Privacy Policy

1. Who we are

Responsible party: [TODO: registered company name], registration number [TODO: company registration number].

Registered address: [TODO: registered physical address].

Information Officer: [TODO: Information Officer name]. Contact: [TODO: privacy contact email].

2. What we collect

Depending on how you deal with us, we may collect:

• Contact details you give us through the website contact form: name, email address, phone number, company, your role and the content of your message.
• Account and business details when you register on a platform: identity and business registration information, addresses, bank and payment details, and verification documents. [TODO: confirm the exact list with the product team]
• Transaction information: orders, wallet and payment activity, airtime and data purchases, rewards activity, and delivery details.
• Technical information: IP address, device and browser type, and basic usage logs needed to run and secure the service.

3. Why we use it

We process personal information only for a specific, lawful purpose, including to:

• respond to your enquiries and onboard you as a trader, distributor, supplier or partner;
• provide the marketplace, wallet, payment, point-of-sale, airtime and data, rewards and delivery services you ask for;
• verify identities and prevent fraud, money laundering and misuse, and meet our legal and regulatory obligations;
• keep our systems secure, fix problems and improve the service; and
• send service messages and, only where you have agreed or the law allows, marketing messages you can opt out of at any time.

4. Legal basis

We rely on the grounds POPIA allows: your consent, the need to conclude or perform a contract with you, a legal obligation, and our or a third party's legitimate interests where these do not override your rights. [TODO: counsel to confirm the ground for each purpose]

5. Who we share it with

We do not sell personal information. We share it only where needed, with:

• payment, banking, card-acquiring and mobile-network service providers that process payments and digital services on our behalf; [TODO: list providers]
• distributors, suppliers and delivery partners to the extent needed to fulfil an order;
• technology, hosting and communications service providers acting as our operators under written agreements; and
• regulators, law-enforcement or other authorities when the law requires it.

6. Transfers outside South Africa

Some of our service providers may store or process information outside South Africa. Where that happens we take steps to make sure the recipient is bound by rules or agreements that give a comparable level of protection, as POPIA section 72 requires. [TODO: confirm hosting locations]

7. How long we keep it

We keep personal information only for as long as needed for the purpose it was collected, and for as long as the law requires (for example, financial and anti-money-laundering record-keeping periods). After that we delete or de-identify it. [TODO: insert retention periods]

8. Security

We use reasonable technical and organisational measures to protect personal information against loss, misuse and unauthorised access. If a security compromise affects your information, we will notify you and the Information Regulator as POPIA requires.

9. Your rights

Under POPIA you may:

• ask whether we hold personal information about you and request a copy;
• ask us to correct or delete information that is inaccurate, outdated or unlawfully held;
• object to processing, including direct marketing, and withdraw consent you have given; and
• lodge a complaint with the Information Regulator (South Africa): inforeg.org.za.

To exercise these rights, contact our Information Officer at [TODO: privacy contact email].

10. Children

Our services are for businesses and adults. We do not knowingly collect personal information of children.

11. Changes to this policy

We may update this policy from time to time. The latest version is always on this page, with the date it last changed.