# Biometric and Special Personal Information Notice **POPIA Section 26 - Processing of Special Personal Information** **Free Me South Africa (Pty) Ltd** Registration Number: 2025/384802/07 Version 1.0 | Effective Date: 24 August 2026 --- ## 1. Purpose of This Notice Section 26 of the Protection of Personal Information Act 4 of 2013 ("POPIA") prohibits the processing of "special personal information" except in limited circumstances, and requires explicit, separate consent where consent is the lawful basis. This notice explains how FMSA processes the following special personal information categories: - **Facial image** (the applicant photograph required on NGB Form 1/1) - **Race** (for anonymised IGHAC demographic harm reporting) --- ## 2. Biometric Information - Facial Image ### 2.1 What We Collect During Step 4 (Identity Verification) of the SE registration flow, you take a photograph using your device camera. The photograph is printed on page 3 of your NGB Form 1/1, as the form requires, and is kept as identity evidence. Your SA ID number is verified separately with Home Affairs on FMSA's back end; the photograph is not sent for that check. ### 2.2 Why We Collect It **Primary purpose:** To confirm that the person completing the self-exclusion registration is the person they claim to be, and to ensure the integrity of the NGB self-exclusion register. **Legal basis:** POPIA Section 26(1)(b) - processing is necessary for the establishment, exercise, or defence of a right or obligation in law. The NGA requires SE applications to be made by the person seeking exclusion. POPIA Section 11(1)(a) - explicit informed consent given during Step 4. ### 2.3 How It Is Processed 1. You take a photograph using your device camera within the Platform 2. The photograph is transmitted over an encrypted HTTPS connection to FMSA's servers in South Africa and stored encrypted (AES-256-GCM) 3. Your SA ID number is verified with Home Affairs on FMSA's back end through FMSA's ID verification service provider (no photograph is sent) 4. FMSA staff review the verification result 5. FMSA records the identity-verification outcome (verified / not verified / pending) against your registration 6. The photograph is printed on page 3 of your NGB Form 1/1 and submitted to the NGB and relevant provincial gambling boards with your application ### 2.4 Retention The photograph is stored securely and encrypted by FMSA in South Africa for evidentiary purposes, for the same period as the rest of your application record (7 years). It is not shared with any third party other than the NGB and relevant provincial gambling boards as part of NGB Form 1/1. ### 2.5 Your Rights You may decline biometric verification. If you decline, FMSA will note your SE as pending identity verification and will attempt to verify your identity through alternative means within 2 business hours. This does not prevent or delay submission of NGB Form 1/1 to the NGB. ### 2.6 International Transfer The Platform is hosted in South Africa. Your photograph is not transferred outside South Africa. Any future transfer would be made only under POPIA Section 72. --- ## 3. Race ### 3.1 What We Collect During Step 1 (Personal Details) you are asked to optionally provide your racial classification from the categories defined under South African employment legislation: African, Coloured, Indian, White, Other. ### 3.2 Why We Collect It Race data is collected solely for submission to the International Gambling Harm Advisory Council ("IGHAC") as part of anonymised demographic harm reporting. This reporting assists IGHAC in understanding the demographic profile of gambling harm in South Africa and informing evidence-based policy. ### 3.3 Legal Basis POPIA Section 26(3)(b) - processing is necessary for the exercise of a public law duty. IGHAC demographic reporting serves a public interest function in gambling harm reduction. POPIA Section 11(1)(a) - explicit, separate consent obtained independently of other consents. The tick-box for race data is distinct from the general POPIA consent and requires a separate affirmative action. ### 3.4 How It Is Used - Your race data is submitted to IGHAC **only in aggregated, de-identified form** as part of periodic demographic reports - It is **never** included in NGB Form 1/1 or any document sent to the NGB or PGBs - It is **never** shared with gambling operators or any commercial entity - It is **never** used for profiling, targeting, or any purpose other than IGHAC demographic reporting - The individual-level race field is **deleted** from the FMSA database once included in the aggregated IGHAC report ### 3.5 Voluntariness Providing your race data is entirely voluntary. Declining to provide it has no effect on your ability to complete self-exclusion or receive any service from FMSA. ### 3.6 Withdrawal of Consent You may withdraw consent for processing of your race data at any time by emailing exclusions@freemesouthafrica.co.za. If your data has not yet been included in an IGHAC report, it will be deleted within 5 business days. Once included in an anonymised aggregate, individual withdrawal is not possible as the data is no longer identifiable. --- ## 4. Contact for Special Data Queries All queries regarding biometric or special personal information processing: **Information Officer: Pierre van Staden** Free Me South Africa (Pty) Ltd Email: exclusions@freemesouthafrica.co.za --- ## 5. Information Regulator If you have a complaint about the processing of your special personal information: **The Information Regulator (South Africa)** Website: https://inforegulator.org.za (see the website for current contact details and the complaints process) --- *Free Me South Africa (Pty) Ltd | Reg. 2025/384802/07* *POPIA Section 26 | POPIA Section 72 | NGA 7 of 2004*