Privacy Statement (ZA) - Oxygen Mobile

OXYGEN MOBILE — PRIVACY POLICY

Protection of Personal Information Act 4 of 2013 (POPIA)
Effective Date: 3 August 2026 | Version 8

This website, platform and related digital channels are operated by Oxygen Mobile (Pty) Ltd (“Oxygen Mobile”, “we”, “us”, “our”), Registration No.: 2022/753182/07. This Privacy Policy explains how we collect, use, store, share and protect personal information when you visit or use the Oxygen Mobile website or platform, contact us, register an account, enquire about or purchase Oxygen Mobile products and services, or access a payroll-linked or white-labelled product journey.

Oxygen Mobile may offer products and services in its own name and may also market, distribute or facilitate products supplied by third-party partners. Where a specific journey identifies another supplier, including Boodle Mobile (Pty) Ltd in relation to certain payroll-linked Device, SIM Card, Data and related products, that supplier’s own terms and privacy policy will also apply.

By using our website, platform or services, you acknowledge the processing practices described in this Privacy Policy. Where consent is required by law, we will obtain it separately and expressly.

INFORMATION OFFICER

Entity	Oxygen Mobile (Pty) Ltd
Information Officer	Leat Sacharowiitz
Email	info@oxygenmobile.co.za
Telephone	+27 (0)82 3301444
Physical Address	33 Scott Street, Waverley, Johannesburg, 2090

1. SOURCES AND CATEGORIES OF PERSONAL INFORMATION

We may collect personal information directly from you, automatically through our digital channels, or from authorised third parties.

1.1 Information provided directly by you

full name and surname;
identity number, date of birth and identity documentation;
gender, where lawfully required or voluntarily supplied;
email address, mobile number and other contact details;
residential, billing, delivery and postal addresses;
proof of residence and other verification documents;
account credentials, username, password or account alias;
product enquiries, selections, orders and support communications;
employment information, employer name, employee number, employment status, salary or income-related information and payroll deduction limits, where relevant;
banking or payment information, subject to the payment-security provisions below;
consent records, declarations, preferences and acceptance records;
ratings, reviews and feedback; and
any other information you choose to provide to us.

1.2 Information collected automatically

IP address, browser type, operating system, device identifiers and time zone;
log files, date and time stamps, referring and exit pages;
pages, products and content viewed;
search terms, clickstream information and interactions with the website or platform;
cookies, pixels, tags, web beacons and similar technologies; and
security, session and authentication information.

1.3 Information received from employers and partners

employer and employee information required to establish or administer an employer-linked or payroll programme;
employment verification, employee number, payroll deduction cap and payroll status information;
deduction instructions, remittance and reconciliation information;
information from product suppliers, fulfilment partners, network operators, couriers, payment processors, fraud-prevention providers and other service providers; and
information lawfully received from Boodle Mobile where necessary to administer a Boodle payroll-linked journey, subject to the limitations in this Privacy Policy.

Oxygen Mobile does not require or rely on an employer supplying salary information unless such information is lawfully provided and genuinely necessary for the relevant programme.

2. PURPOSES FOR WHICH WE PROCESS PERSONAL INFORMATION

We process personal information only for lawful, specific and relevant purposes, including:

creating and administering website or platform accounts;
responding to enquiries and communicating with you;
presenting and facilitating products and services;
processing orders, arranging delivery and administering support;
confirming, verifying and updating personal details;
administering employer-linked and payroll programmes;
verifying employment, employer participation and payroll deduction limits where relevant;
facilitating an embedded or white-labelled application journey supplied by Boodle Mobile or another identified supplier;
transmitting information to an identified supplier where necessary to complete an application or transaction and where the required notice and consent have been given;
processing or facilitating payments where Oxygen Mobile is the contracting supplier;
fraud prevention, security monitoring, risk management and dispute handling;
complying with legal, regulatory, tax, accounting and record-keeping obligations;
improving the website, platform, product selection and customer experience;
performing analytics and compiling aggregated statistics;
sending direct marketing where permitted and subject to your right to opt out; and
protecting our rights, property, systems, customers and business.

3. PAYROLL-LINKED AND WHITE-LABELLED PRODUCT JOURNEYS

Oxygen Mobile may market, distribute or facilitate employer-linked and payroll products through an Oxygen Mobile-branded portal, an employer-branded or white-labelled portal, or another digital channel.

3.1 Boodle Mobile payroll products

Where a payroll-linked product is supplied by Boodle Mobile, Boodle Mobile is the contracting supplier and its Terms of Use, Privacy Policy and Product Schedule apply. Boodle Mobile collects and processes the application information, conducts the relevant assessments and administers payments, support and the User’s account. Oxygen Mobile does not receive the User’s card details or payroll payments.

3.2 Information shared in a Boodle Mobile payroll journey

Information shared in a Boodle Mobile payroll journey is governed by the Boodle Mobile Privacy Policy. Oxygen Mobile will not independently collect application information merely because the journey is Oxygen-branded and will not receive TransUnion, detailed risk, arrears or collection information.

4. LAWFUL BASIS FOR PROCESSING

Depending on the circumstances, we process personal information on one or more of the following grounds:

your consent;
the conclusion or performance of a contract with you;
compliance with a legal obligation;
the protection of your legitimate interests or those of another person;
our legitimate interests or those of a third party, where those interests are not overridden by your rights; and
another lawful basis recognised under POPIA.

You may withdraw consent at any time, but withdrawal does not affect processing already lawfully undertaken or processing required on another lawful basis.

5. WHO WE MAY SHARE PERSONAL INFORMATION WITH

We may share personal information only where necessary and lawful, including with:

our employees, contractors and authorised representatives;
hosting, cloud, analytics, cybersecurity and information-technology service providers;
payment processors and banking partners;
courier, fulfilment, product and network partners;
fraud-prevention, identity-verification and risk-management providers;
professional advisers, auditors, insurers, debt collectors and legal representatives;
participating employers, but only to the extent necessary for an employer-linked or payroll programme;
Boodle Mobile or another clearly identified supplier where you access that supplier’s product journey through Oxygen Mobile;
law-enforcement agencies, regulators, courts or other competent authorities where required or permitted by law; and
a purchaser, successor or adviser in connection with a proposed or completed sale, merger, restructuring or transfer of the business.

We require service providers who process personal information on our behalf to use it only for the agreed purpose and to implement appropriate safeguards.

6. PAYMENT INFORMATION AND CARD SECURITY

Payment details for Oxygen Mobile products are processed through authorised payment providers. Where Boodle Mobile is the supplier, payment information is processed by Boodle Mobile or its authorised provider, and Oxygen Mobile and the Participating Employer do not receive the User’s full card details.

7. DIRECT MARKETING

We may contact you about Oxygen Mobile products, services, promotions or relevant partner offerings where permitted by law. You may opt out at any time by using the unsubscribe facility or contacting us at info@oxygenmobile.co.za. Opting out of marketing will not prevent service, legal, security or transactional communications.

8. COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar technologies to keep sessions secure, remember preferences, analyse usage, improve functionality, measure marketing performance and personalise content. Cookies may include essential, functional, analytics and advertising cookies.

You may manage cookies through your browser or any cookie-preference tool made available on the website. Disabling some cookies may affect website functionality.

9. SECURITY OF PERSONAL INFORMATION

We implement reasonable and appropriate technical and organisational safeguards to protect personal information against loss, damage, unauthorised destruction, unlawful access, disclosure or processing.

access controls and role-based permissions;
confidentiality obligations for employees and service providers;
secure hosting, monitoring and system safeguards;
reasonable vendor and operator controls;
incident-response and breach-management procedures; and
regular review of security measures.

No electronic transmission or storage system is completely secure. We therefore cannot guarantee absolute security, but we will act in accordance with POPIA if a security compromise affects personal information.

10. INTERNATIONAL TRANSFERS

Some service providers may process or store personal information outside South Africa. Where this occurs, we will take reasonable steps to ensure that the transfer is lawful and that the recipient is subject to an adequate level of protection, a binding agreement, corporate rules, consent or another lawful transfer mechanism.

11. RETENTION AND DELETION

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, the duration of the relevant relationship or transaction, and any additional period required for legal, regulatory, tax, audit, fraud-prevention, dispute-resolution or enforcement purposes.

When personal information is no longer required, it will be securely deleted, destroyed, de-identified or anonymised, subject to any lawful retention requirement.

12. YOUR RIGHTS UNDER POPIA

Subject to applicable law, you may:

ask whether we hold personal information about you;
request access to your personal information;
request correction, updating, deletion or destruction of information that is inaccurate, irrelevant, excessive, outdated, incomplete, misleading or unlawfully obtained;
object to processing in appropriate circumstances;
withdraw consent where processing is based on consent;
object to direct marketing;
request information about the identity of third parties who have had access to your information, where legally required; and
lodge a complaint with the Information Regulator.

We may require proof of identity before acting on a request and may refuse or limit a request where permitted by POPIA, PAIA or another applicable law.

13. ACCESS TO RECORDS UNDER PAIA

Requests for access to records held by Oxygen Mobile must be made in accordance with the Promotion of Access to Information Act 2 of 2000 (PAIA) and submitted to the Information Officer.

Access may be refused or limited where a record contains third-party information, confidential commercial information, legally privileged information, security information, fraud-prevention information or other information protected by law.

14. CHILDREN

Our website and services are not intended to solicit personal information from children. Where a product or service is lawfully made available to a minor, the required consent or authorisation of a competent person must first be obtained.

15. RATINGS AND REVIEWS

Where you submit a rating, review or testimonial, you permit Oxygen Mobile to publish and use it for website, customer-experience and marketing purposes, subject to applicable law. Unless otherwise agreed, we will not publish your surname or contact details with the review.

16. THIRD-PARTY WEBSITES AND PARTNER TERMS

Our website may contain links to third-party websites or may provide access to embedded partner journeys. Those third parties may process personal information under their own privacy policies. We encourage you to read the applicable policy before submitting information.

Where a partner journey is embedded within the Oxygen Mobile website, we will take reasonable steps to identify the relevant supplier and provide access to that supplier’s terms and privacy policy before you complete the transaction.

17. SECURITY INCIDENTS AND REGULATORY DISCLOSURE

We may process, retain and disclose relevant personal information where reasonably necessary to detect, prevent, investigate or respond to fraud, attempted fraud, cyber incidents, identity concerns, unlawful conduct, payment disputes, misuse of the website, breach of applicable terms or other security risks.

Where permitted or required by law, information may be disclosed to service providers, banks, card schemes, fraud-prevention agencies, legal representatives, insurers, regulators, law-enforcement authorities, courts or other competent authorities.

18. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in law, technology, our services, partner arrangements or processing practices. The updated version will be published with a revised effective date. Material changes will be communicated where reasonably practicable.

19. COMPLAINTS AND CONTACT DETAILS

Questions, requests, objections or complaints about this Privacy Policy or our processing of personal information may be sent to:

Email	leat@oxygenmobile.co.za
Telephone	+27 (0)82 330 1444
Postal / Physical Address	33 Scott Street, Waverley, Johannesburg, 2090
For attention	Information Officer / Privacy Compliance Officer

20. INFORMATION REGULATOR

You may lodge a complaint with the Information Regulator (South Africa) if you believe your personal information has been processed unlawfully.

Website	www.inforegulator.org.za
General Email	enquiries@inforegulator.org.za
POPIA Complaints	POPIAComplaints@inforegulator.org.za
Address	JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001