Privacy notice
How CodeCraftCo handles personal information, under the Protection of
Personal Information Act 4 of 2013 (POPIA).
Not yet reviewed by an attorney. This describes what the
platform actually does with personal information and is written to be
accurate, but it is not legal advice and should be reviewed before it is
relied on.
Two different relationships
This matters, because it decides who is answerable for what.
-
When you are a merchant using CodeCraftCo — we are
the responsible party for your business and account details.
-
When you are a shopper buying from a shop on our platform —
the shop is the responsible party for your information.
We are the operator, processing it on their instruction. If you
want your information changed or deleted, ask the shop; we act on their
instruction, and will help them do it.
What we collect
From merchants
- Business name, owner name, email address, phone number
- What you do on the platform — sales, stock, staff accounts
- Sign-in records, and the IP address and time of your agreement acceptance
From shoppers
- Name, email, phone number, delivery address
- Order history with that shop
- Delivery location while a delivery is in progress
We do not store card numbers. Payments are processed by our
payment provider; card details never reach our servers.
Why we hold it
- To run the shop — take orders, manage stock, complete deliveries
- To tell a customer what is happening with their order, over WhatsApp or SMS
- To show a merchant how their business is doing
- To keep accounts secure — rate limits and sign-in records exist to stop
someone guessing their way into a shop
- To meet legal obligations, including tax records
Messaging
Order and delivery updates are sent because you placed an order — that is
what the message is for, and you can opt out of them by telling the shop.
Marketing messages are different: they require your consent, every one
carries a way to unsubscribe, and an unsubscribe is honoured immediately and
permanently. We never sell your details, and shops cannot message people who
have not bought from them.
Who we share with
Only what is needed to make the service work:
- Payment provider — to take a payment; money settles to
the shop's own bank account, not ours
- Messaging provider — to deliver WhatsApp and SMS updates
- Hosting provider — where the platform runs
- Maps — to display a delivery route
We do not sell personal information to anyone, for any purpose.
Where it is kept
On servers outside South Africa, which POPIA permits where the receiving
country offers comparable protection or the provider is contractually bound
to equivalent standards. Everything is encrypted in transit.
How long
- Order and sales records: while the shop is active, then as long as tax law requires
- Delivery location trails: 90 days
- Sign-in and rate-limit records: 48 hours
- A closed merchant account: exportable for 30 days, then deleted
Your rights under POPIA
You may ask to:
- see what personal information we hold about you
- have it corrected if it is wrong
- have it deleted, where we are not required to keep it
- object to it being used for direct marketing — always, and at no cost
- complain to the Information Regulator of South Africa
Shoppers should ask the shop they bought from, since that shop is the
responsible party. If you are unsure who to ask, contact us and we will point
you to the right place.
Children
The platform is for businesses and their customers, and is not intended for
children under 18. We do not knowingly collect their information.
Changes
If this notice changes materially we will tell merchants at least 30 days
beforehand, through the inbox in their shop.
Contact
Information Regulator (South Africa) — complaints:
inforegulator.org.za