Privacy Policy
Version 1 · 4 November 2026
This policy explains what personal information Inves Capital (Pty) Ltd collects, why, who receives it, how long it is kept, and how you can see it, correct it or complain.
Who is responsible
Inves Capital (Pty) Ltd (registration number 2016/437415/07) is responsible for the personal information in this policy. In the Protection of Personal Information Act 4 of 2013 (POPIA) it is the responsible party. Inves issues and redeems ZARP, and issues ZARPY.
ZARP Stablecoin (Pty) Ltd is Inves's juristic representative and runs zarpstablecoin.com for Inves. It does not decide what is done with your information. Venox IO (Pty) Ltd is a separate company, also Inves's juristic representative, with its own privacy policy. This policy covers only what Inves receives about Venox's clients.
Contact: Inves's Information Officer, at compliance@inv.es, or 31 Parliament Street, Speakers Corner, Cape Town, 8000.
Whose information we hold, and where it comes from
| If you are | We hold | We get it from |
|---|---|---|
| The representative or contact person of a company applying to become, or already, a ZARP partner | Your names, email address and phone number; whether you hold a prominent public position, and its details | You |
| A director, shareholder, beneficial owner or other controlling person of an applicant or partner | Your names, and for a shareholder your share of the company; the identification, screening and tax-residence information Inves's onboarding requires | The company that applies, not you. We ask it to tell you |
| A user of the partner portal | Your name, email address, sign-in and two-factor credentials, your choice of email notices, and a record of what you do in the portal | You and your company |
| Someone who pays money into Inves's bank account | Your name as your bank sends it, the payment reference you type, and part of your account number | Inves's bank |
| Someone who writes to us, by email or through a form on our websites | Your name, email address, company and what you write | You |
| A visitor to our websites | Your IP address, browser details and the pages you ask for, in our hosting providers' logs | Your browser |
| Staff of the fund administrator who send Inves its daily rate | Your name, email address and email signature | The email you send |
| A person Inves invites to its internal reporting dashboard | Your email address | Inves |
| A client of Venox IO (Pty) Ltd, or a beneficial owner or controlling person of one | The due-diligence, tax and transaction information Inves needs as the financial services provider Venox represents | Venox, not you |
A partner company's own details are also personal information under POPIA: its names, registration number, tax number, bank accounts and wallet addresses.
Why we use it
| Purpose | Basis in POPIA |
|---|---|
| To identify and verify the companies we deal with and the people behind them, screen them, establish their source of funds, keep records and report to the Financial Intelligence Centre, as the Financial Intelligence Centre Act 38 of 2001 (FIC Act) requires | Required by law (section 11(1)(c)) |
| To report tax information to the South African Revenue Service under the Crypto-Asset Reporting Framework and the Common Reporting Standard | Required by law (section 11(1)(c)) |
| To perform our agreement with a partner: issue and redeem ZARP, verify its wallet addresses, approve ZARPY holdings, pay redemptions to its bank account and send it notices | Contract (section 11(1)(b)) |
| To match money paid into our bank account to the partner it belongs to | Required by law (section 11(1)(c)) and contract |
| To run the partner portal securely: sign-in, two-factor authentication and a record of who did what | Contract, and our legitimate interest in security (section 11(1)(f)) |
| To answer you when you write to us | Your request, and our legitimate interest in replying (section 11(1)(f)) |
| To keep evidence of where ZARPY's daily rate came from | Our legitimate interest (section 11(1)(f)) |
What you must give us. The information marked as required in an application is required by the FIC Act or needed for the agreement. Without it Inves cannot take the company on. The rest is voluntary.
Screening results. Sanctions, adverse-media and criminal-record checks produce special personal information. Inves uses screening results only to comply with the FIC Act, holds them itself, and does not share them with its technology provider. Inves has not yet chosen the platform it will screen with; this policy will name it when it does.
Inves does not sell personal information, does not use it for direct marketing, and makes no decision about you by automated means alone. A person decides every application: Inves's Compliance Officer, with its Managing Director.
Who receives it
| Recipient | What it receives, and why | Where |
|---|---|---|
| Totemiq Limited, Inves's technology provider (registered in the Abu Dhabi Global Market) | Builds and runs the partner platform as Inves's operator under a written contract (POPIA section 21). It reads system logs and metrics, which are designed to exclude personal information. It reaches the platform's personal information only when Inves grants a named engineer time-limited access to resolve an incident. It never receives screening results | Works from the United Arab Emirates; the data stays in South Africa |
| Amazon Web Services | Hosts the platform: its database, portal sign-in and the emails it sends | Cape Town, South Africa |
| The partner portal's access logs and web firewall: your IP address, the page address and your browser details, kept for 30 days | United States | |
| Google (Google Workspace) | Email for inv.es and zarpstablecoin.com, and Inves's documents | Google's data centres, in several countries |
| Formspree | The "Become a ZARP Partner" form and the CARF self-certification form on zarpstablecoin.com, which it forwards to us | United States |
| Fly.io and Resend | Inves's internal reporting dashboard, and the sign-in emails it sends | Johannesburg, South Africa (Fly.io); United States (Resend) |
| Discord | Alerts to Inves's operations team about money received: the amount and the payment reference, never the payer's name. A name that a payer types into the reference appears in the alert | United States |
| Alchemy and Safe | Blockchain data services. They see wallet addresses, never names | United States and other countries |
| GitHub (hosts zarpstablecoin.com), DreamHost (hosts inv.es), Google Fonts and CoinGecko | Your IP address and browser details when you visit our websites. Our websites set no cookies of their own and use no analytics | United States and other countries |
| First National Bank, Inves's bank | The partner's bank account details when Inves pays a redemption. FNB also tells Inves who paid money in. FNB is responsible for its own processing | South Africa |
| Regulators and authorities | The Financial Intelligence Centre, the Financial Sector Conduct Authority, the South African Revenue Service and the Information Regulator, and the police or a court, when the law requires | South Africa |
| Inves's auditors and legal advisers | What they need for their work, under a duty of confidentiality | South Africa |
Public blockchains. When Inves verifies a wallet address for ZARP or approves it for ZARPY, the blockchain records publicly that the address is verified or approved. It never records who owns the address. Anyone can see the transactions of an address on a public blockchain, and no one can remove them.
Information that leaves South Africa
The platform keeps its data in South Africa. Personal information leaves South Africa in two ways:
- Totemiq reaches it from the United Arab Emirates. Inves relies on POPIA section 72(1)(a): Totemiq is bound by a written agreement to process it on principles substantially similar to POPIA's, to pass it on only with Inves's written consent to a recipient bound in the same way, and to give you your POPIA rights through Inves.
- Google, Formspree, Resend, Discord, GitHub, DreamHost, Google Fonts, CoinGecko, Alchemy, Safe and Amazon Web Services (for the portal's access logs) process what the table above lists outside South Africa, mostly in the United States, under their own terms.
How long we keep it
| Record | Kept for |
|---|---|
| Due-diligence records: the company and the people named in them, and screening results | At least five years from the end of the business relationship (FIC Act section 23), then de-identified |
| Transaction records, including who paid money in | At least five years from the transaction, then de-identified |
| A declined application | Five years from the decision, then de-identified |
| A portal user's account | While the user has access, then five years, because the record of who did what names the user |
| Records the Financial Intelligence Centre or an investigation needs | Longer, for as long as the law requires |
| Tax information | For the period tax law requires |
| Daily rate emails | 90 days |
| System and access logs | 30 days |
| Emails and website messages | As long as we need to answer you, and then as long as any relationship that follows |
These periods are set, but not yet fully automated. Inves does not yet record, for every record, the date its period starts, and it has no automatic de-identification yet. It is building both. Until they are in place, a record can be kept past its period. Once the period for your information has ended, you may ask us to de-identify it.
How we protect it
- The platform's data is stored in Cape Town and encrypted at rest and in transit.
- Every portal user signs in with two-factor authentication.
- Every change made in the platform is written to an audit record that the platform's own software cannot change or delete.
- Access is given to named people only, and Totemiq's access is limited as described above.
- Today the platform runs in a transitional Amazon Web Services account that ZARP Stablecoin (Pty) Ltd holds for Inves, and one person administers it for both Inves and Totemiq. Inves is moving the platform to accounts it owns, with its own administrators.
If personal information is accessed or acquired by someone not authorised to have it, Inves tells the Information Regulator, and the people affected, as soon as reasonably possible.
Your rights
- See it. You may ask whether we hold personal information about you and for a copy. Our PAIA manual explains how. The FIC Act (section 29) forbids Inves to tell anyone that it has reported a matter to the Financial Intelligence Centre, so Inves answers every request subject to that rule.
- Correct or delete it. Use Form 2 of the POPIA Regulations, 2018. Inves deletes only what the law allows it to delete; the records the FIC Act requires are kept for their period.
- Object. Use Form 1 of the POPIA Regulations, 2018, where we rely on our legitimate interest. You cannot object to processing the law requires.
- Stop email notices. Portal users can switch off email notices in the portal.
- Complain. Write to us first at compliance@inv.es. You may also complain to the Information Regulator: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191; POPIAComplaints@inforegulator.org.za; 010 023 5200; inforegulator.org.za.
ZARP partners are companies, and we do not knowingly collect information about children.
Changes to this policy
Each version is dated. Inves tells its partners of a material change before it takes effect.