Privacy Policy
Steke (Pty) Ltd
Effective Date: 01 August 2026
Last Updated: 11 August 2026
1. Introduction
1.1. Steke (Pty) Ltd (“Steke”, “we”, “us”, “our”) respects your privacy and is committed to protecting your Personal Information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”) and other applicable South African law.
1.2. This Privacy Policy explains what Personal Information we collect, why and how we process it, who we share it with, how we protect it, and the rights you have.
1.3. It applies to the Steke website at https://steke.co.za, the Steke mobile and web application, and all related products and services (the “Platform”).
1.4. This Privacy Policy forms part of our Terms & Conditions. By using the Platform, you acknowledge that you have read and understood it. Where we rely on your consent to process your Personal Information, we will ask for it separately and you may withdraw it as described in clause 12.
2. Responsibility
2.1. Steke is the “responsible party” (data controller) for the Personal Information processed through the Platform.
2.2. Steke (Pty) Ltd Registration number: 2025 / 606764 / 07
3. Collection
Depending on how you use the Platform, we may collect and process the following categories of Personal Information:
3.1. Information you give us
• (a) Identity information — full name and surname, South African ID number, date of birth, gender, and photographs or a “selfie”/liveness image for identity verification.
• (b) Contact information — mobile number, email address, and residential/postal address.
• (c) Financial and affordability information — income, expenses, existing debts, bank account details, and bank statements or bank transaction data (where you provide them or enable access).
• (d) Account information — your PIN (stored securely), device biometric enrolment status, and account preferences.
• (e) Communications — messages, queries and feedback you send us, including your interactions with ARA.
3.2. Information we collect automatically
• (a) Device and usage information — device type, operating system, app version, IP address, and how you use the Platform.
• (b) Cookies and similar technologies — on our Website (see clause 13).
3.3. Voice information (ARA voice input)
• Where you choose to use voice input with ARA, we (and our service providers) process an audio recording of your voice and the text transcribed from it. See clause 8 (third-party processing and cross-border transfer) — voice input is processed by a third-party speech-recognition provider that may be located outside South Africa.
3.4. Information we obtain from others
• (a) Credit bureaux — your credit profile, credit score, credit history and related information.
• (b) Identity-verification providers — to confirm your identity against official records (FICA).
• (c) Bank-data / open-banking providers — read-only transaction data, where you enable this to verify your income.
4. Purpose
We process your Personal Information for the following purposes, relying on the lawful bases in POPIA section 11 as indicated:
5. Marketing
5.1. We will only send you electronic direct marketing (email, SMS, etc.) where you have consented, or as otherwise permitted by POPIA and the CPA.
5.2. Every marketing message will offer an easy way to opt out, and you can unsubscribe at any time by contacting hello@steke.co.za. Opting out of marketing does not stop essential service communications about your account or loan.
6. Sharing
6.1. We do not sell your Personal Information. We share it only as described below, and only as far as necessary:
• (a) Credit bureaux — we request information from, and (as the NCA requires) report information to, registered credit bureaux, including information about how you manage your loan.
• (b) Identity-verification and FICA providers — to confirm your identity.
• (c) Bank-data / open-banking providers — to obtain read-only transaction data where you enable it. Steke never receives or stores your online banking login password.
• (d) Payment and debit-order providers — to disburse your loan and collect repayments.
• (e) Technology service providers — including cloud hosting, and the providers that power ARA and voice input (see clauses 7 and 8).
• (f) Professional advisers — such as auditors, lawyers and debt collectors, where necessary.
• (g) Regulators and authorities — including the NCR, the Financial Intelligence Centre, and any court, ombud or authority, where required by law.
• (h) In a business transaction — for example, if we cede a loan book, restructure, merge or sell part of the business, subject to appropriate protections.
6.2. Where a third party processes Personal Information on our behalf (an “operator”), we require them by written contract to process it only on our instructions and to keep it secure, as required by POPIA section 21.
7. Biometrics
7.1. Certain information may qualify as “special personal information” under POPIA, which requires stronger protection.
7.2. Voice input. Where you use ARA’s voice feature, an audio sample of your voice is processed. We ask for your specific consent before you use voice input, and you can always type instead. Voice input is optional and is not required to use the Platform.
8. Cross-border
8.1. Some of our service providers — in particular the providers that power ARA and voice input — may store or process Personal Information outside South Africa.
8.2. Where we transfer Personal Information outside South Africa, we do so in accordance with POPIA section 72, on the basis of one or more of: your consent; that the transfer is necessary to perform our contract with you; or that the recipient is subject to laws, binding rules or agreements that provide an adequate level of protection.
9. Bureaux
9.1. As required by the NCA, we share information about your loan and repayment behaviour with registered credit bureaux. This includes both positive information (for example, on-time repayments) and negative information (for example, missed payments or default).
9.2. This information may affect your credit record and your ability to obtain credit in future. You have the right to contact a credit bureau to access and challenge the information it holds about you.
10. Automation
10.1. We use automated systems to help assess affordability and creditworthiness and to detect fraud. This means some decisions about your application may be based, in whole or in part, on automated processing.
10.2. ARA also uses automated systems to generate responses and insights.
10.3. Where a decision that produces legal effects for you, or affects you to a similar significant degree, is based solely on automated processing, you have rights under POPIA section 71, including (in appropriate cases) the right to request that the decision be reviewed and to make representations.
11. Protection
11.1. Security. We take appropriate, reasonable technical and organisational measures to protect your Personal Information against loss, unauthorised access, and unlawful processing, as required by POPIA section 19. These include, but are not limited to, encryption in transit and at rest, access controls, secure hosting. Our systems, though secure, are not completely impenetrable, and we cannot guarantee absolute security.
11.2. Retention. We keep your Personal Information only for as long as necessary for the purposes described in this Policy, or as required by law. Certain records (including FICA and credit records) must be retained for a minimum period — generally five (5) years after the end of our relationship or the closure of your account — after which we will delete, destroy or de-identify them.
12. Entitlements
12.1. Subject to POPIA and other applicable law, you have the right to:
• (a) be notified that we are collecting your Personal Information, and when it has been accessed without authorisation;
• (b) access the Personal Information we hold about you;
• (c) request correction or deletion of Personal Information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;
• (d) object to the processing of your Personal Information on reasonable grounds, and to opt out of direct marketing;
• (e) withdraw your consent where we rely on consent (this will not affect processing that already took place, or processing on another lawful basis, and may affect our ability to provide certain features or services); and
• (f) complain to the Information Regulator.
12.2. To exercise any of these rights, we may need to verify your identity first. Some requests are subject to the forms and processes prescribed under POPIA (including the PAIA request process for access).
13. Cookies
13.1. Our Website uses cookies and similar technologies to make the site work, remember your preferences, and understand how the site is used.
13.2. You can control cookies through your browser settings. Disabling some cookies may affect how the Website works.
14. Children
14.1. The Platform is intended for adults (18 years and older). We do not knowingly collect Personal Information from children. If you believe a child has provided us with Personal Information, contact us so we can delete it.
15. Third-Parties
15.1. The Platform may contain links to third-party websites (for example, our social media pages). We are not responsible for the privacy practices of those sites, and we encourage you to read their privacy policies.
16. Updates
16.1. We may update this Privacy Policy from time to time. The current version will always be available on our Website, with the “Last updated” date shown above. Material changes will be communicated through the Platform or by email.
17. Regulator
17.1. You also have the right to lodge a complaint with the regulator:
Information Regulator (South Africa) Website: https://inforegulator.org.za Email (complaints/POPIA): POPIAComplaints@inforegulator.org.za Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001.
This Privacy Policy was last updated on 11 August 2026.