Privacy Policy

EU Brokers (Pty) Ltd ("EU Brokers", "we", "us", or "our") is committed to protecting your privacy and handling your personal information responsibly. This Privacy Policy explains how we collect, use, store, and share your personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and other applicable South African legislation.

By using our website, client portal, or any of our services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this policy, please do not use our services.

The responsible party for your personal information is:

We collect personal information that is necessary to provide insurance broking services. This includes:

We collect information directly from you, from third-party insurers in the course of placing or managing your cover, and automatically through your use of our digital services.

We process your personal information only for lawful purposes, including:

• Providing insurance broking services — obtaining quotes, placing policies, and managing renewals on your behalf.
• Processing and managing claims — submitting, tracking, and resolving insurance claims.
• Communication — sending you important notices about your policies, claims, or account.
• Compliance with legal obligations — meeting FSCA, FAIS, and other regulatory requirements applicable to authorised financial services providers.
• Fraud prevention and risk management — detecting duplicate or suspicious claims.
• Service improvement — analysing usage patterns to improve our portal and services (using anonymised or aggregated data where possible).
• Marketing — only with your explicit consent, and you may opt out at any time.

We will not process your information for purposes incompatible with those stated above without notifying you and, where required by law, obtaining your consent.

We may share your personal information with the following categories of third parties:

• Insurers and underwriters — to obtain quotes, bind cover, and process claims on your behalf.
• Reinsurers — where required in the normal course of underwriting.
• Assessors and loss adjusters — to investigate and settle claims.
• Service providers — including IT infrastructure providers (Supabase, AWS), email service providers (Mailgun), and AI-assisted document analysis providers (Anthropic, USA) who process data on our behalf under binding data processing agreements. Policy schedules and claim details may be sent to Anthropic for technical comparison and summarisation; this constitutes cross-border transfer of personal information to the United States.
• Regulatory authorities — the FSCA, Financial Intelligence Centre, or other bodies where legally required.
• Legal and professional advisors — where necessary to obtain legal advice or defend legal proceedings.

We do not sell your personal information. All third parties who receive your information are required to process it only for the purposes for which it was shared and to maintain appropriate security measures.

Some of our service providers are based outside of South Africa. Where personal information is transferred cross-border, we ensure adequate protections are in place as required by POPIA section 72.

We retain your personal information for as long as necessary to fulfil the purposes for which it was collected, or as required by law. In general:

After the applicable retention period, information is securely deleted or anonymised.

As a data subject, you have the following rights under POPIA:

• Right of access — to request confirmation of whether we hold your personal information and to obtain a copy of it.
• Right to correction — to request that inaccurate, irrelevant, or incomplete information be corrected or deleted.
• Right to object — to object to the processing of your personal information on reasonable grounds.
• Right to withdraw consent — where processing is based on your consent, to withdraw it at any time (this will not affect the lawfulness of processing before withdrawal).
• Right to complain — to lodge a complaint with the Information Regulator of South Africa if you believe we have violated your rights.

To exercise any of these rights, contact our Information Officer at delainy@eub.co.za. We will respond within 30 days. Some rights may be limited where we have a legal obligation to retain the information.

We implement appropriate technical and organisational measures to protect your personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:

• Encryption of data in transit (TLS) and at rest
• Role-based access controls — staff only access what is necessary for their role
• Secure authentication with hashed password storage
• Activity audit logs for all significant actions in our systems
• Regular security reviews of our infrastructure and third-party providers

Despite these measures, no system is completely secure. If you become aware of any security vulnerability or breach, please notify us immediately at delainy@eub.co.za.

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the Information Regulator and affected data subjects as required by POPIA.

Our website uses cookies and similar technologies to ensure the site functions correctly and to improve your experience. We use:

• Strictly necessary cookies — required for authentication and session management. These cannot be disabled.
• Functional cookies — to remember your preferences (e.g. language selection).

We do not use advertising or tracking cookies, and we do not share browsing data with advertising networks. You can control cookies through your browser settings, but disabling necessary cookies may prevent you from using the client portal.

Our services are not directed at persons under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a minor, please contact us immediately and we will delete it.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify registered users of material changes via email or a notice in the client portal. The effective date at the top of this page will always reflect the most recent version.

Continued use of our services after changes are published constitutes acceptance of the updated policy.

For any questions, requests, or concerns regarding this Privacy Policy or the handling of your personal information, please contact our Information Officer:

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Regulator of South Africa.