Privacy policy

Who we are

Detoured (Pty) Ltd ("Detoured", "we", "us") is a private company registered in South Africa, registration number 2019/556330/07. Our address is Unit 309, Block B, 74 Victoria Road, Cape Town, 8000.

We do performance marketing and lead generation. We run paid social ads, mainly on Meta (Facebook and Instagram), that take people in the United States to landing pages and forms we operate. On those forms, consumers and small-business owners ask to be contacted about personal, auto or business loans. We send each request to one lender, broker or lead buyer, and the form names that buyer before you submit it.

We are not a lender and we do not make credit decisions. Filling in one of our forms is a request to be contacted. It is not a loan application.

For the information we collect, Detoured is the "responsible party" under South Africa's Protection of Personal Information Act (POPIA) and the "business" under US state privacy laws. Once the named buyer receives your information, the buyer is responsible for how it uses it, under its own privacy policy.

detoured.co.za is a website for businesses that buy leads. It has no forms. Our consumer forms are on separate pages that we operate, and they link to this policy.

What we collect and how

Website visitors and business contacts

• Details you give us when you email us or book a call: your name, work email, phone number, company, job title and anything you write to us.
• Booking details from Cal.com, our scheduling provider, when you book a call through it.
• Technical information that our hosting provider, Cloudflare, records when you visit: IP address, browser and device type, pages requested and the time of the request.

Consumers who use our lead forms

The exact fields depend on the form and the type of loan. Each form shows what it asks for. A form may collect:

• Contact details: name, email address, phone number and postal address.
• Details about the loan you want, such as the type, amount and purpose, and for auto loans, details of the vehicle.
• Details about you that lenders use to decide whether to contact you, such as date of birth or age, employment status, income and whether you own or rent your home.
• For business loans: business name, industry, time in business, revenue and your role in the business.
• Your consent: the consent wording you saw, the buyer it named, whether you agreed, and when.
• Technical information about your visit: IP address, approximate location based on that IP address, browser and device type, the page URL, the ad you clicked and how you moved through the form.

We also receive information from other sources. Ad platforms send campaign and click details. Lead validation providers tell us whether a phone number or email address is valid and active, and whether a lead duplicates one we already have.

Cookies, pixels and similar technologies

Our landing pages and forms use the Meta Pixel and Meta's Conversions API, and may use similar tools from other ad platforms we advertise on. The pixel runs in your browser. The Conversions API sends event information from our server to Meta. Together they tell us which ads lead to form submissions, so we can measure and improve our campaigns and show ads to people likely to be interested. They may send Meta your IP address, browser details, cookie identifiers, the pages you visit and the actions you take, such as submitting a form. Contact details we send this way are hashed (converted to a scrambled code) before they leave our systems. Meta uses this information under its own data policy.

Consent certification providers place a script on our forms that records your session. Section 3 explains how that works.

On detoured.co.za, Cloudflare may set cookies that are needed to keep the site secure. If you use Cal.com to book a call, Cal.com sets its own cookies.

You can block or delete cookies in your browser settings, and you can manage ad preferences in your Facebook or Instagram account settings. If you block the consent certification script, a form may not be able to record your consent, and we may not be able to pass your request on. Our pages honour Global Privacy Control, as section 7 explains.

Consent records and certification

When you submit a form, we record the time and date, your IP address, the page URL and the exact consent wording shown to you, including the name of the buyer.

We may also use a third-party consent certification provider, such as TrustedForm (by ActiveProspect) or Jornaya (by Verisk). Its script records your visit to the form, including what was on screen and what you typed or clicked, and produces a certificate. The certificate shows that you saw the disclosure and agreed to it. We share the certificate with the named buyer, and the buyer or we may use it to show that consent was given if anyone questions it. The provider keeps the certificate under its own policies.

How we use information

Consumer lead information

• To send your request to the buyer named on the form, so that it can contact you about the loan you asked about.
• To check that leads are real and accurate. We validate phone numbers and email addresses and remove duplicates.
• To record and prove your consent.
• To measure and improve our ads and pages, including through the Meta Pixel and Conversions API.
• To pass on and keep a record of any request you make to stop calls or texts.
• To prevent fraud, keep our systems secure, meet our legal obligations and deal with legal claims.

Business contact information

• To reply to you, hold calls with you and discuss, set up and run lead programmes.
• To manage our relationship with buyers, including test specs, agreements, invoices and reporting.
• To keep the website running and secure.

Under POPIA, we rely on your consent, on what is needed to perform or set up a contract with you, on our legal obligations, and on our legitimate interest in running and protecting our business.

Who we share information with

The buyer named on the form

We sell each consumer lead to one buyer only: the US lender, broker or lead buyer named in the consent wording on the form you submitted. We send it in real time through the buyer's CRM, an API, a ping-post system or email. In a ping-post system, we may first send some details without your name or contact details so that the buyer can decide whether to accept the lead. Your contact details then go only to the buyer named on the form. We do not sell the same lead to anyone else.

Service providers

We use these providers to run our business. They may handle personal information for us under contract:

• Cloudflare, which hosts our websites and protects them from attacks.
• Google Workspace, for email, documents and storage.
• Cal.com, for booking calls.
• Ad platforms, starting with Meta, for running and measuring our ads.
• Lead validation providers, which check phone numbers and email addresses.
• Consent certification providers, such as TrustedForm or Jornaya.

Ad platforms and consent certification providers may also use information under their own terms. Where that counts as "sharing" for cross-context behavioural advertising under US state law, we treat it that way. See sections 6 and 7.

Other disclosures

We may disclose information when the law requires it, to respond to valid legal process, to protect our rights or other people's safety, or to deal with a complaint or claim about consent. If we sell or reorganise our business, personal information may pass to the new owner, who must use it in line with this policy.

Sale and sharing of lead information

We do not sell the information of business contacts who email us or book a call, and we do not knowingly sell or share the personal information of anyone under 16.

You can opt out of future sale or sharing at any time. Section 7 explains how.

US state privacy rights

If you live in California or another US state with a consumer privacy law (such as Colorado, Connecticut, Oregon, Texas or Virginia), you have the rights below. The details vary by state, and we will apply the law of the state where you live.

Categories of information we collect, sell and share

In the past 12 months we have collected the categories below. We collect them from you, from your device, from ad platforms and from lead validation providers, for the purposes in section 4.

We also disclose these categories to the service providers in section 5 for business purposes, such as hosting, email, validation and consent certification. If a form asks for anything state law treats as sensitive personal information, we use it only to handle your request and for other purposes the law allows, and not to infer things about you.

Your rights

• Right to know and access. You can ask what personal information we have collected about you, where we got it, why we use it, and who we have sold it to, shared it with or disclosed it to. You can ask for a copy.
• Right to delete. You can ask us to delete personal information we collected from you. Some laws let us keep certain records, such as proof of consent, which we keep to defend legal claims.
• Right to correct. You can ask us to correct inaccurate information.
• Right to opt out of sale and sharing. You can tell us to stop selling or sharing your personal information, including for targeted advertising.
• Right to appeal. If we turn down your request, you can appeal by replying to our decision. If your state allows it, you can then complain to your state attorney general.

How to opt out of sale or sharing

Email peter@detoured.co.za with the subject line "Do not sell or share my information" and include the email address or phone number you used on our form. You do not need to verify your identity to opt out. We will act on your request within 15 business days. We will stop selling and sharing your information from then on, and we will tell the buyer that received your lead and ask it to stop selling your information too.

An opt-out cannot undo a sale that has already happened. If you want the buyer to stop contacting you or delete your information, contact the buyer directly as well. Section 8 explains how to stop calls and texts.

Global Privacy Control

If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out of sale and sharing for that browser. On our pages, that means we do not run advertising pixels for that visit. If you submit a form while GPC is on, we treat the submission as your request to send your details to the buyer named on that form, and we do not sell or share them in any other way.

How to make other requests

To use your right to know, delete or correct, email peter@detoured.co.za. We will confirm we received your request within 10 business days and answer within 45 days. If we need more time, we will tell you why, and we can extend by up to 45 more days. To protect you, we will verify your identity by matching details you give us against the information we hold, usually your name plus the email address or phone number you used on the form.

You can use an authorised agent. We will ask for proof that you gave the agent permission, and we may ask you to verify your identity with us directly.

Non-discrimination

We will not deny you a service, charge you a different price or treat you differently because you used any of these rights.

Calls, texts and your consent

Before you submit a form, it shows you consent wording that names the one buyer who may contact you. If you agree, you give that buyer permission to call and text you at the number you provided, about the loan you asked about. Under the US Telephone Consumer Protection Act (TCPA), this consent can cover calls and texts made with automated technology or prerecorded or artificial voice messages, if the consent wording says so. It applies even if your number is on a do-not-call list. Message and data rates may apply, and message frequency varies.

Consent is not a condition of any purchase. You do not have to agree to calls or texts to buy any product or service, or to get a loan. If you would rather not give consent, you can contact the lender directly instead.

How to withdraw consent

You can withdraw your consent at any time, in any reasonable way. For example:

• reply STOP to any text message;
• tell the person who calls you that you want no more calls; or
• email peter@detoured.co.za with the phone number you used. We will pass your request to the buyer that received your lead and record that you withdrew consent.

Under federal rules, the buyer must honour your request within 10 business days.

How long we keep information

We keep personal information only as long as we need it for the purposes in this policy:

• Consumer lead information, consent records and opt-out records: five years from the date you submitted the form. TCPA claims can be brought up to four years after a call or text, so we keep proof of consent for that period plus a margin.
• Business contact information: for as long as we are in contact or doing business with you, and for up to five years after that for accounting, tax and legal purposes.
• Website logs and security data: as long as our hosting provider keeps them, usually a short period.

When we no longer need information, we delete it or remove anything that identifies you. We may keep it longer where the law requires it or where it is needed for a legal claim.

Security

We take reasonable technical and organisational steps to protect personal information against loss, misuse and unauthorised access. These include encrypting data in transit (HTTPS), limiting access to the people who need it, and choosing providers with recognised security standards. No system is completely secure. If a breach affects your personal information, we will tell you and the authorities where the law requires us to.

International transfers

Detoured is a South African company. Information from US consumers is collected on pages hosted by Cloudflare, stored in Google Workspace and other cloud services that run in the United States and other countries, and delivered to buyers in the United States. Our team works with this information from South Africa.

That means personal information moves between the United States, South Africa and other countries where our providers operate. When we send personal information outside South Africa, we do so as POPIA allows: the recipient is bound by law, contract or binding rules that give it a similar level of protection, or the transfer is needed to carry out your request, or you have agreed to it. Our providers' contracts include data protection terms.

Your rights under POPIA

Because Detoured is based in South Africa, POPIA applies to how we handle personal information, wherever you live. Under POPIA you can:

• ask whether we hold personal information about you, and ask for a copy and a list of who has received it;
• ask us to correct, update or delete information that is inaccurate, out of date, incomplete, excessive or unlawfully obtained;
• object to our use of your information, including for direct marketing;
• withdraw your consent, which does not affect anything we did before you withdrew it; and
• complain to the Information Regulator.

Information officer

Our information officer is Peter Fogden. You can reach them at peter@detoured.co.za or at Unit 309, Block B, 74 Victoria Road, Cape Town, 8000.

Complaints

If you are unhappy with how we have handled your information, please contact our information officer first. You also have the right to complain to the Information Regulator of South Africa. Its contact details are on its website, inforegulator.org.za.

Children

Our websites, ads and forms are not directed at anyone under 18, and we do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it and will not pass it on. If you think a child has given us information, email peter@detoured.co.za.

Changes to this policy

We will update this policy when our practices or the law change, and at least once every 12 months. The date at the top shows when we last changed it. If we make a significant change to how we use information we already hold, we will tell affected people or ask for consent where the law requires it.

Contact us

For privacy questions or requests, email peter@detoured.co.za.

By post: Detoured (Pty) Ltd, Unit 309, Block B, 74 Victoria Road, Cape Town, 8000, South Africa.