Privacy Policy

1. Who We Are

Online Fingerprint Authentication (Pty) Ltd (“Onfinga”, “we”, “our”, “us”) provides Order Confirmation Before Payment.

A seller creates an order confirmation request, the buyer reviews and confirms the order through Onfinga, and the buyer may then continue to the seller’s existing payment method. Onfinga creates and maintains an Order Confirmation Record relating to the confirmation event.

Onfinga does not process the buyer’s payment to the seller and does not determine whether payment has cleared.

This Privacy Policy explains how we process personal information in connection with the Onfinga website and service, including under the Protection of Personal Information Act 4 of 2013 (“POPIA”) and other applicable privacy and data-protection laws.

2. Seller Account Information

When a seller creates or uses an Onfinga account, we may process information including:

• seller name;
• email address;
• seller or merchant identifier;
• account status and account-security information;
• login, session and security records;
• passkey/WebAuthn public credential information and authentication metadata;
• purchase and entitlement information relating to Order Confirmation packages; and
• support communications and other information the seller chooses to provide.

3. Order and Buyer Confirmation Information

When a seller creates an order confirmation request and a buyer uses Onfinga, we may process information needed to present, confirm and record the order. Depending on the transaction, this may include:

• order or transaction identifier;
• seller identifier;
• buyer reference or other reference supplied by the seller;
• item or service description;
• quantity;
• amount and currency;
• confirmation status;
• creation, confirmation and expiry timestamps;
• payment destination selected by the seller;
• device or session identifiers used in the confirmation process;
• IP address and derived or approximate country information where available;
• browser or user-agent information;
• passkey/WebAuthn authentication-event information; and
• record-integrity and technical information used to create, verify, secure or maintain an Order Confirmation Record.

Some of this information may be masked, hashed, pseudonymous or indirectly identifying. It may still constitute personal information where it can reasonably be linked to an identifiable person.

4. Passkeys and Biometric Information

Onfinga uses WebAuthn/passkey technology for authentication and confirmation.

Onfinga stores public credential information and authentication metadata needed to verify passkey events.

Onfinga does not receive or store biometric templates, biometric images, device PINs or passkey private keys. Any fingerprint, facial recognition or device PIN used to unlock a passkey is handled by the user’s device or authenticator rather than by Onfinga.

5. Payment Information

Onfinga does not collect or store buyer full card numbers, CVV/CVC codes or banking credentials as part of the Order Confirmation Before Payment service.

Purchases of Onfinga packages are handled through Paddle as Merchant of Record. Paddle may process payment, billing, tax and transaction information in accordance with Paddle’s own terms and privacy practices.

The Paddle transaction used to purchase Onfinga is separate from the payment transaction between a seller and the seller’s buyer.

6. Website, Analytics and Support Information

When you visit the Onfinga website or contact us, we may process technical and usage information such as IP address, browser or device information, pages viewed, approximate location information where available, analytics events and technical logs.

Our public website currently uses Google Analytics and may use Plausible Analytics to help us understand website usage and improve the service.

These analytics providers may process information according to their own technologies, configurations and privacy policies.

If you contact Onfinga, we may also process your email address, message content and information reasonably necessary to respond to your request.

7. How We Use Personal Information

We may use personal information to:

• create and manage seller accounts;
• verify seller email addresses and authenticate account access;
• create and manage order confirmation requests;
• present order information to buyers;
• record buyer confirmation events;
• create, maintain and provide Order Confirmation Records;
• operate passkey/WebAuthn authentication;
• protect the security and integrity of the service;
• detect fraud, misuse, abuse or unauthorised access;
• manage Order Confirmation package entitlements and purchases;
• provide customer and technical support;
• understand website usage and improve the service; and
• comply with applicable legal, accounting, tax, security and regulatory obligations.

We do not sell buyer confirmation information to data brokers or use Order Confirmation Records for unrelated advertising.

8. Legal Basis and Roles

Depending on the circumstances and applicable law, Onfinga may process personal information because it is necessary to provide the service, because we or another party have a legitimate interest in operating and securing the service, because processing is required by law, or because consent or another lawful basis applies.

In some circumstances, a seller may determine the purpose for which buyer information is supplied to Onfinga. In other circumstances, Onfinga determines the purposes and means of particular processing activities for operating, securing and maintaining the service.

Nothing in this policy relieves a seller of its own obligations under applicable privacy or data-protection law.

9. Service Providers and International Transfers

We may use service providers to help operate Onfinga, including providers of cloud infrastructure, database services, email delivery, security, analytics, domain and network services, and payment or Merchant-of-Record services.

These providers may process personal information on our behalf or as independent providers in accordance with their applicable terms and privacy obligations.

Personal information may be processed in countries other than the country in which the seller or buyer is located. Where applicable law requires safeguards for international transfers, we will use appropriate lawful mechanisms.

10. Data Retention

We retain personal information for as long as reasonably necessary for the purposes for which it was collected or subsequently lawfully processed.

Retention periods may depend on the type of information, the status of the seller account, the need to maintain Order Confirmation Records, security and fraud-prevention requirements, legal or regulatory obligations, accounting and tax requirements, dispute or legal-claim requirements, and other legitimate business purposes permitted by law.

Where information is no longer required, we may delete, anonymise or otherwise dispose of it in accordance with applicable law and our operational requirements.

11. Data Security

We use technical and organisational safeguards designed to protect personal information and Order Confirmation Records against unauthorised access, alteration, loss or misuse.

Security measures may include encrypted communications, access controls, authentication controls, security logging, integrity mechanisms and other safeguards appropriate to the nature of the information and service.

No online service can guarantee absolute security.

12. Your Privacy Rights

Depending on your location and applicable law, you may have rights relating to your personal information, including rights to request access, correction, deletion, restriction, objection or a copy of certain information, and to withdraw consent where processing is based on consent.

Where information was supplied to Onfinga by a seller, we may need to coordinate with that seller when responding to a request.

We may request reasonable information to verify identity before responding to a privacy request.

You may also have the right to complain to an applicable privacy regulator, supervisory authority or court.

13. Children

Onfinga seller accounts are not intended for children.

Sellers are responsible for ensuring that their use of Onfinga, including any processing of information relating to minors, complies with applicable law.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to the service, our practices or applicable law.

Where appropriate or required by law, we will provide notice of material changes.

The Effective Date shown above identifies the current published version.

15. Contact Us

For privacy questions, requests or concerns, contact:

Online Fingerprint Authentication (Pty) Ltd
Registration number: 2024/227769/07
Business address: 9 Knokke Avenue, Table View, Cape Town, 7441, South Africa
Email: admin@onfinga.net