POPIA Compliance

The Protection of Personal Information Act 4 of 2013 (POPIA) is South Africa's data protection law that regulates how personal information may be processed. It came into effect on 1 July 2021.

Personal information includes any information that identifies you or can be used to identify you. This includes your name, contact details, ID number, location data, financial information, and any other data that can be linked to you.

• Account registration and profile creation
• Product listings and store setup
• Communication through our platform
• Delivery address details for orders and marketplace matching
• Seller verification (ID document, proof of address, bank details)
• Payment information (processed by third parties)
• Device and usage data for platform improvement

We process your personal information based on:

• Your consent when you create an account and use our services
• Legitimate business interests in providing our platform
• Legal obligations under South African law
• Contract performance when you place or fulfil orders

• Right to be informed about how your data is used
• Right to access your personal information
• Right to correct inaccurate information
• Right to delete your data ("right to be forgotten")
• Right to object to processing in certain circumstances
• Right to data portability
• Right to lodge a complaint with the Information Regulator

• Handsy uses an automated Trust Score that affects your visibility and perks on the platform. We disclose this clearly in-app and in these terms.
• Right to transparency: You can view your Score Ledger (full history of positive and negative events) at any time in your account.
• Right to correction and objection: If you believe a negative event is wrong, you may submit an appeal with evidence (e.g. waybill, chat screenshot) via the in-app appeal flow. We will review and may reverse the event or reject with reasons.
• If we cannot resolve your concern, you may contact the Consumer Goods and Services Ombud (CGSO) or the National Consumer Commission (NCC) for independent redress.

We collect the following categories of personal information:

• Identity information: Name, surname, ID number (from verification documents)
• Contact information: Email address, phone number, physical/delivery address
• Profile information: Store details, product categories, seller verification status
• Banking information: Account details sellers submit for verification and payouts
• Location data: Town, suburb, delivery address for orders and marketplace matching
• Communication data: Messages, reviews, ratings. Chat messages may be processed for platform safety, fraud prevention, abuse detection, and risk detection. Automated checks look for attempts to divert a recorded Handsy order. They do not treat ordinary contact details as fraud, and they do not judge whether a person “is a scammer”. Safety logs keep a short excerpt and the classification for 90 days, not the full conversation indefinitely.
• Technical data: Device/browser signals, IP address (used to create a salted fraud-link identifier), and usage patterns. We collect this for specified, lawful purposes: security, fraud prevention, detecting abuse, protecting users, preventing duplicate or fraudulent accounts, and investigating suspicious activity.

• To provide and maintain our platform and marketplace services
• To connect buyers with sellers and products; to facilitate orders and delivery
• To facilitate communication and order fulfilment
• To verify user identities and seller accounts
• To improve our services and develop new features
• To comply with legal obligations
• To prevent fraud and abuse, protect users, detect duplicate or fraudulent accounts, investigate suspicious activity, and ensure platform security

We may share your information with:

• Other platform users (sellers and buyers as necessary for listings, orders, and delivery)
• Third-party service providers (hosting, analytics, payment provider)
• Law enforcement when required by law
• Professional advisors and insurers in case of disputes
• The Information Regulator for compliance purposes

We implement appropriate technical and organisational measures to protect personal information, and we review them as risks change (POPIA section 19):

• HTTPS for data in transit; hosting-provider encryption of storage volumes at rest
• Database access controls and private storage for identity and bank documents while a check is in progress, with short-lived signed access for the seller and authorised administrators. Uploaded verification files are destroyed once the seller is verified (POPIA). An approved selfie may be kept only as the profile photo.
• Audit records of administrator access to verification documents, bank details, seller status, and role changes
• A written incident-response process. If personal information is compromised we assess the incident and notify the Information Regulator and affected data subjects as required by POPIA
• Hosted backups and point-in-time recovery on the production database provider, when that feature is enabled

We retain your personal information for as long as necessary to provide our services and comply with legal obligations:

• Seller verification files: Destroyed as soon as the seller is verified. We retain the verification outcome, not copies of the documents.
• Active accounts: Retained while account is active
• Inactive accounts: Retained for 3 years after last activity
• Network fraud-link identifiers: salted hashes retained up to 12 months after last use, then deleted. Raw IP addresses are not stored in the fraud graph.
• Legal requirements: Retained as required by South African law
• Backup data: Held by the hosting provider for disaster recovery. Retention follows that provider’s backup window and this policy’s account and inactive-account periods.

Your data is primarily stored in South Africa. Any international transfers comply with POPIA requirements and include appropriate safeguards.

We use cookies and similar technologies to improve your experience and analyse platform usage. Handsy does not use third-party advertising cookies. See our Cookie Policy at /legal/cookies. You can control cookie preferences through your browser or device settings.

Our services are not intended for children under 18. We do not knowingly collect personal information from children under 18.

We may use automated systems for marketplace search and matching, the Trust Score, and fraud detection. A shared IP address or internet connection is treated as one risk signal only and never causes an automatic ban — households, offices, campuses and mobile networks often share an address. You have the right to request human review of automated decisions.

By using Handsy, you consent to the collection and processing of your personal information as described in this policy. You may withdraw consent at any time.

If you have concerns about how we handle your personal information:

• Contact us at privacy@handsy.co.za
• Lodge a complaint with the Information Regulator of South Africa
• Contact details: informationregulator.org.za

We may update this POPIA compliance information periodically. We will notify you of material changes through the platform or via email.

Handsy has appointed a POPIA compliance officer responsible for ensuring compliance with the Act. Contact: compliance@handsy.co.za