This policy explains what personal information Thrive SA collects when you use the Thrive Check and the Thrive assessment, why we collect it, who we share it with, how long we keep it, and how you can get it corrected or deleted. It is written to meet our obligations under the Protection of Personal Information Act 4 of 2013 (POPIA).
1. Who is responsible for your information
- Responsible party
- THRIVE SA (PTY) LTD (registration number 2025/741148/07), trading as Thrive SA
- Address
- Cape Town, South Africa
- Privacy contact
- privacy@thrivesa.co.za
- General support
- support@thrivesa.co.za
Our Information Officer can be reached at the privacy address above. You may also complain directly to the Information Regulator (South Africa) — their details are in section 11.
2. What you can do on this site
This site does one thing, and almost everything in this policy follows from it:
- The Thrive Check — a free questionnaire that produces a Thrive Readiness Score out of 100. It is calculated only from the answers you type in. It is not a credit bureau score, it is not obtained from any credit bureau, and lenders do not use it.
- Your contact details — at the end of the questions we ask for your name, cell number and email address, so that we can show you your score, send it to you, and have a consultant follow up.
This site is free, and nothing is sold or paid for on it. We do not ask for your ID number here, we do not ask for card details here, and nothing is retrieved from a credit bureau here. Where a bureau retrieval happens at all, it happens on a separate service with its own consent screen and its own tick box, and never automatically.
3. What we collect
3.1 Answers you give us in the Thrive Check
What you are trying to achieve, whether you have recently been declined for credit and what for, your work situation, an income band, whether items such as missed payments, arrears, a judgment or a listing are on your profile, how month-end feels, whether you are under debt review, your timeframe, and how well you feel you know your credit profile. These are your own statements about yourself. We do not verify them at this stage and we do not treat them as fact.
3.2 Contact details
Your name, cellphone/WhatsApp number and email address, collected after the questions so that we can save and send you your result.
3.3 Consent records
Whether you accepted these terms and the privacy policy (required), whether you opted in to marketing (optional), whether you gave bureau consent (only on the bureau screen), the date and time of each, and the version of the wording you agreed to.
3.4 Visitor and session identifiers
A random visitor identifier stored in a cookie on your device for up to one year, and a random session identifier that lasts until you close the tab. Neither contains your name or contact details. They exist so that a part-finished assessment can be continued, so that one person is not counted or contacted twice, and so that we can measure how the service is actually used. See our Cookie Policy.
3.5 Usage events
Which step you reached and when, the page address, the referring website, any campaign source in the link you followed, and whether you are on a mobile or desktop device. Events are linked to your visitor identifier and, once you have given contact details, to your record with us.
3.6 South African ID number — not collected on this site
We do not ask for your ID number on this website. We ask for it only on a separate service, at the point where your credit record is actually to be retrieved. It is used to find your record at the credit bureau, it is never displayed back to anyone, and it is removed from your order as soon as the report is received. A one-way cryptographic hash of the number is kept so that we can recognise a repeat retrieval without storing the number itself.
3.7 Credit bureau information — only with your bureau consent, and never on this site
Where you have given bureau consent on a separate service, we receive your credit information from the credit bureau. This can include your credit score, your accounts and their balances and payment status, arrears, judgments, defaults and listings, debt review status, and enquiries made about you. This is a soft enquiry for your own information and is not a credit application.
3.8 Payment information
No payment is taken on this website and we never ask for card details here. Where you have paid us for something — now or in the past — your card details were entered on our payment provider's own secure checkout. We never see, receive or store your card number. We receive only confirmation of the outcome, the amount and a payment reference.
4. Why we use it, and on what lawful basis
| What we do | Information used | Lawful basis (POPIA) |
|---|---|---|
| Calculate and show your Thrive Readiness Score | Your questionnaire answers | Your consent, and performance of the free service you asked for |
| Save your result and send it to you | Name, cell, email | Your consent when you submit the form |
| Retrieve your credit record and prepare a written analysis (separate service, not this site) | ID number, bureau information | Your separate, explicit bureau consent |
| Take payment for a service you bought from us (not sold on this site) | Order and payment confirmation | Performance of our contract with you |
| Have a consultant follow up by phone or WhatsApp about your enquiry | Name, cell, your answers | Our legitimate interest in responding to an enquiry you started; you may ask us to stop at any time |
| Send marketing tips, offers and reminders | Name, cell, email | Only if you ticked the optional marketing box |
| Prioritise which enquiries our consultants call first | Your answers and your activity on the site | Our legitimate interest in running the business efficiently |
| Measure and improve the service | Usage events, visitor/session identifiers | Our legitimate interest in understanding how the service performs |
| Keep records, prevent abuse, meet legal obligations | As applicable | Legal obligation and legitimate interest |
Marketing consent is optional and separate. You will receive your Thrive Score, and a consultant can still follow up with you, whether or not you tick the marketing box. Accepting these Terms and this Privacy Policy is required to use the service; agreeing to marketing is not.
4.1 Internal prioritisation
We calculate an internal priority rating so our consultants know which enquiries to return first. It uses what you told us about your work situation, income band, goal, timeframe and credit situation, and how you have engaged with us. It is not shown to you, it is not a credit score, it is not shared with lenders or credit bureaux, and it is never used to decide the price you pay. We do not use race, gender, age, health, religion, political opinion, trade union membership, biometrics or sexual orientation for this. No decision with a legal or similarly significant effect on you is made by automated means alone — a person is always involved.
5. Who we share it with
| Who | What they get | Why |
|---|---|---|
| Credit bureau (Datanamix) | Your ID number | To retrieve your credit record, only on your bureau consent |
| Payment provider (Yoco) — not used on this site | Your card details, entered directly with them; order amount and reference | To process securely any payment you make to us elsewhere |
| Email provider (Resend) | Your email address and the message | To deliver your result and order emails |
| WhatsApp / messaging provider | Your cellphone number and the message | Only where you opted in, or to respond to an enquiry you started |
| Cloud hosting and database (Supabase) | The information described above, stored securely | To run the service |
| AI processor (Anthropic) | The content needed to prepare your assessment or answer your chat question | To generate your written assessment and power the on-site assistant |
| Thrive SA consultants | Your contact details, your answers, and a summary of your position | To follow up on your enquiry |
| NCR-registered debt counsellor partners | Only what you agree to share, and only if you ask for a referral | Debt counselling is a separate, regulated service we do not provide ourselves |
We do not sell your personal information. Some of these providers process information outside South Africa; where that happens we rely on the provider's contractual commitments to protect it to a standard comparable to POPIA.
6. How long we keep it
| Information | Kept for |
|---|---|
| Unfinished assessments (answers only, no contact details) | Up to 12 months, then deleted |
| Enquiry records that did not become a customer relationship | Up to 24 months from your last activity, then anonymised or deleted |
| Your ID number | Removed as soon as your report is received; only a one-way hash is kept |
| Bureau information on an order that was never paid | Up to 90 days |
| Your paid Thrive Analysis and its order record | 5 years, to meet record-keeping and tax obligations |
| Usage events | 13 months, then aggregated |
| Opt-out and deletion records | Kept indefinitely, so that we can honour your request |
7. Your rights
Under POPIA you may ask us to:
- tell you what personal information we hold about you, and give you a copy;
- correct or complete anything that is wrong or out of date;
- delete information we no longer have a lawful reason to keep;
- stop using your information for marketing;
- object to processing based on legitimate interest.
Write to privacy@thrivesa.co.za. We respond within 30 days. We may ask you to confirm your identity first. A formal access request is made under the PAIA Manual.
Some information cannot simply be erased on request — for example records we must keep for tax or accounting purposes, or a record that you asked us not to contact you. Where that applies we will tell you which information we are keeping and why.
8. Stopping messages
- WhatsApp: reply STOP.
- Email: use the unsubscribe link in any message.
- Either: email privacy@thrivesa.co.za.
Opt-outs are recorded on a suppression list that every one of our senders checks before anything goes out, so the request holds even if you come back to the site later. If you have told a consultant you are not interested, we stop marketing contact as well. Messages that are strictly about something you bought — your receipt, or your analysis being ready — are not marketing and are still sent.
9. Security
Traffic is encrypted in transit. Your credit report and order sit behind a private link that is unique to you — treat that link like a password and do not share it. Staff access is restricted by role, and the internal tools our consultants use do not expose your ID number or your card details. No system can be guaranteed perfectly secure; if a breach affects your personal information we will notify you and the Information Regulator as POPIA requires.
10. Children
The service is for people aged 18 and over. We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.
11. Complaints
Please raise it with us first at privacy@thrivesa.co.za. You may also complain to the Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg 2001 · complaints.IR@justice.gov.za · inforegulator.org.za.
12. Changes
If we change this policy we will update the version and date at the top. Where a change materially affects how we use information you have already given us, we will ask for your consent again rather than rely on the old wording.