Privacy & POPIA Policy

SS Group (Pty) Ltd, trading as Claim Tracker, is committed to lawful, reasonable and transparent processing of personal information under the Protection of Personal Information Act 4 of 2013 (POPIA).

1. Responsible party

For the Claim Tracker service, SS Group (Pty) Ltd determines why and how personal information is processed and is therefore generally the responsible party under POPIA. Certain service providers may act as operators under written arrangements.

2. Scope

This policy applies to the Claim Tracker website, account registration, subscription payments, customer support, claim-related document handling, status communications and related administrative activities. It applies to claimants, authorised representatives, website visitors, payers and persons whose information is lawfully included in claim records.

3. Personal information we may process

• Identity and contact information, such as name, identity or passport number, date of birth, address, telephone number and email address.
• RAF claim information, accident details, claim numbers, correspondence, status information and supporting documents.
• Special personal information where necessary and lawful, including health, injury, disability or medical information relevant to the claim.
• Authority and relationship information, including mandates, proxies, guardianship or representative details.
• Payment and transaction information. Full card data may be processed directly by an authorised payment provider rather than stored by us.
• Account, device, access, communication, support and security logs, including IP address and browser information.

4. Sources

Information may be collected directly from the user or claimant; an authorised representative; documents submitted to the service; payment, hosting or communications providers; the RAF or another public body where access is lawful and authorised; and other parties involved in the claim where lawful.

5. Purposes of processing

• Create, verify and administer accounts and subscriptions.
• Identify and organise a claim and supporting documents.
• Provide authorised claim-status tracking, communications and customer support.
• Verify identity, authority, mandates and payment status.
• Protect users, investigate suspected fraud, maintain security and prevent misuse.
• Keep legal, accounting and transaction records and manage complaints or disputes.
• Improve service reliability and user experience using appropriately minimised information.
• Comply with applicable law, lawful requests and regulatory duties.

6. Lawful justification

Depending on the context, processing is based on consent; performance of an agreement; compliance with a legal obligation; protection of a legitimate interest of the data subject; or pursuit of our legitimate interests or those of a third party where permitted by POPIA. Special personal information is processed only where a POPIA authorisation applies, including consent or where processing is necessary for the establishment, exercise or defence of a right or obligation in law.

7. Mandatory and voluntary information

Information requested for account creation, identity or authority verification, payment and claim matching may be mandatory for service delivery. If it is not provided, we may be unable to activate or continue the service. Optional information will be identified where reasonably practicable.

8. Sharing and operators

We may share only what is reasonably necessary with authorised payment processors, hosting and cloud providers, communications providers, security and verification providers, professional advisers, the RAF or other relevant authorities or claim participants, and regulators or law-enforcement bodies where legally required.

Operators must process information only with our authorisation, maintain confidentiality and implement appropriate safeguards. We do not sell personal information.

9. Cross-border processing

Some technology or support providers may process information outside South Africa. Where this occurs, we will use a lawful transfer basis under POPIA and take reasonable steps to ensure an adequate level of protection, an appropriate binding agreement or another permitted safeguard.

10. Direct marketing and communications

Service messages about accounts, security, payments, documents and claim updates are necessary operational communications. Promotional electronic messages will be sent only where permitted by law. Recipients may opt out of marketing using the method provided in the message or by contacting us; opting out does not stop essential service communications.

11. Cookies and analytics

The website may use essential cookies for login, security, preferences and session management, and limited analytics to understand performance. Non-essential cookies will be managed according to applicable consent requirements. Browser settings may block cookies, but some service features may then not function correctly.

12. Security safeguards

We use reasonable technical and organisational measures appropriate to the nature of the information and foreseeable risks. Measures may include access controls, authentication, encryption in transit where supported, logging, backups, confidentiality duties, operator controls, vulnerability management and incident response. No electronic system can be guaranteed completely secure.

13. Security compromises

Where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, we will investigate, contain and assess the incident and notify the Information Regulator and affected data subjects as soon as reasonably possible where POPIA requires, unless a lawful restriction applies.

14. Information quality

Users should keep details accurate and notify us of changes. We may take reasonable steps to verify or update information, particularly where incorrect data could cause a claim to be mismatched or disclosed to the wrong person.

15. Retention and deletion

We retain personal information only as long as reasonably necessary for service delivery, legal or contractual duties, accounting, dispute resolution, security and proof of transactions. Retention periods vary by record and claim status. When no longer required, information will be securely deleted, destroyed or de-identified, subject to lawful archival or evidentiary needs.

16. Data-subject rights

17. Exercising rights

Send a written request to claimtracker@ssgroup.tech. Describe the request and provide sufficient information for us to identify the relevant record. We may verify identity or authority before disclosing or changing confidential information. Access may be subject to PAIA and any lawful fee or refusal ground. We will respond within the periods required by applicable law.

18. Children and persons requiring representation

The service is intended for adult users. Information about a child or legally incompetent person will be processed only with appropriate consent or another lawful authorisation, and with proof of guardianship or representative authority where required.

19. Automated decisions

Claim Tracker does not make official RAF claim decisions. If automated tools are used for routing, matching, security or reminders, they do not determine whether the RAF must accept or pay a claim.

20. Complaints and regulator

Privacy concerns should first be sent to us so that we can investigate. A person may also lodge a complaint with the Information Regulator of South Africa. Current complaint channels and forms are available at inforegulator.org.za/complaints.

21. Changes to this policy

We may update this policy when the service, providers or legal requirements change. Material changes will be posted or communicated through available contact details. Where the law requires new consent, we will request it.

22. Privacy contact