Privacy policy

This is a starter document and has not been reviewed by a lawyer. It must be checked against South African law (POPIA, the Consumer Protection Act and ECTA) and completed with Veld & Steel business details before the store opens for orders.

Who we are

Veld & Steel operates this marketplace and is the responsible party for the personal information described here. [Add the registered entity name, registration number, physical address, and the name and contact details of the Information Officer registered with the Information Regulator, as POPIA requires.]

What we collect

• Account details: your name, email address, and password (stored hashed, never in readable form).
• Order details: contact details, delivery address, and what you bought or bid on.
• Usage: essential cookies keep you signed in and hold your cart. Analytics cookies are used only if you agree to them.

Why we collect it, and on what basis

To create your account, process and deliver orders, run auctions, answer support requests, and meet our legal obligations. We process this information because it is necessary to perform our contract with you, to pursue our legitimate interests in running the marketplace, or because the law requires it.

Who we share it with

Sellers receive the details needed to fulfil your order. Service providers for hosting, database, storage, payments, email and delivery process data on our behalf under contract. We do not sell your personal information.

Where your information is stored

Our hosting, database and file storage providers operate outside South Africa, so your personal information is transferred and stored abroad. Section 72 of POPIA permits this where the receiving country or the provider is bound by comparable protections; our providers are contractually required to protect your information to a standard at least equivalent to POPIA.

How long we keep it

We keep your account information for as long as your account is open, and order and auction records for as long as tax and consumer-protection law requires. [Confirm your retention periods.]

How we protect it

Passwords are hashed, traffic is encrypted in transit, administrative access is restricted to authorised staff, and changes to permissions and moderation decisions are recorded in an audit trail.

Marketing

We only send marketing email if you have asked for it, and every message includes a way to unsubscribe.

Your rights

Under POPIA you may ask what we hold about you, ask us to correct or delete it, object to processing, and withdraw consent. Contact us using the details on our contact page.

Complaints

If you are not satisfied with how we handle your information, you may complain to the Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, or by email to complaints.IR@justice.gov.za.