Join Early Access

Privacy Policy

Effective Date: May 31, 2026

Company: Online Fingerprint Authentication (Pty) Ltd (“Onfinga”)

Jurisdiction: Republic of South Africa | Global where applicable

1. Who We Are

Online Fingerprint Authentication (Pty) Ltd (“Onfinga”, “we”, “our”, “us”) provides a transaction confirmation and evidence-recording service for selected online transactions. For short-term rental operators and other customers, our service enables the creation of a pre-payment confirmation record showing selected transaction or booking information displayed to a guest or buyer, together with confirmation-event metadata captured before the transaction proceeds to the existing payment flow.

In this policy, “PCR” may refer to a Purchase Confirmation Record or Pre-Payment Confirmation Record, depending on the product context.

Onfinga does not process payments, does not store card data, does not replace 3D Secure, does not authenticate cardholders for issuers or card schemes, does not decide disputes, does not guarantee that fraud, abuse, or chargebacks will not occur, does not guarantee chargeback outcomes, does not determine liability shift, and does not determine consumer refund rights. Onfinga also does not acquire transactions or issue cards.

This Privacy Policy explains how we process information in connection with our services, including under the Protection of Personal Information Act, 2013 (“POPIA”), the General Data Protection Regulation (“GDPR”) where applicable, and other applicable privacy laws.

2. What Data We Collect

A. Operator, merchant, and institutional customer data

We collect limited information when a short-term rental operator, merchant, PSP, acquirer, payment facilitator, bank, or other institutional customer signs up for, requests access to, or uses Onfinga:

B. Guest- or buyer-related PCR and transaction metadata

Depending on the operator, merchant, or customer integration and configuration, we may process limited guest- or buyer-related transaction metadata to create and maintain a Purchase Confirmation Record or Pre-Payment Confirmation Record (“PCR”). This may include:

We do not usually collect directly identifying guest or buyer information such as full names, email addresses, phone numbers, identity numbers, full card numbers, CVV/CVC codes, biometric templates, biometric images, device PINs, passkey private keys, or banking credentials.

However, we may process limited guest- or buyer-related transaction metadata, device/session metadata, authentication-event metadata, operator- or merchant-provided references, payment references, and record-integrity data. Some of this information may be masked, hashed, pseudonymous, or indirectly identifying, but it may still be personal information or personal data where it can reasonably be linked to an identifiable guest or buyer by Onfinga, an operator, merchant, PSP, acquirer, bank, payment facilitator, or other authorised party.

Some of this information may be pseudonymous, masked, or hashed. It may still be personal information or personal data where it can reasonably be linked to an identifiable guest or buyer.

Onfinga does not collect or store full card numbers, CVV/CVC codes, card PINs, banking passwords, biometric templates, biometric images, device PINs, passkey private keys, or raw biometric data.

C. Website and support data

When you visit our website, request pilot access, submit a contact/demo/intake form, or contact support, we may process contact details, business details, form responses, messages, analytics events, cookie preferences, and technical logs needed to operate, secure, evaluate, and improve our public website, pilot process, and support channels.

Users should not submit guest personal information, payment card data, banking credentials, login credentials, API keys, live dispute documents, identity documents, or sensitive personal information through public website forms unless specifically requested through a secure approved channel.

3. How We Use Data

We use data to:

We do not use guest- or buyer-related PCR data for unrelated advertising, sale to data brokers, unrelated profiling, or training unrelated AI models.

4. Legal Basis for Processing (GDPR & POPIA)

Depending on the deployment, Onfinga may act as an operator/processor for a short-term rental operator, merchant, PSP, acquirer, payment facilitator, bank, or other institutional customer, or as a responsible party/controller for limited purposes where we determine the means and purposes of processing.

The applicable lawful basis may include contractual necessity, legitimate interests, compliance with legal obligations, or consent where required.

Data type Purpose GDPR basis POPIA basis / role
Operator, merchant, or customer account data Provide and manage services Contractual necessity / legitimate interests Contractual necessity, legitimate business purpose, or responsible party processing
Guest- or buyer-related PCR metadata Create and preserve transaction confirmation records Legitimate interests, contractual necessity where applicable, or consent where required Lawful processing for legitimate interests or contractual purposes; often processed as operator/processor for the operator, merchant, or institutional customer
Security logs Security, abuse prevention, audit Legitimate interests / legal obligation Security, legal compliance, and platform protection
Billing records Tax, accounting, invoicing Legal obligation / contractual necessity Legal obligation and contractual necessity
Optional analytics Service improvement using aggregated or de-identified data Legitimate interests or consent where required Legitimate purpose, preferably de-identified or aggregated

Where consent is required by applicable law or customer configuration, the operator, merchant, or relevant responsible party/controller must ensure that valid notice and consent are obtained.

5. Data Storage & Retention

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, unless a longer period is required or permitted by law, contract, tax/accounting rules, card scheme rules, dispute requirements, audit, security, or legal defence.

Verification logs are generally retained for 12 months. PCR transaction metadata is generally retained for 18 months and may be retained for up to 24 months where required for dispute support, chargeback response, audit, fraud/risk review, legal defence, or customer agreement. Operator, retailer, merchant, or customer account data is retained for the account lifetime plus 24 months. Billing and invoice records are retained for 5 years or longer if required by applicable tax or accounting law.

Where a dispute, investigation, complaint, legal claim, security incident, regulatory request, or chargeback process is ongoing, relevant records may be retained until the matter is resolved and any applicable limitation period has expired. After expiry of the applicable retention period, records are deleted, anonymised, or securely archived.

Data is stored on encrypted infrastructure and protected via role-based access control, audit logs, and encryption at rest and in transit.

6. Your Rights

Depending on your location and the applicable law, you may have rights to access, correct, delete, restrict, object to, or receive a copy of personal information, and to withdraw consent where processing is based on consent.

Where we process guest- or buyer-related PCR data on behalf of an operator, merchant, or institutional customer, that operator, merchant, or customer may be the responsible party/controller. In that case, we may refer your request to them or assist them in responding. We may require reasonable identity verification before disclosing PCR-related information. Access may be limited or redacted where permitted by law to protect security, confidential commercial information, platform-abuse prevention measures, or the rights of others.

To exercise your rights, contact: support@onfinga.net. You may also have the right to lodge a complaint with a relevant information regulator, supervisory authority, ombud, or court.

7. Data Security

We apply modern security measures to personal information and PCR records, including:

8. Subprocessors and International Transfers

We may use subprocessors and infrastructure providers to host, protect, monitor, and operate the service, including cloud hosting, DNS, edge security, email, analytics, logging, and support providers.

Where personal information is transferred outside South Africa or the EEA/UK, we use appropriate safeguards required by applicable law, which may include contractual safeguards, Standard Contractual Clauses, transfer impact assessments where required, and POPIA section 72 transfer mechanisms.

9. Automated decision-making

Onfinga does not make automated decisions that determine whether a guest or buyer receives a stay, goods, or services, whether a payment is approved or declined, whether a refund is granted, or whether a chargeback or dispute succeeds. Any such decisions are made by the operator, merchant, PSP, acquirer, issuer, card scheme, bank, regulator, court, ombud, or other relevant decision-maker.

10. Operator, merchant, and institutional customer responsibility

Operators, merchants, and institutional customers are responsible for ensuring that booking or transaction information, purchase terms, refund/cancellation terms, recurring-payment terms, and guest or buyer notices shown during checkout are accurate, lawful, fair, and not misleading. They are also responsible for using PCR records only for lawful, permitted purposes and not to mislead guests or buyers or suppress lawful disputes, refunds, chargebacks, complaints, or data protection rights.

11. Children's Data

Onfinga is not intended for use by children under 18. We do not knowingly collect data from minors. Operators, merchants, and institutional customers must not use Onfinga in connection with transactions directed at children or where children’s personal information is knowingly processed, unless appropriate legal authority, parental/guardian consent where required, and additional safeguards are in place.

12. Changes to This Policy

We may update this Privacy Policy periodically. Material changes may be notified by email, dashboard notice, or website update where appropriate. Continued use of Onfinga after notice constitutes acceptance of changes where legally permitted.

13. Contact Us

For privacy questions or concerns:

Data Privacy Contact
support@onfinga.net

Online Fingerprint Authentication (Pty) Ltd
Western Cape, South Africa