VulaMart Privacy Policy and POPIA Compliance Statement

This Privacy Policy and POPIA Compliance Statement (“Privacy Policy”) explains how VULAMART (PTY) LTD, registration number 2025/712808/07 (“VulaMart”, “we”, “us”, “our”) collects, uses, discloses and protects personal information when you use:

• vulamart.co.za
• Any mobile-optimised sites, APIs, and other digital channels, tools or services we make available

(collectively, the “Platform”).

This Privacy Policy forms part of the VulaMart Policies, including:

• VulaMart – Conditions of Use
• VulaMart Seller Terms and Conditions
• Buyer/Customer Terms and Conditions
• Returns and Refunds Policy
• Cookie Policy
• Any additional service-specific rules, guidelines, or notices on the Platform

If there is any conflict between this Privacy Policy and the Conditions of Use or Seller Terms regarding the processing of personal information, this Privacy Policy will apply. For all other matters, the Conditions of Use and Seller Terms and Conditions will apply.

In our documentation, this document may be referred to as the “Privacy Policy”, “Privacy Notice” or “Privacy Policy and POPIA Compliance Statement”. All such references refer to this same document.

By accessing, browsing or using the Platform, or by creating any account (Buyer or Seller), you agree to the processing of your personal information as described in this Privacy Policy and the other VulaMart Policies.

We are committed to processing personal information lawfully, reasonably and securely, in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”), as well as other applicable South African laws such as the Consumer Protection Act 68 of 2008 (“CPA”) and the Electronic Communications and Transactions Act 25 of 2002 (“ECTA”).

For consistency with the Conditions of Use and Seller Terms and Conditions:

• “User” means any person or entity that accesses or uses the Platform in any way, including Buyers and Sellers.
• “Buyer” means a User who purchases or intends to purchase goods or services via the Platform.
• “Seller” means a User who is registered and approved by VulaMart to list and sell products or services (“Seller Items”) via the Platform.
• “Account” means a registered Buyer or Seller account on the Platform.
• “Seller Account” has the meaning given in the Seller Terms and Conditions.
• “Seller Items” has the meaning given in the Seller Terms and Conditions.
• “Services” means the online marketplace and related services VulaMart provides via the Platform.

Capitalised terms not defined in this Privacy Policy have the meanings given to them in the Conditions of Use and Seller Terms and Conditions.

For purposes of POPIA, the Responsible Party determining the purposes and means of processing personal information is:

VULAMART (PTY) LTD
Registration number: 2025/712808/07
Physical / registered address: 865 Natasha Street, Pretoria, 0044, South Africa
General support email: support@vulamart.co.za
Legal / privacy email (Information Officer): legal@vulamart.co.za
Telephone: 0800 123 456

We may appoint third-party Operators (processors) who process personal information on our behalf in terms of written agreements and in accordance with POPIA.

This Privacy Policy applies to:

• Users who browse, access or use the Platform
• Buyers using the Platform to purchase goods or services
• Sellers using the Platform to list, market and sell Seller Items
• Prospective customers, business partners and other individuals who contact us
• Any person whose personal information we process in connection with the Platform and our Services

This Privacy Policy does not apply to:

• Third-party websites, apps or services that may be linked from the Platform
• A Seller’s independent processing activities outside the Platform

Sellers are independent responsible parties for the personal information they receive from Buyers via the Platform (for example, delivery details) and are required by the Seller Terms and POPIA to handle such information lawfully.

The Platform operates in the Republic of South Africa and is primarily governed by South African law, including:

• The CPA, which governs consumer rights and fair marketplace practices
• The ECTA, which regulates certain aspects of electronic communications and online transactions
• The POPIA, which sets conditions for lawful processing of personal information

Nothing in this Privacy Policy is intended to unlawfully limit or exclude any rights you have, or obligations we (or Sellers) have, under the CPA, ECTA, POPIA or any other mandatory South African law.

We collect and process different categories of personal information depending on how you interact with the Platform.

5.1 Information you provide directly

User, Buyer and Seller Account information

• Full name
• Email address
• Mobile number
• Password (stored in encrypted form)
• Profile photo or avatar (optional)
• Communication and notification preferences

Seller / business information (as per Seller Terms)

• Business or trading name
• Company registration number / VAT number (where applicable)
• Business address and contact details
• Banking details for payouts (account holder, bank, account number, etc.)
• Information about Seller Items (products, services, property, motors, digital goods, jobs)
• Supporting documentation for verification (e.g. ID, proof of address, FICA/KYC documents, VAT registration)

Order and transaction information

• Items purchased or sold
• Order numbers and timestamps
• Pricing, discounts and fees
• Delivery and billing addresses
• Delivery method and courier selection
• Tracking and delivery status
• Invoices, receipts, refunds and chargebacks
• Communications relating to Orders, returns and disputes

Customer support and communications

• Content of messages, enquiries or complaints sent to VulaMart or via the Platform
• Information you provide when participating in surveys, promotions, competitions or feedback requests

5.2 Information we collect automatically

When you access or use the Platform, we automatically collect certain technical and usage information, such as:

• IP address
• Device type, operating system, browser type and version
• Log data (pages viewed, time and date, referring and exit pages, clickstream data)
• Usage data (search terms, filters, categories, items viewed, time spent on pages, interactions with features)
• Approximate location inferred from your IP address (e.g. city or region)

We use this information mainly to:

• Operate and secure the Platform
• Detect and prevent fraud, abuse and unauthorised access
• Understand usage patterns and improve the Services

5.3 Information from third parties

We may receive personal information from:

• Payment service providers and banks (limited transaction data, payment status, chargeback information)
• Courier and logistics partners (delivery and tracking updates, failed delivery information)
• Identity verification and fraud prevention service providers (verification results, risk indicators)
• Analytics and marketing partners (aggregated or anonymised insights)
• Public or regulatory sources, such as CIPC or sanction lists, for verification and compliance purposes

We process personal information in accordance with POPIA’s conditions for lawful processing, based on one or more of the following legal grounds:

1. Consent
2. For example, where you opt in to marketing communications or accept optional cookies.
3. Contractual necessity
4. To perform our obligations and exercise our rights under:
5. The Conditions of Use (for all Users)
6. The Seller Terms and Conditions (for Sellers)
7. Buyer/Customer Terms and Conditions (for Buyers)
8. Including account creation, facilitating Orders, processing payments and arranging delivery.
9. Legal obligations
10. To comply with statutory obligations (e.g. tax, financial record-keeping, FICA/KYC, reporting to authorities).
11. Legitimate interests
12. To operate, secure and improve the Platform, prevent abuse and fraud, enforce our policies, and manage business risks, provided these interests are not overridden by your rights and interests.

Where we rely on your consent, you may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawal of consent may affect our ability to provide certain services.

We use personal information for purposes that are aligned with the Conditions of Use, Seller Terms and other VulaMart Policies, including:

1. Providing and operating the Platform and Services
2. Creating and managing User, Buyer and Seller Accounts
3. Enabling listing, browsing, searching and filtering of Seller Items
4. Facilitating Orders, payments, cancellations and returns
5. Operating messaging and communication tools between Buyers, Sellers and VulaMart
6. Processing payments and payouts
7. Processing Buyer payments through third-party payment providers
8. Managing Seller balances and processing payouts (after fees, refunds, chargebacks and other adjustments)
9. Issuing invoices and receipts
10. Shipping and delivery
11. Providing Buyers’ delivery information to Sellers and/or courier partners
12. Generating waybills or labels where integrated courier options are used
13. Providing tracking details and handling delivery-related support
14. Verification, security and fraud prevention
15. Verifying the identity and details of Users and Sellers where required
16. Monitoring activity for fraud, abuse or policy violations
17. Enforcing our Conditions of Use, Seller Terms and other policies
18. Improving and personalising the Platform
19. Analysing usage, performance and traffic patterns
20. Improving features, layout and user experience
21. Showing relevant products, categories, promotions or recommendations
22. Communications and service messages
23. Sending transactional and service notifications (account alerts, security notices, order confirmations, shipping updates, policy changes)
24. Responding to queries, feedback and complaints
25. Marketing (subject to law and preferences)
26. Sending newsletters, offers, promotions or surveys relating to the Platform and Sellers
27. Giving you the option to manage or opt out of marketing at any time
28. Legal, regulatory, risk and dispute management
29. Complying with applicable laws, regulations, court orders and lawful requests
30. Handling complaints, disputes, chargebacks and legal claims
31. Maintaining appropriate records for audit and compliance purposes

We use cookies and similar technologies on the Platform to:

• Keep you signed in and maintain session security
• Remember your preferences (for example, language or filters)
• Collect analytics data for performance and usage insights
• Support security and fraud prevention
• Support certain marketing or remarketing activities (where permitted and, where required, with your consent)

Details of our use of cookies are set out in our Cookie Policy, which should be read together with this Privacy Policy.

You can manage cookies via your browser settings and, where applicable, through cookie settings on the Platform. If you disable certain cookies, some features of the Platform may not function correctly.

We do not sell personal information. We only share it as needed for the purposes described in this Privacy Policy and other VulaMart Policies, including:

1. Between Users (Buyers and Sellers)
2. To the limited extent necessary to complete an Order, arrange delivery, process returns, respond to queries and comply with legal obligations.
3. Payment service providers and banks
4. To process payments, refunds, chargebacks and for fraud prevention.
5. Courier and logistics partners
6. To collect and deliver physical goods, and to provide tracking updates.
7. IT, hosting and infrastructure providers
8. For website hosting, data storage, backup, email delivery, customer support tools, security and analytics.
9. Verification and risk management providers
10. For identity checks, sanctions screening, fraud detection, credit or risk assessments, where appropriate.
11. Professional advisers
12. Auditors, legal advisors and other professionals bound by confidentiality, where necessary for business, legal or compliance reasons.
13. Business transfers
14. In connection with a merger, acquisition, restructuring or sale of assets, subject to continued protection of personal information.
15. Public authorities and regulators
16. Where required by law, regulation, court order or lawful request (for example, the Information Regulator, law enforcement or tax authorities).

Where third parties act as Operators (processors) on our behalf, they are contractually required to process personal information only on our documented instructions, apply appropriate security measures and comply with POPIA.

Some Operators, service providers or data centres may be located outside South Africa. When personal information is transferred to another country, we will ensure that:

• The recipient is subject to a law, binding corporate rules or contract that provides an adequate level of protection substantially similar to POPIA; or
• Another lawful basis for cross-border transfer applies under POPIA.

By using the Platform, you acknowledge that your personal information may be transferred to and processed in other countries, subject to these protections.

We take reasonable and appropriate technical and organisational measures to secure personal information against:

• Loss, theft or damage
• Unauthorised access, disclosure or alteration
• Unlawful processing

These measures include, where appropriate:

• Secure servers and restricted access controls
• Encryption in transit where reasonable and appropriate
• Authentication, logging and monitoring
• Internal policies, confidentiality obligations and staff awareness measures
• Incident response processes

No security measures are perfect. You are responsible for protecting your Account credentials and devices, and for notifying us promptly at support@vulamart.co.za or legal@vulamart.co.za if you suspect unauthorised access to your Account.

We retain personal information only for as long as reasonably necessary to:

• Provide the Services and operate the Platform
• Fulfil the purposes described in this Privacy Policy and other VulaMart Policies
• Comply with legal, tax, accounting and regulatory requirements
• Resolve disputes and enforce our agreements

Retention periods depend on the type of information and legal requirements. For example:

• Transaction and financial records are kept for the minimum periods required by law.
• Account information is kept while your Account is active and for a reasonable period thereafter, unless a longer period is required or permitted by law.

When personal information is no longer needed, we will delete or de-identify it in a secure manner, unless we are legally required or permitted to keep it longer.

As set out in the Conditions of Use, the Platform is intended primarily for persons 18 years and older. Minors under 18 may only use the Platform if:

• They are duly assisted by a parent or legal guardian; and
• That parent or guardian agrees to the VulaMart Policies on their behalf.

We do not knowingly collect personal information from children without appropriate consent. If you believe we have collected personal information from a child without proper consent, please contact legal@vulamart.co.za so that we can investigate and take appropriate steps.

As set out in the Seller Terms and Conditions:

• VulaMart is the responsible party for personal information collected and processed via the Platform for our own purposes (e.g. marketplace operations, account creation, fraud prevention).
• Sellers are independent responsible parties for any personal information they receive from VulaMart or Buyers for the purposes of fulfilling Orders or providing services (e.g. recipient name, delivery address, contact numbers).

Sellers must:

• Use Buyer personal information only for legitimate purposes related to Orders and compliance with law
• Implement appropriate technical and organisational security measures
• Not sell, rent or misuse Buyer personal information
• Honour applicable data-subject rights and cooperate with VulaMart in responding to such requests

If a Seller experiences a personal data breach affecting Buyer information obtained via the Platform, the Seller must notify VulaMart without undue delay and cooperate in any required notifications to affected individuals and the Information Regulator.

Subject to certain limitations in POPIA, you have the right to:

1. Be informed
2. To be notified when personal information about you is collected and, where required, when it has been accessed or acquired by an unauthorised person.
3. Access
4. To request confirmation of whether we hold personal information about you and to request access to such information.
5. Correction or deletion
6. To request that we correct or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully.
7. Objection to processing
8. To object, on reasonable grounds, to the processing of your personal information where processing is based on our legitimate interests or for direct marketing.
9. Withdraw consent
10. Where processing is based on your consent, you may withdraw that consent at any time (subject to legal or contractual restrictions).
11. Opt out of direct marketing
12. To object at any time to the processing of your personal information for direct marketing purposes.
13. Not be subject to certain automated decision-making
14. To not be subject to decisions based solely on automated processing (including profiling) that significantly affect you, unless such processing is allowed by law and subject to appropriate safeguards.
15. Lodge a complaint
16. To lodge a complaint with the Information Regulator if you believe we are interfering with the protection of your personal information or failing to comply with POPIA.

To exercise your POPIA rights or to make a privacy-related enquiry, please contact:

Email (privacy / legal): legal@vulamart.co.za
Subject line: “POPIA: Personal Information Request”

You may also contact customer support for general matters at support@vulamart.co.za.

We may require you to verify your identity before responding to your request. In some cases, a reasonable fee may be charged (for example, for copies of records) in accordance with applicable law. We will inform you of any fee before processing your request.

If you are not satisfied with how we handle your personal information or your request, you may lodge a complaint with the Information Regulator (South Africa):

Information Regulator (South Africa)
Woodmead North Office Park
54 Maxwell Drive
Woodmead, Johannesburg, 2191
Tel: 010 023 5200
Email (general): enquiries@inforegulator.org.za
Email (POPIA complaints): POPIAComplaints@inforegulator.org.za
Website: inforegulator.org.za

We encourage you to contact us first so that we can try to resolve your concern directly.

We may update this Privacy Policy from time to time to reflect:

• Changes in our Services or business operations
• Changes in legal or regulatory requirements
• Improvements in how we explain our practices

When we change this Privacy Policy, we will:

• Publish the updated version on the Platform; and
• Update the “Last updated” date at the top.

Where changes are material, we may also notify you via email, in-platform notifications or banners. Your continued use of the Platform after any changes take effect will constitute your acceptance of the updated Privacy Policy.

For any questions about this Privacy Policy or our privacy practices, please contact:

VULAMART (PTY) LTD – Information Officer
Email (privacy / legal): legal@vulamart.co.za
Support email: support@vulamart.co.za
Telephone: 0800 123 456
Physical / registered address: 865 Natasha Street, Pretoria, 0044, South Africa

Email: support@vulamart.co.za

Phone: 0800 123 456

Address: 865 Natasha Street, Pretoria, 0044, South Africa