Privacy Policy

1. Information We Collect

We collect the following categories of personal information:

• Identity Information: Full name, email address, phone number, and physical address.
• Account Information: Username, password (encrypted), and account preferences.
• Transaction Information: Bid history, auction activity, purchase history, and payment records.
• Payment Information: Bank account details for payouts (sellers) and EFT payment references (buyers).
• Seller Verification Data: Business registration documents (CIPC), proof of premises, and banking details.
• Technical Information: IP address, browser type, device information, and access timestamps.
• Communications: Messages sent through the platform, support requests, and dispute correspondence.

2. How We Use Your Information

We use your personal information for the following purposes:

• Account Management: Creating, maintaining, and securing your account.
• Transaction Processing: Facilitating bids, auction management, escrow payments, and payouts.
• Notifications: Sending auction updates, outbid alerts, winning notifications, payment reminders, and delivery confirmations.
• Verification: Confirming seller eligibility and verifying user identity as needed.
• Dispute Resolution: Investigating and mediating disputes between buyers and sellers.
• Platform Improvement: Analysing usage patterns to improve functionality and user experience.
• Legal Compliance: Meeting regulatory and legal obligations.

3. Data Sharing

We share your personal information only in the following limited circumstances:

• Transaction Counterparties: When an auction is won, the Buyer receives the Seller's store name and collection address. The Seller receives the Buyer's name and contact information necessary to arrange collection or delivery.
• Payment Processors: Banking details are shared with our payment service providers solely for processing transactions.
• Legal Requirements: We may disclose information if required by law, court order, or government authority.
• Platform Protection: To investigate fraud, enforce our Terms, or protect the rights and safety of users.

We do not sell your personal information to third parties. We do not share your data with advertisers or marketing companies.

4. Data Security

We implement appropriate technical and organisational measures to protect your personal information:

• All data in transit is encrypted using TLS (Transport Layer Security).
• Sensitive data at rest is encrypted using industry-standard encryption algorithms.
• Access to personal information is restricted to authorised personnel on a need-to-know basis.
• Regular security audits and vulnerability assessments are conducted.
• Passwords are stored using secure hashing algorithms and are never stored in plain text.

5. Cookies

Asset Exchange uses cookies for the following purposes:

• Session Management: Keeping you logged in and maintaining your session state.
• Security: Preventing cross-site request forgery and other security threats.
• Preferences: Remembering your display preferences and settings.

We do not use third-party tracking or advertising cookies. You may disable cookies in your browser settings, but this may affect Platform functionality.

6. Your Rights

Under POPIA, you have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete personal information.
• Deletion: Request deletion of your personal information, subject to legal retention requirements.
• Objection: Object to the processing of your personal information in certain circumstances.
• Data Portability: Request your data in a structured, commonly used format.
• Withdrawal of Consent: Withdraw consent for processing where consent was the legal basis.

To exercise any of these rights, contact our Information Officer at the details provided below. We will respond within 30 days.

7. POPIA Compliance

Asset Exchange complies with the Protection of Personal Information Act 4 of 2013 (POPIA). Our processing of personal information is based on the following lawful grounds:

• Contractual Necessity: Processing required to perform our contract with you (account management, transaction processing).
• Legal Obligation: Processing required to comply with applicable laws and regulations.
• Legitimate Interest: Processing for fraud prevention, platform security, and service improvement.
• Consent: Where we rely on consent, you may withdraw it at any time.

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Data is securely deleted or anonymised when no longer needed.

8. Data Retention

• Active account data is retained for the duration of your account.
• Transaction records are retained for 5 years as required by tax and financial regulations.
• Upon account deletion, personal information is anonymised within 30 days, except where legal retention applies.

9. Contact & Information Officer

For privacy-related queries, data access requests, or complaints, please contact our Information Officer:

• Email: privacy@asset-exchange.co.za
• General Support: support@asset-exchange.co.za

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za.