Last updated 11 November 2026
In short
- We collect what we need to open and run your account, and what the law requires of a financial services provider.
- We never sell your information, and we do not share it with anyone for their own marketing.
- We share it only with the companies that help us run Numbelo, and with authorities when the law requires it.
- Some records must by law be kept for years after you close your account. Everything else you can ask us to delete.
Who we are
Numbelo is run by to be confirmed. It has applied for a licence as a financial services provider and is not yet authorised. Under South Africa's Protection of Personal Information Act (POPIA), we are the "responsible party" for your information.
Our Information Officer is to be confirmed, reachable at to be confirmed.
What we collect
- Who you are: your name, email address, and your South African ID or passport number.
- Your bank accounts: the accounts you save for withdrawals.
- Your activity: deposits, trades and withdrawals, the coin addresses you save, and your balances.
- How you sign in: the devices and browsers you use, their internet addresses, and when you sign in.
- What you tell us: your personal email code, and anything you write to us.
Your ID number and bank account numbers are stored encrypted. Our own team sees only their last four characters.
Why we use it
- To provide your account: to hold your balances, carry out your trades and pay out your withdrawals. This is our agreement with you.
- Because the law requires it: to confirm who you are and check for money laundering under the Financial Intelligence Centre Act, and to report crypto activity to SARS.
- To protect you: to spot sign-ins from new devices, unusual activity and attempts to take over your account.
We do not use your information to advertise to you, and we do not make decisions about you by computer alone that have legal effect. A person reviews any decision to pause an account.
Who we share it with
- The companies that help us run Numbelo: the custodian that holds coins, the service that confirms identities, our bank, the exchange that fills orders, and our hosting provider. Each sees only what it needs, and must protect it.
- Authorities, when the law requires: for example the Financial Intelligence Centre, the Financial Sector Conduct Authority and SARS.
Your information is stored in Strasbourg, France, on a server operated for us by Host Europe GmbH, part of the GoDaddy group. France is covered by European Union data protection law, which protects personal information at least as well as POPIA requires.
Any other service we use that keeps your information outside South Africa must protect it at least as well as POPIA requires.
How long we keep it
While your account is open, and afterwards for as long as the law requires. Financial services providers must keep identity and transaction records for a number of years after an account closes, currently to be confirmed. When that period ends, we delete or anonymise them.
How we protect it
Two-step sign-in is required on every account and for every member of our team. Sensitive numbers are encrypted. Records of money cannot be edited after they are written, and everything our team does is kept on a record they cannot change.
Your rights
Under POPIA you may, at no cost:
- ask what information we hold about you;
- ask us to correct anything that is wrong;
- ask us to delete information we are not required to keep;
- object to how we use it.
Email our Information Officer at to be confirmed. We will confirm the request comes from you before acting on it.
If you are unhappy with how we handle your information, you may complain to the Information Regulator of South Africa. We would ask that you tell us first, so we can put it right.
Changes to this notice
If we change this notice, we will update the date at the top. If a change affects how we use information you have already given us, we will tell you before it applies.