Privacy and cookies

Who is responsible

The Private Lending Association of South Africa publishes this website. For the purposes of the Protection of Personal Information Act 4 of 2013 (POPIA), it is the responsible party for the information described below. Enquiries and requests go to info@privatelendingassociation.co.za.

What is collected

Analytics

The site uses Google Analytics 4 through Firebase (measurement ID G-LPB3EVTMSG) to count which pages are read. It records the page you viewed, the page that referred you, approximate location derived from your IP address, and general device and browser information. Google Analytics 4 does not store full IP addresses. Nothing collected identifies you by name, and nothing is used to build an advertising profile.

Course progress, in aggregate

The free course keeps your progress in your own browser and sends none of it anywhere. Separately, the site records anonymous events through Crossdeck when a lesson is marked complete, when the assessment is started and submitted, and when a certificate is generated — with the lesson number, the part, the score and whether it was passed. This is how the Association finds out where people stop, which is the only way to improve a course nobody has to tell us about. The events carry a random identifier for the browser and nothing else. The name you type on the certificate is never sent — it is written to your browser’s storage, rendered there, and no event carries it.

Server logs

The site is served by Firebase Hosting, which keeps standard request logs including IP address, user agent and the file requested. These are operational records — they exist to run and secure the service.

A complaint you submit

When you press Lodge this complaint, what you typed is written to the Association’s complaints register — your name, contact details, the subject of the complaint, the substance, and whether you agreed to be named. Nothing is sent before you press it. The register is a Cloud Firestore database hosted in Johannesburg (africa-south1), so a complaint about a South African lender does not leave the country. Its security rules permit a complaint to be created and nothing else: no browser, including yours, can read, edit or delete what is stored, and the register is opened only by the Association. If the write fails, the form falls back to composing the same record as an email for you to send. We hold it to handle the complaint and to maintain the registers, for no other purpose. It is never used for marketing and never passed to a partner. Complaint records are kept for five years from the decision and then deleted, except where the record is relevant to a listing that is still current. The complaints and compliance policy sets this out in full.

A newsletter subscription

If you subscribe, the only things written to the database are your email address, the fact that you consented, the time, and which page you subscribed from. No name, no company, no interests, and no record of what you were reading. It is the same Cloud Firestore database in Johannesburg (africa-south1), create-only, and not readable from any browser — so the list cannot be harvested from this site. Your address is used to send the newsletter and for nothing else: it is never sold, never rented and never passed to a partner. Every email carries a one-click unsubscribe, and leaving takes effect immediately and removes the record. You can also ask us to remove it at any time by writing to the editor.

Anything else you send us

If you write to the editor, we hold your email and whatever you put in it, for as long as is useful to deal with the correspondence. Writing to us does not add you to the newsletter — that only happens if you subscribe.

Cookies and what is stored on your device

That is the complete list. There are no advertising cookies, no social-media pixels, no embedded third-party content, and no cross-site tracking. The site loads no fonts, images or scripts from anywhere other than its own domain. It sends analytics to Google and to Crossdeck, and it makes one further connection — to the complaints database in Johannesburg — only at the moment somebody lodges a complaint.

What this site does not do

• It does not sell, rent or share personal information with anyone for their own use.
• It does not run advertising or work with an advertising network.
• It does not build marketing profiles, and it does not pass reader data to any partner.
• It has no login, so it holds no accounts, passwords or financial information.
• It never asks for identity documents, banking details or money — if a page on this domain ever appears to, it is not us.

Why analytics at all

Because the site is written to be useful, and the only honest way to know whether a page is doing its job is to know whether it is read and where readers stop. The interest being relied on is that narrow one: improving the material. If you would rather not be counted, the next section says how to opt out, and nothing on this site behaves differently if you do.

How to opt out

Analytics is on unless you turn it off. A notice says so on your first visit rather than hiding it behind an “accept” button, and the switch below works at any time:

Off means off. The analytics SDK is not started at all on a browser that has turned it off — no session, no page view, no heartbeat — rather than being started and then told to discard what it collected. One thing is not ours to decide either way: a browser sending a Global Privacy Control signal is opted out before any of this runs.

Other routes, if you prefer them:

• Use your browser’s privacy settings to block cookies for this site, or use private browsing.
• Install Google’s official Analytics opt-out add-on, which works across every site that uses Analytics.
• Block googletagmanager.com, google-analytics.com and api.cross-deck.com with a content blocker. The site is built so that everything still works when those requests fail.
• Clear site data for this domain to remove the identifiers already stored.

Who else is involved, and where the data goes

Google processes the analytics and hosting data described above on our behalf, on infrastructure outside South Africa. POPIA permits that where the recipient is bound by rules affording comparable protection; Google’s data-processing terms are the basis relied on here. Complaints are the exception and are deliberately kept local: they are stored in Cloud Firestore in the Johannesburg region, which does not leave South Africa. No other processor is involved, and no reader data is transferred to any partner, including ProLend.

How long anything is kept

Analytics data is retained on Google’s standard retention setting for this property and then deleted or aggregated. Hosting logs follow Firebase’s own retention. Correspondence is kept while it is useful and then deleted.

Your rights under POPIA

You may ask what personal information we hold about you, ask for it to be corrected or deleted, and object to its processing. Write to info@privatelendingassociation.co.za and we will deal with it. If you are not satisfied, you may complain to the Information Regulator (South Africa).

Changes to this notice

If what the site collects changes, this page changes with it and the date at the top is updated. The technical detail here is meant to match the code exactly; if you find a discrepancy, tell us and we will fix the page or the code, whichever is wrong.

See also: editorial policy (how the material is researched, reviewed and corrected) and about (who publishes this and how it is funded).