Privacy Policy

Stallspace ("we", "us", "our") is operated by Kwry (Pty) Ltd, a company registered in South Africa. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use the Stallspace marketplace platform, in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA").

1. Information We Collect

We collect personal information that you provide directly to us, including:

• Name, email address, and phone number when you create an account or contact a vendor
• Delivery and billing addresses for orders
• Business information submitted by vendors during registration, including business name, registration number, and the merchant identifiers for the vendor's own payment gateway such as a PayFast merchant ID and passphrase, which we store encrypted. Stallspace does not collect or hold vendor bank account numbers, and never receives or holds customer funds.
• Communications between you and vendors via our enquiry system
• Usage data such as pages visited, products viewed, and search queries

2. How We Use Your Information

We use the information we collect to:

• Facilitate connections between customers and vendors
• Process and display order history and enquiries
• Verify and approve vendor applications
• Send transactional notifications (order updates, enquiry replies, subscription status)
• Improve and personalise the marketplace experience
• Comply with legal and regulatory obligations

3. Our Lawful Basis

Section 11 of POPIA requires a justification for every processing activity. Ours are:

• Performance of a contract (s11(1)(b)) for your order, delivery and contact details, and for giving you the marketplace service you asked for.
• Legal obligation (s11(1)(c)) for transaction, tax and company records we are required to keep.
• Legitimate interests (s11(1)(f)) for vendor application and verification data, fraud prevention, and keeping the marketplace vetted.
• Consent (s11(1)(a)) for any marketing message. You may withdraw that consent at any time and we stop.

4. Cookies and Similar Technologies

We set only the cookies the site needs to work. Those are the session cookies that keep you signed in, set by our authentication provider. We set no advertising cookies and no third-party tracking cookies, and we do not sell or share your browsing behaviour with anyone.

Our own page-visit counter stores a random identifier in your browser's session storage, not in a cookie. It is cleared when you close the tab, it is not linked to your name or email, and it exists so we can count visits to the marketplace and to each storefront.

5. Where Your Information Is Stored

Our database is hosted by Supabase in Frankfurt, Germany, in the European Union. Our email is sent by Resend. Transferring your information there is permitted by section 72 of POPIA, because those providers are bound by the European General Data Protection Regulation and by a written processing agreement with us that imposes protections substantially similar to POPIA's eight conditions, and because the transfer is necessary to perform your contract with us.

6. Important: Payments Are Not Processed by Stallspace

Stallspace is not a payment intermediary. When you make a purchase, your payment is processed directly by the vendor's payment provider (currently PayFast). We do not collect, store, or have access to your full payment card details. Please refer to the relevant payment provider's privacy policy for information on how they handle your payment data.

7. Sharing of Information

We share personal information only where necessary:

• With the relevant vendor when you submit an enquiry or place an order
• With our service providers (e.g. Supabase for data storage, Resend for email delivery) strictly to operate the platform
• Where required by law or to protect our legal rights

We do not sell your personal information to third parties.

8. Data Security

We implement reasonable technical and organisational measures to protect your information, including SSL encryption, role-based access control, and database-level security policies. However, no method of transmission over the internet is 100% secure.

9. Your Rights Under POPIA

You have the right to:

• Request access to the personal information we hold about you
• Request correction or deletion of your personal information
• Object to the processing of your personal information
• Lodge a complaint with the Information Regulator of South Africa

You can manage or delete your account information directly from your account settings, or contact us using the details below.

10. Data Retention

Section 14 of POPIA requires us to destroy records once the purpose we collected them for is spent. These are the periods we keep to:

• Order and transaction records, five years from the end of the tax year, as tax legislation requires.
• Company and accounting records, seven years, as the Companies Act requires.
• Customer account details, until you close the account or ask us to delete them, then 30 days to allow for recovery.
• Vendor application documents for rejected applications, twelve months.
• Enquiry messages between you and a vendor, twenty-four months.
• Website usage data, fourteen months.

We delete or de-identify personal information once these periods expire.

11. If Your Information Is Compromised

Where there are reasonable grounds to believe your personal information has been accessed by an unauthorised person, we will notify you and the Information Regulator as soon as reasonably possible, as section 22 of POPIA requires.

12. Information Officer & Contact

Our Information Officer can be reached for any privacy-related queries, access requests, or complaints at:

Mujahid Hendricks, as head of Kwry (Pty) Ltd
Kwry (Pty) Ltd trading as Stallspace
A private company registered in the Republic of South Africa
Registration number 2026/269289/07
Telephone +27 62 025 1903
hello@stallspace.co.za
South Africa
Email: mujahidh@stallspace.co.za or privacy@stallspace.co.za

We respond to an access request within 30 days, as the Promotion of Access to Information Act requires.

You may also lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a notice on the platform.