Privacy Policy

Last updated: 23 October 2026

This policy explains how VerifyForce collects, uses, stores, and protects personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA). It applies to everyone whose personal information we process, including people who contact us, our clients, and the people we are asked to verify (verification subjects).

1. Who we are

VerifyForce is a division of Steleg (Pty) Ltd, a private company based in Midrand, Gauteng, South Africa. Steleg (Pty) Ltd is the responsible party for personal information processed by VerifyForce.

We are a professional consulting service. Clients engage us to carry out verification, screening, and property inspection work. We run the required checks ourselves, interpret the results, and deliver a written VerifyForce report. We do not sell or resell raw credit bureau data.

2. What personal information we collect

• Enquiry and client information: name, email address, phone number, role or organisation, and any details you send us through our contact form, WhatsApp, email, or phone.
• Verification subject information: where a client asks us to verify someone, we may process that person's identity number and identity details, contact and address details, credit information, fraud-listing information, criminal record information (including fingerprints for AFIS checks), employment history, company directorships, and property ownership records. We collect only what is needed for the checks the client has requested.
• Consent records: the signed POPIA consent form from each verification subject.
• Property inspection information: photographs and written notes on the condition of a property, along with the names of the landlord, tenant, or agent involved.
• Technical information: essential cookies needed for the site to work and, only if you accept them, anonymised analytics data.

3. Why we collect it

• To respond to enquiries and provide quotes.
• To carry out the verification, screening, and inspection services a client has engaged us for, and to compile and deliver our reports.
• To invoice for our professional services and keep proper business records.
• To meet our legal obligations, including under POPIA, the National Credit Act 34 of 2005 (NCA), and the Financial Intelligence Centre Act 38 of 2001 (FICA).

We do not sell personal information. We do not use verification data for marketing or for any purpose other than the engagement it was collected for.

4. Credit bureau data and consent

We access credit bureau data only with the written consent of the subject. Before we run any check, including identity, credit, fraud, criminal, or employment checks, the subject must sign our POPIA consent form. The form explains which checks will be run, why, and who will receive the results. If we do not have a signed consent form, we do not run the check.

Credit and related bureau data is obtained through a licensed credit bureau data partner and is used only for the purpose stated on the consent form.

5. Who we share it with

• The client who commissioned the check: our report goes only to the client named in the engagement, and only for the purpose the subject consented to.
• Data providers: we submit the subject's details to accredited data providers, such as our licensed credit bureau data partner, the credit bureaux, and the SAFPS fraud database, so they can return the results. Fingerprints for criminal checks go to the relevant authority. These providers have their own regulatory and confidentiality obligations.
• Service providers: we use trusted operators for email, messaging, and website analytics (for example email delivery services, WhatsApp, and Google Analytics). Some of these may process information outside South Africa. Where they do, we rely only on providers that are bound by data protection standards at least equivalent to POPIA, as section 72 of POPIA requires.
• Where the law requires it: for example, in response to a valid court order or a request from a regulator.

6. How we store and protect it

We take reasonable technical and organisational measures to protect personal information against loss, damage, unauthorised access, and unlawful processing. These include:

• Access to data-provider portals is restricted to authorised VerifyForce staff and protected by individual logins.
• Reports and consent forms are stored securely, in password-protected digital storage or a locked physical location.
• Reports go only to the client's nominated contact.
• We only keep what each engagement needs.

If we have reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and the affected people as POPIA requires.

7. How long we keep it

We keep verification reports, consent forms, and related records for five (5) years from the date the engagement is completed. This allows us to meet our record-keeping obligations and to respond to any query or dispute about our work. After that, the records are securely destroyed or de-identified, unless the law requires us to keep them longer.

We keep general enquiry information that did not lead to an engagement only for as long as we need it to respond.

8. Your rights under POPIA

As a data subject, you have the right to:

• Ask whether we hold personal information about you, and request a copy of it.
• Ask us to correct or delete personal information that is inaccurate, out of date, incomplete, or unlawfully obtained.
• Object to the processing of your personal information, on reasonable grounds.
• Withdraw your consent at any time. This does not affect checks already run lawfully before you withdrew.
• Lodge a complaint with the Information Regulator (South Africa): inforegulator.org.za.

To exercise any of these rights, contact our Information Officer using the details below. We may need to confirm your identity before acting on your request.

9. Cookies

We use essential cookies to keep the site running. Optional analytics cookies are set only if you accept them through the cookie banner. You can change your choice at any time by clearing your browser storage for this site.

10. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated.

11. Information Officer

For any privacy request, question, or complaint, contact our Information Officer:

• Information Officer: Steven Legae
• Responsible party: Steleg (Pty) Ltd, trading as VerifyForce
• Location: Midrand, Gauteng, South Africa
• Email: info@verifyforce.co.za
• Phone / WhatsApp: 078 894 9331