Privacy Policy & POPIA Notice

1. Categories of Personal Information We Collect

Depending on how you interact with FrashionCart as a customer, designer, or visitor, we collect and process the following categories of information:

2. Purposes of Data Processing

We process your personal information for lawful and specific marketplace purposes, including:

• Order Fulfillment & Delivery: Enabling independent designers to prepare your garments and dispatch them via nationwide courier partners.
• Payment & Settlement Processing: Authorizing transactions, issuing tax invoices, processing refunds, and managing seller payout disbursements.
• Customer Support & Dispute Resolution: Responding to buyer inquiries, order tracking assistance, and facilitating returns or size exchanges.
• Platform Security & Fraud Prevention: Authenticating users, securing login sessions, detecting unauthorized access, and verifying seller applications.
• Legal & Tax Compliance: Maintaining financial transaction records in accordance with South African tax laws (SARS) and the Companies Act.

3. Third-Party Service Providers (Operators)

To provide our multi-vendor service, we partner with specialized third-party operators who process information on our behalf under strict confidentiality and security standards:

• Payment Gateways (PayFast & Yoco): When you pay online, payment credentials are sent directly to PCI-DSS Level 1 certified gateways. FrashionCart receives only encrypted transaction tokens and payment confirmation status.
• Logistics & Courier Partners (e.g. The Courier Guy, RAM Couriers): We share recipient names, delivery addresses, and contact numbers strictly to execute door-to-door physical delivery and returns collection.
• Cloud Infrastructure & Database (Google Cloud / Firebase & Supabase): We use managed cloud databases and identity providers to securely store customer accounts, encrypted credentials, and transaction records with Row Level Security (RLS).
• Transactional Communications (Resend): We use transactional email dispatch to send order receipts, password recovery links, and seller status notifications.

4. Information Sharing Between Buyers and Sellers

FrashionCart is a multi-vendor marketplace where independent designers fulfill their own orders. When you place an order, the relevant seller receives only the information necessary to fulfill that order: the recipient’s name, delivery address, contact phone number, and ordered products. Sellers are contractually prohibited from using buyer information for unsolicited marketing or unauthorized purposes.

5. Data Retention & Statutory Accounting Obligations

We retain personal information for as long as your account remains active or as needed to provide you with marketplace services. In compliance with Section 29 of the South African Tax Administration Act No. 28 of 2011 and the Companies Act No. 71 of 2008, financial records, tax invoices, and order transaction archives are legally required to be preserved for a minimum period of 5 (five) years, even if a user requests account deletion.

6. Technical & Organisational Security Safeguards

FrashionCart applies comprehensive administrative, physical, and technical safeguards to protect your personal data against loss, theft, and unauthorized access. These measures include TLS/SSL in-transit encryption, database Row Level Security policies, tokenized authentication sessions, and secure server headers.

7. International & Transborder Data Flows

Certain technology infrastructure (such as Google Cloud / Firebase and Supabase) may utilize secure servers located outside South Africa. In accordance with Section 72 of POPIA, we ensure that any cross-border transfer of personal information is subject to binding agreements or legal frameworks providing an adequate level of data protection substantially similar to POPIA.

8. Your POPIA Rights & Self-Service Account Tools

Under the Protection of Personal Information Act, you have the right to:

• Access Your Information (Section 23): Request confirmation of what personal information we hold about you. You can instantly download your complete data archive in JSON format via your Privacy & Security settings.
• Correct or Rectify Details (Section 24): Update your name, phone number, and delivery addresses at any time directly in your Personal details page.
• Request Deletion (Section 24): Request deletion of your personal account data, subject to lawful statutory retention requirements for financial and tax records.
• Object to Processing (Section 11(3)): Object to the processing of personal information on reasonable grounds.

9. Information Regulator & Complaints

If you have concerns about how we handle your personal information, you have the right under POPIA to lodge a complaint with the South African Information Regulator: