Privacy Policy (POPIA)
We process personal information in line with the Protection of Personal Information Act 4 of 2013 (POPIA).
1. Responsible party
Lenro Mostert t/a SmousPlek. Information Officer: Renier Ferreira, info@smousplek.co.za.
2. What we collect
- Account details: name, email, cellphone number and password (stored as a one-way hash).
- Ad content: text, photos, documents, town, and the contact details you choose to show. Location data (GPS) is removed from photos when you upload them.
- Payment records: amount, date, invoice number and gateway reference. We never receive or store your card details. These are handled by our payment provider, PayFast, under PCI DSS.
- Technical data: IP address, device and browser type, and reports made.
- Credit and referrals: your credit balance and history, and, if you joined through someone’s invite link, who invited you, so we can give them credit. We don’t show them your details.
3. Why we use it
- To run your account and publish your ad (performance of a contract, s11(1)(b)).
- To show your selected contact details to people viewing your ad (your consent, s11(1)(a)).
- To send receipts, reminders and service messages, and to prevent fraud (legitimate interest, s11(1)(f)).
- To meet tax and legal obligations (s11(1)(c)).
- Marketing only if you opt in (s69). You can unsubscribe at any time.
4. Your contact details on ads
Only the details you tick are shown, and only while the ad is live. Viewers must tap “Show contact details” to see them, and this is rate-limited to make scraping harder. People who view your ad can still copy your details. To withdraw consent, untick them or remove the ad.
5. Who we share it with
Operators who process information for us under written agreements (s21): our payment gateway (PayFast), hosting provider, email provider (Brevo) and SMS provider (BulkSMS). Some of these may store data outside South Africa, only where the recipient is subject to adequate protection (s72). We do not sell personal information.
6. How long we keep it
Ad photos and documents: deleted 365 days after the ad ends. Payment and invoice records: 5 years (Tax Administration Act). Account data: until you delete your account, plus any period the law requires.
7. Security
Encryption in transit (HTTPS), hashed passwords, access controls, activity logs and daily backups (s19). We will notify you and the Information Regulator of a security compromise as required by s22.
8. Your rights
You may ask to access, correct or delete your information, object to processing, or withdraw consent. You can delete your account yourself under Account. For other requests, email info@smousplek.co.za. You may complain to the Information Regulator (inforegulator.org.za).
9. Cookies
We only use essential cookies: one to keep you signed in and one to protect forms against misuse. We do not use advertising or tracking cookies.