Privacy Policy

Vakoop (Pty) Ltd ("Vakoop", "we", "us") is committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, and share your data in compliance with the Protection of Personal Information Act 4 of 2013 ("POPIA") and other applicable South African data protection laws.

1. Responsible Party and Information Officer

Vakoop (Pty) Ltd is the responsible party (as defined in POPIA) for personal information processed through the Vakoop Platform. Information Officer: Vakoop Privacy Officer. Email: [email protected]. You may contact our Information Officer for any queries regarding the processing of your personal information, to exercise your rights, or to lodge a complaint.

2. Personal Information We Collect

We collect the following categories of personal information: Account information — name, email address, profile photo (obtained through your identity provider upon sign-in). Profile information — username, bio, location, profile photo. Transaction data — purchase and sale history, payment method used, amounts, delivery addresses, in-app purchase records, premium service usage records. Communication data — messages sent through the platform, including real-time messaging data. Financial data — bank account details (for withdrawals), wallet balance and transaction history. Authentication data — photos submitted for professional item authentication, verification codes, authentication results. Device and technical data — device type, operating system, app version, device identifiers, push notification tokens, IP address, browser type, and diagnostic data including crash reports and performance data. Location data — with your consent, precise geolocation data for nearby listings and delivery estimates. Usage data — pages visited, actions taken on the platform, search queries, and conversion events used to measure and improve our services.

3. How We Collect Your Information

Directly from you when you create an account, list items, make purchases, send messages, submit authentication photos, use premium services, grant location permissions, or contact support. From third parties — identity verification data from your sign-in provider, payment confirmation data from our payment processing partners, and in-app purchase transaction data from your device's app store. Automatically — technical, diagnostic, and usage data collected through cookies, device APIs, and similar technologies when you access or use the Platform.

4. How We Use Your Information

We process your personal information to create and manage your account; to facilitate buying and selling transactions, including auctions and promotional events; to process payments securely through our payment partners and in-app purchase infrastructure; to provide buyer protection and resolve disputes; to send you transactional notifications via push notifications, in-app alerts, and email; to detect and prevent fraud, counterfeit items, and prohibited activity (including automated content moderation of communications); to facilitate the professional authentication of items, including sharing photos with authentication service providers; to manage premium listing services (Boost, Bump, Promote); to monitor platform stability and diagnose technical issues; to measure the effectiveness of our services and improve the platform; to provide location-relevant features when you grant location access; and to comply with legal obligations.

5. Legal Basis for Processing (POPIA Section 11)

We process your personal information on the following legal bases under POPIA: Consent (s.11(1)(a)) — where we have obtained your specific consent, such as when you submit authentication photos or agree to marketing communications. Contractual necessity (s.11(1)(b)) — to fulfil our agreement with you when you use the platform, process transactions, or deliver premium services. Legal obligation (s.11(1)(c)) — to comply with South African laws including tax legislation, the CPA, and the ECT Act. Legitimate interest (s.11(1)(f)) — to improve the platform, prevent fraud, ensure security, and protect users from counterfeit goods.

6. Sharing Your Information

We may share your personal information with other users — your public profile, listing details, and ratings are visible to other users; delivery information is shared with Sellers so they can ship items to Buyers on VaKoop's behalf. Payment processing partners — they process your payment information securely; we do not store your full card details; in-app purchase transactions are processed by your device's app store operator. Delivery partners — courier and logistics providers receive delivery information necessary to process shipments. Authentication partners — third-party authentication services receive item photos, product descriptions, and your verification code; they do not receive your personal contact details or financial information. Infrastructure and service providers — we engage third-party providers for cloud hosting, transactional email, push notification infrastructure, error monitoring, service measurement, and AI-assisted feature processing (currently including OpenAI and other commercial AI providers, based primarily in the United States; see Section 14 for full details); these providers process data solely on our behalf and in accordance with our instructions. Authorities — when required by law, or to protect the safety of our users or the integrity of the Platform. We never sell your personal information to third parties.

7. Authentication Photo Data

When you use the professional authentication service, photos you submit are stored securely and used solely to authenticate your item; photos are shared only with the authentication service provider handling your request, along with the product description and your verification code. Authentication photos and related records are retained for 12 months after the authentication decision to support dispute resolution. After the 12-month retention period, you may request deletion of your authentication photos by contacting [email protected].

8. Data Security (POPIA s.19)

We implement appropriate security measures to protect your personal information, as required by POPIA section 19. All data transmitted between your device and our servers is encrypted using SSL/TLS. Payment processing is handled by PCI-DSS compliant partners, and card payments use 3D Secure authentication. Bank account numbers are encrypted end-to-end — your account number is encrypted on your device before transmission, encrypted during transmission, and stored in encrypted form. Your full account number is never stored or transmitted in plain text; only the last four digits are displayed after saving. Full bank details are accessible only to authorised Vakoop administrators for the purpose of processing withdrawal payouts. Rate limiting and abuse prevention protect against unauthorized access. Access to personal data is restricted to authorised personnel. In the event of a data breach that compromises your personal information, we will notify the Information Regulator and affected data subjects as soon as reasonably possible, as required by POPIA section 22.

9. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Account data is kept for the duration of your account and deleted upon account closure, except where retention is required. Transaction records are retained for 5 years for tax and legal compliance. Authentication photos are retained for 12 months after the authentication decision. Communication data is retained for the duration of your account. When you delete your account, we will delete your personal data except where retention is required for legal, accounting, or dispute resolution purposes.

10. Cookies

We use cookies and similar technologies to improve your experience on the Platform. You can manage cookie preferences through your browser settings.

11. Your Rights Under POPIA

As a data subject, you have the right to request access to your personal information (POPIA s.23); to request correction of inaccurate or incomplete information (POPIA s.24); to request deletion of your personal information (POPIA s.24); to object to the processing of your information (POPIA s.11(3)); to withdraw consent where processing is based on consent; not to be subject to automated decision-making (POPIA s.71); and to lodge a complaint with the South African Information Regulator. To exercise these rights, contact our Information Officer at [email protected]. We will respond within 30 days as required by POPIA.

12. International Data Transfers (POPIA s.72)

Your data may be processed outside of South Africa for cloud hosting purposes. Where this occurs, we ensure appropriate safeguards are in place to protect your information in accordance with POPIA section 72, including ensuring the recipient country has adequate data protection laws or that you have consented to the transfer.

13. Children's Privacy

Vakoop is not intended for children under the age of 13. Users between the ages of 13 and 17 may use the platform with verifiable parental or guardian consent. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information without appropriate consent, we will take steps to delete it in accordance with POPIA section 35.

14. AI-Assisted Features and Genio

AI Features used on the Platform. The Platform includes several features that process your personal information using artificial intelligence: Genio — an AI assistant for Sellers and Buyers (when you send a message, we transmit your message, a short history of recent turns, and a snapshot of your shop, which may include your Listings, prices, views, watchers, likes, followers, sales counts, and wallet balance, to our AI provider to generate Genio's reply; for Buyers, Genio also performs marketplace searches across the public catalogue of active Listings); Image moderation — every photo you upload is automatically analysed by an AI moderator to detect prohibited content (nudity, violence, weapons, drugs, hate symbols, counterfeit indicators), with flagged photos quarantined for manual review; Snap & List — optional feature analysing an uploaded photo to draft a Listing; AI Auto-Fill and AI Write — optional Seller tools that draft Listing titles, descriptions, and suggested prices; Bug-report triage — AI summarises and categorises bug reports for routing. Third-party AI processors. AI Features rely on third-party AI service providers, currently including OpenAI (United States) and other commercial AI providers. These providers process your data solely to generate the AI output for your specific request, in accordance with their data-processing terms. We do not authorise them to use your data to train their general AI models. As required by POPIA section 72, we have ensured appropriate safeguards for these cross-border transfers, including binding contractual data-processing terms. Genio chat history. Your Genio conversation history is stored locally on your device only, scoped to your account so it does not bleed across users on shared devices. Each chat request transmits only the most recent turns of the conversation as transient context. VaKoop does not retain a reconstructible record of your Genio conversations server-side — only a short hashed log entry per request for auditing and idempotency. Your chat history does not transfer when you switch devices or reinstall the app. Image quarantine retention. Photos flagged by image moderation are retained until an administrator reaches a decision; false-positive flags result in immediate deletion, confirmed flags may be retained for up to 90 days for evidence purposes and are then permanently deleted. AI usage logs. We maintain internal logs of AI Feature usage (feature, time, Rand value of compute) for up to 12 months for fraud prevention, capacity management, and abuse detection. Automated decision-making (POPIA s.71). Genio proposes actions on your shop but does not execute them automatically — every proposed action requires your explicit confirmation. Image moderation can result in an upload being rejected without manual review; in that case you may contact our Information Officer to request human review. You retain your POPIA s.71 right not to be subject to a decision based solely on automated processing. Legal basis for AI processing. Consent (s.11(1)(a)) — you opt in by tapping Genio, Snap & List, AI Auto-Fill, or AI Write; Contractual necessity (s.11(1)(b)) — where AI assists with services you have purchased; Legitimate interest (s.11(1)(f)) — image moderation, fraud detection, and bug-report triage to keep the Platform safe and operational. Opt-out. You can stop using optional AI Features at any time. Image moderation is mandatory for all photo uploads while you have an active account. If you object to AI processing more broadly, contact our Information Officer; we will explain which Platform features remain available without AI processing. Guest trial. Visitors without a Vakoop account may use a limited free trial of certain AI Features; trial usage is tracked by IP and an anonymous device identifier for abuse prevention only, and no account is created.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes through the app or via email. The most current version is always available on the Platform.

16. Contact Us

For questions about this Privacy Policy or our data practices, contact our Information Officer at [email protected]. You may also lodge a complaint with the Information Regulator of South Africa — website inforeg.org.za, email [email protected].