-identifying after 14 months.
  • Records required by law (for example evidence of consent for direct marketing): for as long as the law requires.

8. Your rights under POPIA

You have the right to:

  • be told what personal information we hold about you and to access it (section 23);
  • ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully (section 24);
  • object to processing based on our legitimate interests, and to object at any time to direct marketing (sections 11(3) and 69);
  • withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal;
  • not be subject to a decision based solely on automated processing that has legal effects on you (section 71);
  • complain to the Information Regulator (South Africa) at inforegulator.org.za or [email protected].

To exercise a right, write to [email protected] from the email address you registered, or use the unsubscribe link in any email. We may ask you to confirm your identity in a proportionate way. We answer within a reasonable time and in any case within 30 days; access requests are free of charge.

9. Direct marketing

We only send marketing emails to people who have given consent through a quiz or form on this site, in line with section 69 of POPIA. Each message identifies Kredua as the sender, includes our physical address and provides a working unsubscribe link. Unsubscribe requests are honoured within 24 hours. We do not send unsolicited SMS marketing and we do not sell or rent our subscriber list.

10. Cookies and similar technologies

We use the following categories of cookies and tags. Categories other than “necessary” are only activated after you accept them in the cookie banner, and you can change your choice at any time through the “Cookie settings” link in the footer.

  • Necessary: session, security and cookie-preference cookies (up to 12 months). They cannot be disabled.
  • First-party measurement: anonymous identifiers we use to count visits and sessions and to measure which content is useful (up to 30 days for the visitor identifier, 30 minutes for the session).
  • Advertising and measurement by third parties: Google (Ad Manager, AdSense, Analytics, Tag Manager) and Meta (pixel). These may be used by those companies to personalise advertising on other sites; their durations range from a session to 24 months. You can also opt out through Google Ads Settings and your Meta ad preferences.

Your browser lets you delete cookies and block them for this site. Blocking necessary cookies may prevent parts of the site from working.

11. Security

We apply reasonable technical and organisational measures as required by section 19 of POPIA: encryption in transit (HTTPS), access controls and logging on our systems, hashing of email addresses sent to advertising platforms, and contractual security obligations for our operators. If a security compromise affects your personal information, we will notify the Information Regulator and you as required by section 22.

12. Children

The site and the quizzes are intended for adults aged 18 and older, the minimum age for a credit agreement in South Africa. We do not knowingly collect personal information from children under 18. If you believe a child has subscribed, write to us and we will delete the record.

13. Links to other websites

The site links to the official websites of banks and credit providers and to other third-party sites. We are not responsible for their content or their privacy practices; read their notices before providing information.

14. Changes to this policy

We may update this policy to reflect changes in the law or in our practices. The date at the top shows the latest version. If a change materially affects how we use your information, we will inform subscribers by email before it takes effect.

15. Contact

Information Officer: [email protected]. General contact: [email protected]. Post: RR Digital, Rua Balbino Bento da Silva, 02, União dos Palmares/AL, 57800-000, Brazil. Regulator: Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001.

Last updated: 19/09/2026