Privacy Policy

Umhlakasi Electricity Advance (Pty) Ltd operates the Umhlakasi website, portal and customer access channels. Electricity advances accessed through Umhlakasi are provided by BluAdvance.

1. Who we are

Umhlakasi Electricity Advance (Pty) Ltd, registration number 2025/442870/07 ("Umhlakasi", "we", "us" or "our"), operates the Umhlakasi website, web portal and customer access channels.

This Privacy Policy explains how Umhlakasi collects, uses, shares, stores and protects personal information when you visit our website, create or use an Umhlakasi profile, contact us, or use Umhlakasi through the web portal, MoyaApp, WhatsApp, USSD, a partner-branded channel or another approved interface.

Our current customer access details are:

• Website: https://umhlakasi.co.za/
• Web portal: https://portal.umhlakasi.co.za/
• WhatsApp and MoyaApp messaging number: +27 87 813 4433
• USSD: *120*12209#
• Support: support@umhlakasi.co.za

2. Umhlakasi and BluAdvance have different privacy roles

Electricity advances accessed through Umhlakasi are provided by BluAdvance. Umhlakasi operates the customer-facing access platform and handles personal information for the purposes described in this policy.

BluAdvance and relevant members of the Blue Label Group may separately determine why and how they process personal information for provider registration, eligibility assessment, advance fulfilment, repayment, fraud prevention, account administration and related purposes. Their processing is governed by the BluAdvance Terms and Conditions of Agreement and the Blue Label Group Privacy Notice referred to in those terms.

Depending on the activity and the applicable agreements, a third party may act as:

• a separate responsible party for its own processing;
• an operator processing information for Umhlakasi under written instructions; or
• a supplier or service provider with its own legal duties.

Nothing in this policy describes Umhlakasi and BluAdvance as joint responsible parties unless a written agreement and applicable law establish that relationship. This policy does not replace the BluAdvance terms or the Blue Label Group Privacy Notice.

3. The personal information we may process

The information we process depends on how you use Umhlakasi and may include:

3.1 Identity and contact information

Your first and last name, South African mobile number, email address, customer or provider identifiers, language preference and contact preferences.

3.2 Account, verification and security information

Your Umhlakasi profile details, password or PIN in protected form, verification status, one-time-code and recovery events, terms and consent records, login history, security events and account settings. Do not send us your password, PIN or one-time verification code through support channels.

3.3 Prepaid meter and electricity information

Meter numbers, meter labels, primary or archived-meter status, linked customer or channel details, utility or municipality information returned by relevant systems, and information needed to select, reconcile or support a meter.

3.4 Electricity-advance information

Eligibility requests and results, offered advance options or limits, accepted terms, selected amount, service fee, token value, transaction status, provider reference, electricity token, units where supplied, outstanding balance, repayments, purchase and payment history, previous-token requests and related support information.

The currently published electricity-advance options are R20, R30 and R50 inclusive of the associated service fee. The currently published BluAdvance fee is R5 including VAT per electricity advance. Eligibility and the option made available may depend on transaction, purchase, usage and repayment history and other provider criteria.

3.5 Free Basic Electricity information

The selected meter, FBE request, supplier response, claim status, provider reference, token and related information needed to check or claim an allocation. FBE eligibility and allocation are determined by the relevant municipality or electricity supplier, not by Umhlakasi.

3.6 Payment and order information

Payment amount, payment status, provider and bank references, sales-order information, refund or reconciliation status and, where you give consent, reusable payment-authorisation metadata supplied by the payment provider. Umhlakasi does not intend to store your full payment-card number, card verification value or online-banking password.

3.7 Communications and support information

Messages and menu selections sent through MoyaApp, WhatsApp, USSD, email, SMS or the portal; support requests; conversation and channel identifiers; delivery status; notes; support outcomes; and information needed to continue the same customer journey across supported channels.

3.8 Partner information

The partner or campaign through which you accessed Umhlakasi, partner-specific channel or profile identifiers, referral information and information needed to provide a partner-branded or embedded experience.

3.9 Technical and usage information

IP address, device and browser information, operating system, pages and features used, timestamps, referral URL, cookies or similar technologies, system logs, request identifiers, security data, error reports and diagnostic information.

3.10 Inferences and risk information

Eligibility, fraud, security, repayment-propensity or service-risk indicators derived from the information above, where permitted by law and required for the service.

We do not intentionally ask for more information than is reasonably necessary for the relevant purpose.

4. Where we obtain personal information

We may obtain personal information:

• directly from you when you register, log in, send a message, select a menu option, make a request, update your details, accept terms, make a payment or contact support;
• from BluAdvance, members of the Blue Label Group, suppliers, merchants, utility systems and service providers involved in eligibility, fulfilment, token delivery, purchase history, repayment or reconciliation;
• from municipalities, electricity suppliers or authorised systems when checking or claiming FBE;
• from MoyaApp, WhatsApp/Meta, our USSD provider, email or SMS providers and customer-support systems;
• from payment providers, banks and card schemes in relation to a payment, refund, reusable authorisation or reconciliation;
• from an approved partner through which you accessed the service;
• automatically from your device, browser and use of our systems; and
• from public or lawful third-party sources where necessary and permitted by law.

If you provide information about another person, for example when using a shared device or buying for a meter associated with another person, you must be authorised to do so and should explain the relevant processing to that person.

5. Why we process personal information

We may process personal information to:

• create, verify, secure and administer your Umhlakasi profile;
• authenticate you and recover access to your account;
• provide and support the website, portal, MoyaApp, WhatsApp, USSD and partner-channel journeys;
• identify, select, label, reconcile and support prepaid meters;
• send a request to BluAdvance, display eligibility and offered options, record terms acceptance, fulfil an approved advance and show balances, repayments, history and tokens;
• check or claim an available FBE allocation through authorised supplier systems;
• initiate, verify, reconcile and support payments, refunds and repayment transactions;
• prevent duplicate value delivery, fraud, abuse and unauthorised access;
• provide customer support, respond to complaints and investigate unfamiliar transactions;
• send service, security, verification, transaction, support and legal notices;
• maintain records, audit trails, reporting and financial reconciliation;
• operate partner-branded access and attribute transactions to the correct partner or channel;
• troubleshoot, test, monitor and improve service performance and customer experience;
• comply with legal, regulatory, tax, accounting, audit, court and law-enforcement requirements;
• establish, exercise or defend legal rights; and
• send direct marketing where you have consented or where another lawful basis permits it, subject to your right to opt out.

6. Legal grounds and conditions for processing

We process personal information only where permitted under POPIA and other applicable law. Depending on the activity, processing may be necessary to:

• take steps at your request or perform a contract;
• comply with a legal obligation;
• protect a legitimate interest of you, Umhlakasi or a third party where the law permits;
• pursue Umhlakasi's legitimate operational, security, fraud-prevention, support or service-improvement interests in a proportionate way; or
• act on your consent where consent is required.

Where we rely on consent, you may withdraw it for future processing, but withdrawal does not make earlier lawful processing invalid and may prevent us from providing a feature that genuinely depends on that information.

7. Eligibility assessments and automated decisions

BluAdvance may use transaction, purchase, usage and payment or repayment history, together with other qualification and risk criteria, to decide whether a customer qualifies and which advance option is available. Umhlakasi may transmit the required information, receive the result and display it in the channel you use.

A previous approval does not guarantee a later request. Only one electricity advance may be active at a time through the current service, and the earlier advance must be settled before another can be approved.

Where a decision based solely on automated processing has a legal or similarly significant effect and POPIA gives you a right to challenge it, you may contact us to request available information about the decision and the appropriate review or provider-contact process. Umhlakasi cannot promise to change a provider decision that it did not make.

8. Who we may share personal information with

Where reasonably necessary and lawful, we may share information with:

• BluAdvance and relevant Blue Label Group companies for provider registration, eligibility, advances, balances, repayments, tokens, transaction history, fraud prevention, account administration and provider support;
• electricity suppliers, utilities, municipalities, merchants and authorised provider systems for meter validation, electricity transactions, FBE and linked-meter processing;
• MoyaApp, WhatsApp/Meta, HighLevel or another approved messaging, CRM or support provider used to receive, route and respond to messages;
• our USSD, telecommunications, SMS, email and notification providers;
• Paystack or another approved payment provider, acquiring banks, issuing banks and card schemes for payments, reusable authorisations, refunds, disputes and reconciliation;
• cloud hosting, security, monitoring, backup, analytics, software, professional-advisory and other operational service providers;
• approved partners where you use a partner-branded or embedded Umhlakasi channel and the sharing is required to provide, support or report on that experience;
• auditors, insurers, professional advisers, regulators, courts, law-enforcement bodies and other persons where required or permitted by law; and
• a purchaser, successor or relevant adviser in a proposed or completed corporate transaction, subject to appropriate confidentiality and legal safeguards.

We require operators acting for us to process information under appropriate written terms and security requirements. Separate responsible parties process information under their own legal duties and privacy notices.

We do not sell personal information merely in exchange for payment. This does not prevent authorised sharing needed to provide the service, process a transaction, meet a legal duty or operate an approved commercial partnership.

9. Third-party channels and links

MoyaApp, WhatsApp, payment providers, partner websites and other third-party services have their own terms and privacy practices. When you leave Umhlakasi or use a third-party channel, that provider may process information independently. Review its privacy information.

MoyaApp text messaging may work without an airtime or data balance on supported South African networks, but the app and network coverage are required. Downloads, media, external links and the separate Umhlakasi web portal may use data.

10. International processing

Some service providers or their systems may process or store information outside South Africa. Where personal information is transferred across borders, we take reasonable steps to use a transfer permitted by section 72 of POPIA or another applicable legal mechanism, including appropriate contractual or organisational safeguards where required.

11. Security

We use reasonable technical and organisational safeguards appropriate to the nature of the information and the risks involved. These may include access controls, authentication, encryption in transit where supported, protected credential storage, separation of environments, audit logs, monitoring, backups, duplicate-transaction safeguards and incident procedures.

No internet, messaging or storage system can be guaranteed completely secure. You must keep your PIN/password, device and verification codes secure and notify us promptly if you suspect unauthorised use.

Where a security compromise creates the notification duties set out in POPIA, we will notify the Information Regulator and affected data subjects as required, subject to lawful restrictions.

12. How long we keep information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, to provide and support the service, to maintain transaction and acceptance evidence, to meet legal, tax, accounting, regulatory and audit duties, to resolve disputes, and to establish or defend rights.

Different records have different retention periods. Financial, transaction, contract, consent, fraud and dispute records may be retained longer than ordinary support or technical logs. When information is no longer authorised or required, we take reasonable steps to delete, destroy, de-identify or restrict it, subject to lawful backup and archival cycles.

13. Cookies, analytics and similar technologies

The Umhlakasi website may use strictly necessary cookies or local storage for security, session, language, accessibility and core functionality. We may use measurement or analytics technologies to understand aggregate use and improve the website. Advertising or non-essential tracking technologies should be used only where configured and lawfully permitted, including obtaining consent where required.

You can use browser controls to block or delete cookies, but disabling necessary storage may prevent parts of the website or portal from working. Our cookie interface, where present, provides more specific choices.

14. Communications and direct marketing

We may send operational communications needed for registration, verification, security, transactions, tokens, repayments, support, service changes and legal notices. These are not necessarily marketing messages.

We send direct marketing only where permitted by law. You may opt out through the method in the message, by sending STOP where supported, changing an available preference, or contacting us. Opting out of marketing does not stop necessary service or security communications.

15. Children

Electricity advances are intended only for people aged 18 or older. We do not knowingly offer advances to children. If you believe a child has provided information unlawfully, contact us so that we can investigate and take appropriate action.

16. Your privacy rights

Subject to POPIA, other applicable law and any lawful limitations, you may ask us to:

• confirm whether we hold personal information about you and request access to it;
• correct or update inaccurate, irrelevant, excessive, outdated, incomplete or misleading information;
• delete or destroy information that we are no longer authorised to retain;
• object to processing in the prescribed manner;
• withdraw consent for future processing where consent is the basis;
• stop direct marketing;
• request available information about certain automated decisions; and
• explain how to lodge a complaint.

We may need to verify your identity and authority before acting. We may retain information where the law requires or permits it, including for a transaction, dispute, fraud investigation or legal claim. If the requested information is controlled by BluAdvance or another separate responsible party, we may direct you to that party.

Send a request to support@umhlakasi.co.za with the subject Privacy request. Do not include your PIN, password, one-time code or full payment-card details.

17. Complaints and the Information Regulator

Please contact us first so that we can try to resolve your concern. You also have the right to complain to South Africa's Information Regulator.

Information Regulator (South Africa):

• Website: https://inforegulator.org.za/
• General enquiries: enquiries@inforegulator.org.za
• POPIA complaints: POPIAComplaints@inforegulator.org.za
• Telephone: 010 023 5200
• Toll-free: 0800 017 160
• Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

The Regulator may require a prescribed complaint form.

18. Changes to this policy

We may update this policy when our services, providers, legal duties or processing practices change. We will publish the revised version and its effective date and provide additional notice where required. Material changes do not retrospectively create consent where fresh consent is legally required.

19. Contact and Information Officer

Responsible party:

Before publication, Umhlakasi must confirm legal review and approval of this policy.

20. Related documents

Read this policy together with:

• the Umhlakasi Terms of Service at https://umhlakasi.co.za/terms-of-service/;
• the BluAdvance Terms and Conditions of Agreement at https://bluadvance.co.za/terms-and-conditions-of-agreement/; and
• the Blue Label Group Privacy Notice linked from https://www.bluelabeltelecoms.co.za/privacy-policy.php.

Electricity advances are provided by BluAdvance. Free Basic Electricity entitlement is determined by the relevant municipality or electricity supplier.

Electricity advances powered by BluAdvance.

Read the BluAdvance provider agreement·Umhlakasi Terms of Service·Blue Label Group Privacy Notice