Privacy Policy

This policy explains how Spaza Shop (Pty) Ltd ("we") collects, uses, and protects your personal information as an Information Officer under the Protection of Personal Information Act (POPIA).

What we collect

• Account details: name, email, phone, shop name.
• Identity: your South African ID number is hashed (SHA-256) before storage — we retain only the hash, last 4 digits, verified date of birth, and gender.
• Business data: inventory, orders, deliveries, sales.
• Technical: device, IP address, user agent.

How we use it

• Operate the Service (auth, marketplace matching, delivery routing).
• Comply with legal obligations (KYC, anti-fraud, tax).
• With your consent, send you tips and product updates.

Your POPIA rights

You have the right to access, correct, and delete your data, and to withdraw consent at any time. Contact privacy@spazashop.co.za.

Retention

We retain personal data for as long as needed to provide the Service and comply with law (typically 5 years for financial records).

Security

Row-level security in our database, encryption in transit, and hashed ID numbers. No system is 100% secure — we notify affected users of any material breach within 72 hours.