1. Scope of this notice
This notice explains how Exclusive Advisory Services, trading as RandCrypto (“RandCrypto”, “we”, “us”), processes personal information collected through randcrypto.co.za (“this website”), in line with the Protection of Personal Information Act, 2013 (POPIA).
This website is informational: it does not require you to register, log in, or submit identity documents. Account opening, KYC verification, and transaction data in the RandCrypto app are covered by a separate in-app privacy notice, not by this one.
2. What we collect on this website
Contact details you choose to give us: when you submit the OTC inquiry or corporate onboarding form, we collect your name, email address, phone number (if provided), company or entity name (if provided), and the details of your inquiry.
Local browser storage: starred “watchlist” assets are stored only in your browser’s local storage. This never leaves your device and is not linked to any account.
Technical and log information: our hosting provider may process standard request information (such as IP address and browser type) to deliver this website, keep it secure, and diagnose issues.
We do not run advertising trackers or marketing pixels, and we do not build behavioural profiles of visitors to this website.
3. Why we process it
To respond to an OTC or onboarding inquiry you submit, including verifying who we are speaking to before discussing terms.
To operate, secure, and improve this website, including detecting abuse of our market-data endpoints.
To meet legal and regulatory obligations that apply to a licensed Category I Crypto Asset Service Provider.
4. Lawful basis
We process inquiry details on the basis of your consent (you chose to submit the form) and to take steps at your request before entering into an agreement. We process technical/log data on the basis of our legitimate interest in keeping this website secure and functioning correctly.
5. Sharing your information
Inquiry details are shared internally with the RandCrypto team responsible for OTC and corporate onboarding. We use third-party infrastructure providers (hosting, and a market-data provider for reference prices) who process limited technical data on our behalf under their own security obligations. We do not sell personal information.
6. Cross-border processing
Some infrastructure providers we use may process data outside South Africa. Where this happens, we take reasonable steps to ensure the recipient is subject to a data protection standard that gives your information a comparable level of protection to POPIA.
7. Retention
We keep inquiry submissions for as long as reasonably needed to respond to you and to meet record-keeping obligations that apply to a licensed financial services provider, after which they are deleted or anonymised.
8. Your rights
Under POPIA you can ask us to confirm what personal information we hold about you, request access to it, ask us to correct or delete it, and object to processing carried out on the basis of legitimate interest. To exercise any of these rights, contact us using the details below.
9. Security
We use reasonable technical and organisational measures to protect the information submitted through this website against loss, unauthorised access, and disclosure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
10. Children
This website is not directed at, and we do not knowingly collect personal information from, anyone under the age of 18.
11. Changes to this notice
We may update this notice from time to time. The date at the top of this page shows when it was last updated.
12. Information Officer & contact
Our Information Officer can be contacted at support@randcrypto.co.za regarding this notice or any POPIA request. You also have the right to lodge a complaint with the Information Regulator (South Africa) if you believe your information has been processed unlawfully.