Privacy Policy

1. Introduction and scope

Admin Focus Underwriting Managers (Pty) Ltd (“AFUM”, “we”, “us”) administers the FlexiFocus platform on behalf of Bryte Insurance Company Limited (“Bryte”). This policy explains how we collect, use, share, and protect personal information in line with the Protection of Personal Information Act 4 of 2013 (“POPIA”). It applies to clients, policyholders, dependants, brokers, and visitors to the FlexiFocus website and client portal.

This policy does not replace our Promotion of Access to Information Act (PAIA) manual, which sets out how you may request access to records we hold and is available on request from our Information Officer.

2. Information Officer

Our Information Officer is responsible for POPIA compliance across AFUM and the FlexiFocus platform, and is registered with the Information Regulator as required by section 55 of POPIA.

3. What personal information we collect

Depending on your relationship with us, we may collect:

• Identity information — full name, ID or passport number, date of birth, contact details
• Policy and underwriting information — property or asset details, address, risk factors, claims history
• Financial information — banking details, payment history, premium collection records (processed via our payment service providers)
• Claims information — details of the incident, supporting documents, photographs, assessor reports, and, where relevant to a specific claim, special personal information such as health information (for example, in a personal injury claim)
• Communication records — correspondence, portal activity, complaint records, and interactions with our SISA assistant
• Technical information — device and browser information collected via the FlexiFocus website and client portal

Special personal information (as defined in section 26 of POPIA, which includes health information) is only processed where an exception applies — in our case, primarily the exception in section 32 of POPIA permitting insurers to process health information for purposes connected to assessing risk, administering policies, and processing claims.

4. Why we process your information

• To assess insurance risk, quote, and underwrite policies
• To administer your policy, including premium collection and renewals
• To assess and settle claims, including verifying information with brokers, assessors, and Bryte
• To register, investigate, and resolve complaints in line with our Complaints Registration and Resolution Policy
• To comply with legal and regulatory obligations, including those under the FAIS Act, the Insurance Act, the Policyholder Protection Rules, and FICA
• To detect and prevent fraud
• To communicate with you about your policy, claims, and, where you have not opted out, relevant products or services

5. The lawful basis for processing

We only process personal information where at least one of the following applies, in line with POPIA's conditions for lawful processing: you have consented; processing is necessary to conclude or perform our contract with you; processing is required to comply with a legal obligation; processing protects a legitimate interest of yours; or processing is necessary to pursue our legitimate interests, such as fraud prevention, provided this does not unreasonably infringe your rights.

6. Who we share your information with

We share personal information only where necessary, and always under a contractual duty of confidentiality:

• Bryte Insurance Company Limited, as the underwriter of your policy
• Your broker, for policy administration, claims support, and complaint handling
• Payment service providers (currently Peach Payments, Ozow, and Netcash) for premium collection and, where relevant, bank account verification ahead of a claim payout
• Assessors, loss adjusters, and other service providers engaged to investigate a specific claim
• Regulators, including the Financial Sector Conduct Authority and the Information Regulator, where legally required
• Our technology service providers who host and support the FlexiFocus platform, under written confidentiality and security obligations

We do not sell personal information to third parties.

7. Cross-border transfers

Some of our technology service providers may process or store information outside South Africa. Where this occurs, we only transfer personal information where the recipient is subject to a law, binding corporate rules, or a written agreement that upholds protections comparable to POPIA, or where another basis under section 72 of POPIA applies (for example, the transfer is necessary to perform our contract with you).

8. How long we keep your information

We retain personal information for as long as needed for the purposes described in this policy, and thereafter as required by law — including the FAIS Act's record-keeping requirements (generally 5 years), FICA, and prescription periods under the Insurance Act. Claims and complaints records are retained for at least 5 years from finalisation.

9. Security safeguards

We maintain technical and organisational measures appropriate to the risk, including access controls, encryption of sensitive data in transit, restricted internal access on a need-to-know basis, and written confidentiality obligations for all service providers who process personal information on our behalf. If a data breach occurs that is likely to compromise your personal information, we will notify the Information Regulator and affected data subjects as required by section 22 of POPIA.

10. Direct marketing

We will only send you direct marketing communications with your consent, or where you are an existing client and the marketing relates to similar products or services, in line with section 69 of POPIA. You may opt out of direct marketing at any time by contacting us or using the unsubscribe option in any marketing communication — this will not affect service communications about your policy or claims.

11. Your rights as a data subject

• To be told what personal information we hold about you and why
• To access the personal information we hold about you
• To request correction of inaccurate or outdated information
• To request deletion of personal information we no longer have a lawful basis to retain
• To object to processing, including direct marketing, in certain circumstances
• To complain to the Information Regulator if you believe we have not complied with POPIA

To exercise any of these rights, contact our Information Officer using the details in Section 2. We will respond within a reasonable time and at no charge, except where a request is manifestly unfounded or excessive.

12. Children's information

FlexiFocus policies are held by adult policyholders. Where a policy covers a dependant who is a minor, their information is processed with the consent of, and under the instruction of, their parent or legal guardian.

13. Complaints to the Information Regulator

If you are not satisfied with how we have handled your personal information, you may lodge a complaint with the Information Regulator:

14. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or the law. The current version is always available from the FlexiFocus client portal and website.

15. Contact us