Eswatini Privacy Centre

Introduction

TransUnion operates as a credit information and insights provider in Eswatini and processes personal information in accordance with applicable legal and regulatory requirements.

Its operations are governed by relevant laws, including the Data Protection Act, 2022, and any other applicable financial services and regulatory frameworks in Eswatini.

TransUnion is committed to protecting the integrity, confidentiality, and security of all Personal Information processed in the course of its operations and recognises the importance of privacy and data protection.

TransUnion implements appropriate technical and organisational measures to safeguard personal information and ensure that such information is processed lawfully, fairly, and transparently.

Where applicable, TransUnion aligns its practices with recognised industry standards and requires all entities interacting with TransUnion to maintain equivalent levels of data protection when processing personal information.

This notice covers the following topics:

1. Purpose
2. Scope and Application
3. Definitions
4. Compliance with Laws
5. Information Security
6. Lawful Basis and Consent
7. Submission and Quality of Information
8. Use of Information
9. Protection of Personal information
10. Data Breach Notification
11. Retention and Disposal
12. Confidentiality
13. Credit Information and Payment Profiles
14. Removal of Advere sCredit Information
15. Contact and Queries
16. Policy Updates

1.  Purpose

This Policy sets out the requirements and standards for the lawful processing, protection, and secure handling of personal information collected, shared with, or processed by TransUnion in the course of its operations.

2.  Scope and Application

1.    This policy applies to:

a.    TransUnion, including its employees, contractors, and internal operations that handle personal information; and 

b.    all external organisations that access, use, process, or provide personal information to or from TransUnion (whether directly or through an authorised TransUnion partner or reseller) (“Applicable Parties”).

2.    This Policy establishes the minimum standards for how personal information must be handled and protected. For external parties, this Policy forms part of the terms governing their relationship with TransUnion and must be read together with any applicable agreement.

3.    Non-compliance with this Policy may be treated as a breach of contractual obligations and may be addressed in accordance with the relevant agreement and applicable law.

4.    This Policy continues to apply for as long as TransUnion or any Applicable Party holds or uses personal information, even if the commercial relationship has ended.

5.     If there is any conflict between this policy and another agreement between TransUnion and an Applicable Party, this Policy will apply to matters relating to how personal information is handled, unless the law requires otherwise.

3.  Definitions

Key terms used in this policy include:

1. “Data Controller” means the party that determines the purpose and means of processing personal information.
2. “Data Processor” means a party that processes personal information on behalf of a Data Controller.
3. “Data Protection Act” means the Data Protection Act, 2022 of Eswatini, as amended from time to time.
4. “Data Subject” means an identifiable individual whose personal information is collected or processed.
5. “Laws” means all applicable laws, regulations, and requirements issued by authorities or regulators.
6. “Party” or “Parties” means TransUnion and/or any Applicable Party, as the context requires.
7. “Payment Profile Information” means information relating to a person’s payment behaviour and credit activity.
8. “Personal information” means any information relating to an identifiable individual.
9. “Processing” means any activity involving personal information, including collection, use, storage, or deletion.
10. “TransUnion” means the relevant TransUnion entity operating in the Kingdom of Eswatini.

4.  Compliance with Laws

TransUnion and all Applicable Parties must comply with all applicable legal and regulatory requirements in Eswatini, including the Data Protection Act, 2022, and any relevant financial services or regulatory obligations.

5.  Information Security

TransUnion implements appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse, or damage.

Access to personal information is restricted to authorised individuals, and third-party service providers are required to maintain appropriate security safeguards.

In the event of a security incident, TransUnion will investigate and take appropriate steps to contain and remediate the issue in line with applicable requirements.

6.  Lawful Basis and Consent

TransUnion processes personal information in a lawful, fair, and transparent manner.

Where required, consent will be obtained before processing takes place, and records of such consent will be maintained. Personal information may also be processed where necessary to fulfil contractual obligations, comply with legal requirements, or for legitimate business purposes.

7.  Submission and Quality of Information

1.    TransUnion and all parties processing Personal information must ensure that any information collected, used, or submitted is:

• Accurate, complete, and up to date 
• Not duplicated or misleading 
• Processed lawfully and with proper authorisation 
• Limited to categories of information permitted by applicable law

2.    Where information is submitted to TransUnion or used for credit credit information or risk assessment purposes, the following additional requirements apply:

• Only information permitted under applicable laws and regulations may be submitted;
• Data must meet required minimum standards and reporting criteria
• All submissions must comply with applicable legal and regulatory requirements 

3.    The following types of information must not be submitted to TransUnion:

• Prescribed debt
• Duplicate or erroneous listings
• Unresolved disputed information
• Restricted categories as defined by law
• Information that has previously been successfully challenged and removed 

All parties must take reasonable steps to ensure data accuracy and must cooperate in resolving disputes and correcting any inaccurate information.

8.  Use of Information

Personal information must be used responsibly and only for lawful purposes, such as:

Personal information must:

• Be used only for the purpose for which it was collected;
• Not be used in a way that is incompatible with that purpose; and
• Not be shared with third parties for unauthorised purposes.

In limited cases, credit information may be used for employment-related checks, where:

• The individual has provided consent; and
• The role requires a position of trust (for example, handling finances).

TransUnion takes steps to ensure that Personal information is handled in a fair and responsible manner at all times.

9.  Protection of Personal information

TransUnion ensures that personal information is processed securely and access is limited to authorised individuals.

Appropriate safeguards are in place to protect data from unauthorised access, loss, or misuse. Third parties are required to meet equivalent data protection standards.

10.  Data Breach Notification

TransUnion takes the protection of Personal information seriously and has measures in place to identify, manage, and respond to any security incidents that may affect such information.

In the event of a security incident, TransUnion will take appropriate steps to investigate, contain, and address the incident, and to minimise any potential impact on affected individuals. This may include securing systems, assessing the nature and scope of the incident, and implementing measures to prevent a recurrence.

Where required by applicable law, TransUnion will notify affected individuals and the relevant data protection authority in Eswatini. TransUnion remains committed to handling such incidents responsibly and transparently.

11.  Retention and Disposal

TransUnion retains Personal information only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable laws and regulatory obligations.

Once Personal information is no longer required, TransUnion takes appropriate steps to ensure that it is securely deleted, destroyed, or de-identified in a manner that protects privacy and prevents unauthorised access.

12.  Confidentiality

TransUnion treats Personal information as confidential and takes appropriate steps to protect it from unauthorised access, disclosure, or misuse. 

Access to Personal information is limited to authorised individuals who require it to perform their roles. 

TransUnion remains committed to maintaining the confidentiality of Personal information, even after its relationship with an individual or organisation has ended, where required by law.

13.  Credit Information and Payment Profiles

Payment Profile Information relates to an individual’s payment behaviour and credit activity.

TransUnion processes and shares this information in accordance with applicable laws and regulatory requirements. Access is restricted to authorised entities for lawful purposes such as credit assessments and risk management.

All sharing of such information is subject to safeguards to ensure accuracy, fairness, and responsible use.

14.  Removal of Adverse Credit Information

TransUnion processes adverse credit information in accordance with applicable laws and regulatory requirements in Eswatini, including relevant data protection, financial services, and consumer protection legislation.

Adverse credit information relating to a credit facility may be updated, retained, or removed from an individual’s credit profile in accordance with applicable legal and regulatory requirements, including where the underlying obligation has been settled or where the information is no longer required to be retained.

Judgments and other credit-related information are recorded and updated based on information received from authorised sources and in line with applicable legal requirements.

Adverse listings will only be amended or removed where permitted by law, including where the information is found to be inaccurate, incomplete, misleading, fraudulent, duplicated, or subject to a valid dispute.

TransUnion does not permit the unlawful or unauthorised removal of adverse credit information and does not support the charging of upfront fees for the removal of such information, except where permitted under applicable law.

15.  Contact and Queries

If you have any questions about this policy or how your Personal information is processed, you may contact TransUnion using the following details:

• Location: Kiosk no 4,Plot 339,Ground Floor,Swazi Post, Nkoseluhlaza St, Manzini
• Postal Address: PO Box 2642, Manzini, Eswatini, M200
• Telephone: +268 2505 7844
• Email: DPOEswatini@transunion.com

16.  Policy Updates

This policy may be updated from time to time to reflect changes in applicable laws, regulations, or industry practices. 

TransUnion will take reasonable steps to inform relevant stakeholders of any material changes to this policy. The latest version of this policy will always reflect the most recent effective date.

Effective date: 1 June 2026