POPIA Compliance

SS Group (Pty) Ltd, trading as Claim Tracker, is committed to protecting your personal information and complying with the Protection of Personal Information Act 4 of 2013 (POPIA). This page summarises how we meet POPIA's eight conditions for lawful processing. The full, binding detail — including retention periods, sharing, security and your rights — is set out in our Privacy & POPIA Policy, which this page does not override.

POPIA's eight conditions for lawful processing

1. Accountability

SS Group (Pty) Ltd is the responsible party for personal information processed through Claim Tracker and is accountable for meeting POPIA's conditions across our own systems and any operators we use.

2. Processing limitation

We only collect and process personal information that is lawfully obtained, necessary for providing the claim-tracking service, and processed for a lawful purpose related to that service.

3. Purpose specification

Information is collected for specific purposes: verifying identity, administering accounts and subscriptions, tracking and communicating about RAF claims, processing payments, customer support, and legal compliance. See the Privacy & POPIA Policy for the full list.

4. Further processing limitation

We do not process personal information for a secondary purpose incompatible with the original purpose, unless a further POPIA-permitted ground applies.

5. Information quality

We take reasonable steps to keep information complete, accurate and up to date, and users can request correction of inaccurate information at any time.

6. Openness

We are transparent about what we collect, why, and who may see it, through this page, the Privacy & POPIA Policy, the Terms and Conditions and the Client Mandate and Consent.

7. Security safeguards

We use reasonable technical and organisational measures appropriate to the nature of the information and foreseeable risks — see section 12 of the Privacy & POPIA Policy for detail. No electronic system can be guaranteed completely secure.

8. Data subject participation

Data subjects may request access, correction or deletion of their information, object to processing, request restriction, and lodge a complaint with us or the Information Regulator.

Your rights at a glance

How we obtain your consent

We obtain consent during account registration, through the POPIA acknowledgement in the registration form and, where you are authorising us to make claim enquiries on your behalf, through the Client Mandate and Consent. We record the timestamp and IP address of consent for audit purposes. You may withdraw consent at any time, though this may affect our ability to continue the service.

Data breach response

Where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, we will investigate, contain and assess the incident and notify the Information Regulator and affected data subjects as soon as reasonably possible where POPIA requires.

Cross-border processing

Some technology or support providers may process information outside South Africa. Where this occurs, we use a lawful transfer basis under POPIA and take reasonable steps to ensure an adequate level of protection.

Automated decision-making

Claim Tracker does not make official RAF claim decisions. Any automated tools used for routing, matching, security or reminders do not determine whether the RAF must accept or pay a claim.

How to exercise your rights

We will respond within the periods required by applicable law.

Complaints to the Information Regulator