POPIA compliance & the Information Officer.

• Accountability:we take responsibility for compliance with POPIA across the platform and our operator chain.
• Processing limitation:we process personal information lawfully, in a minimal, justifiable, and non-excessive way.
• Purpose specification:we collect personal information for specific, explicitly defined, and lawful purposes related to running the marketplace.
• Further processing limitation:we do not repurpose personal information in a way that is incompatible with the original purpose.
• Information quality:we take reasonable steps to keep personal information complete, accurate, and current; you may correct your own details at any time.
• Openness:this page, the Privacy Policy, and the Terms of Service explain what we hold and why.
• Security safeguards:technical and organisational measures are described in the Privacy Policy and the Trust Center.
• Data subject participation:you can access, correct, and where applicable delete or object to the processing of your personal information.

• Know what personal information we hold about you (Section 23).
• Access that information and receive a copy.
• Correct information that is inaccurate or out of date (Section 24).
• Request deletion of information no longer required for the purpose collected, subject to FICA and tax retention periods.
• Object to specific processing activities.
• Lodge a complaint with the Information Regulator of South Africa.

Send a written request to our Information Officer at privacy@pakstoor.co.za. Include:

• Your full name and email address as registered on Pakstoor.
• A copy of your South African ID (for verification: encrypted at rest and deleted after the request is processed).
• A clear description of what you want (access, correction, deletion, or objection).

We respond within 30 days. There is no charge for a first access request per year; subsequent requests may incur a reasonable admin fee as permitted by POPIA regulations.

• Account details (name, email, phone, hashed password, communication preferences).
• Profile details (display name, location, bio, avatar).
• Transaction records (listings, offers, deals, ratings, courier and payment references).
• Public listing Q&A and private buyer-seller chat exchanged inside Pakstoor. Messages are subject to platform moderation to prevent fraud, off-platform contact-exchange (phone numbers, external links, messaging-app handles), abuse, and prohibited-goods activity. Pakstoor does not read message content for advertising.
• Listing photos and avatar images. We process images for moderation and quality. For example: automated checks for contact details inside images using optical character recognition (OCR), AI-assisted listing autofill that runs only on the first photo a seller uploads, and basic image-quality checks. Images are not used for third-party advertising.
• Verification records (for sellers: FICA-aligned identity and bank-account verification, run through our regulated escrow partner).
• Technical and security audit (IP address, browser/device data, login events, session metadata, fraud-risk signals, and append-only logs of high-risk admin actions).
• Formal Protected Review evidence, including parcel photos, waybill images, serial or IMEI images, item condition photos, written explanations, timestamps, courier tracking, chat records, and fraud-review indicators.

Where identity escalation is required during Fraud Escalation or high-risk review, Pakstoor will use secure in-platform upload or approved verification channels rather than ordinary email wherever reasonably possible.

If you choose Sign in with Google we receive the following from your Google account, and only the following:

• Email address: to identify your Pakstoor account.
• First and last name: to populate your Pakstoor profile.
• Profile picture URL: to display your photo on Pakstoor (we don't store the image itself; we render it from Google's CDN at googleusercontent.com).
• Google account ID (sub): an opaque internal identifier that lets us recognise you on subsequent sign-ins.
• Email-verified status: to confirm Google has verified the inbox; we don't separately email-verify accounts that arrived via Google.

Selected third-party operators process personal information on Pakstoor's behalf. Pakstoor remains the Responsible Party; operators act on our written instructions and are bound by appropriate Data Processing Addendums (DPAs) where applicable, including with Zoho for accounting. Current operators in the data flow include:

• TradeSafe:regulated escrow partner; handles buyer/seller KYC, payment processing, FICA verification, and seller payouts.
• The Courier Guy (Shiplogic):courier partner; receives delivery + collection addresses to fulfil shipments.
• Zoho Books:accounting partner; receives commission and settlement records under a signed DPA.
• Cloudflare:CDN, WAF, DDoS protection, and edge security.
• Resend:transactional email delivery.
• BulkSMS:transactional SMS delivery; WASPA-aligned operator.
• OpenAI:AI-assisted case advice generation. Where used, Pakstoor limits and privacy-scrubs the information before sending it for AI-assisted review support. AI output does not make the final decision; Pakstoor admin review remains responsible for the outcome.

Pakstoor does not sell personal information and does not share it for third-party advertising.

The following documents are available to the public in terms of the Promotion of Access to Information Act 2 of 2000 (PAIA).