South Africa Privacy Notice (POPIA)

This notice explains how Tanqory collects, uses, discloses, transfers, and protects personal information under the Protection of Personal Information Act, 2013 (POPIA) and guidance from the Information Regulator. It is written in a practical, transparent style and links to our Data Processing Addendum for merchants and partners. It covers lawful processing, transparency and consent, data subject rights, cross-border transfers, security, breach notification, sensitive/special personal information, and children’s information.

Purpose, scope, and roles

This notice applies to merchants, developers, end customers of merchants, users of our apps/services, and visitors whose personal information is processed under POPIA. Tanqory acts as:

• Operator when processing merchant customer data under the merchant’s instructions in the DPA.
• Responsible Party when providing services directly (e.g., merchant accounts, billing, payments, support, platform analytics).

It covers data you provide directly, data provided by merchants, and data generated by Tanqory systems (logs, telemetry, analytics), including data routed to third-party systems and cross-border services. We define purposes clearly, apply minimality and accountability, and provide accessible notices and rights forms in English and, where appropriate, other prevalent languages (e.g., Afrikaans, isiZulu, Sesotho) to uphold openness and fairness.

Privacy by design and default

We embed POPIA principles in our product and engineering processes: minimality, purpose limitation, role-based access, shortest practical retention, and strong default privacy settings. New or changed features undergo security and privacy reviews; higher-risk changes trigger impact assessments and require approvals before launch. Where minors may use services, defaults are set to maximize privacy and safety.

What we collect, sources, and purposes

We collect only what is necessary for stated purposes:

• Account and contact data (name, email, phone, business address, role): To create/manage accounts, authenticate users, provide support, invoicing, and communications. Basis: contract or consent (where required).
• Transaction and payment data (orders, refunds, disputes, payment tokens via payment providers): To deliver services, manage fraud/chargebacks, and meet financial/tax/AML obligations. Basis: contract and legal obligation.
• Technical and event data (IP, device/browser/OS, event logs, cookies/pixels, language/time zone, session IDs): To secure services, prevent abuse, improve reliability/performance, and run non-essential analytics only with consent where required. Basis: legitimate interests and consent for non-essential cookies/trackers; balancing tests are recorded.
• Merchant customer data: Orders, fulfillment, communications, and related metadata processed on behalf of merchants. Merchant is the Responsible Party; Tanqory is Operator under the DPA and written instructions.
• Special personal information (where applicable): Identity documents, biometrics for verification, limited health or belief data only if strictly necessary and lawful (e.g., explicit consent, legal obligation, protection of life/body, or other POPIA-permitted grounds). Access is restricted, encrypted, and logged.
• Children’s information: Collected only with a lawful basis and parental/competent person consent where required. Defaults are high privacy; behavioural tracking/targeted ads for minors are disabled.

Sources include: direct collection from you (account setup, support, device telemetry you allow), from merchants (order/customer service data), from service providers (payment authorizations, fraud signals, logistics events), and lawful third-party/public sources (e.g., sanctions/PEP lists for AML/CTF/fraud prevention). We avoid over-collection, use anonymization/pseudonymization where feasible (especially in testing/analytics), and validate accuracy for decisions affecting eligibility, security, or risk.

Illustrative purpose mapping

• Service delivery: account creation, authentication, checkout, order fulfillment, shipping updates, invoicing, customer support.
• Security and fraud/abuse prevention: identity/risk checks, sanctions screening, chargeback management, device integrity, anomaly detection.
• Product reliability/improvement: performance analytics, feature testing, error diagnostics, contextual experience tuning (non-essential analytics only with consent where required).
• Legal and compliance: tax/finance recordkeeping, AML/CTF, responding to lawful requests, enforcing terms, defending claims.
• Marketing (optional): product updates and offers with consent/opt-out controls; direct marketing complies with POPIA and ECTA rules.

Lawful bases, consent, and transparency

We rely on appropriate grounds under POPIA (mirroring Section 11 factors): the data subject’s consent; contract performance; compliance with law; protecting legitimate interests of the data subject; performance of a public law duty; and legitimate interests pursued by Tanqory or a third party where compatible with data subject rights. Consent is specific, informed, voluntary, unbundled from non-essential services, and as easy to withdraw as to give. Consent receipts (including withdrawals) are maintained. We avoid consent where another lawful basis is more appropriate. If purposes change materially, we update notices and seek renewed consent where required.

We provide layered notices at or before collection, describing categories of information, purposes, recipients, retention, transfer mechanisms, rights, and how to object/withdraw consent. For higher-risk processing (e.g., profiling/ADM), Statements of Reasons and impact assessments are prepared where required; summaries can be shared under NDA to support customer compliance.

Lawful basis mapping (illustrative)

• Contract: account set-up, checkout, payment processing, shipping, support.
• Legal obligation: tax/finance recordkeeping, AML/CTF, sanctions screening, lawful authority requests.
• Legitimate interests: security monitoring, fraud prevention, service reliability, limited analytics with minimization and opt-outs where required.
• Consent: marketing (where required), non-essential cookies/trackers, special personal information where no other permitted ground applies.
• Vital/public interest: protecting life/health or complying with public-law duties where applicable. Direct marketing complies with POPIA and ECTA; recipients can object at any time.

Your rights

Under POPIA (and PAIA where applicable), you may:

• Access and obtain copies of personal information we hold about you.
• Correct/rectify inaccurate or incomplete information.
• Delete/destroy or de-identify information that is no longer needed for lawful purposes.
• Object to processing based on legitimate interests or for direct marketing; withdraw consent where consent was the basis.
• Request restriction in certain circumstances and request that personal information not be processed for direct marketing.
• Seek not to be subject to decisions based solely on automated processing that significantly affect you, with an opportunity for human intervention.

We aim to respond within a reasonable period (target: within 21 business days) and will inform you if more time is needed for complex requests. Identity verification is required to protect your information. If we decline a request, we explain why, cite any applicable exemption (e.g., legal claims, lawful authority, public interest), and provide complaint routes to the Information Regulator. Requests and outcomes are logged for accountability.

How to exercise your rights

• Email privacy@tanqory.com with “POPIA data rights request” in the subject, include your contact details, the right you are exercising, and information to help locate your data.
• We may request additional verification (e.g., ID confirmation).
• If your data originates from a merchant, we may coordinate with that merchant in line with Responsible Party/Operator roles.
• Responses are provided securely; portability-like requests (where applicable) use structured, commonly used formats.
• For PAIA access requests, we will provide guidance on required forms/fees if applicable.

PAIA access guidance

Where access is requested under PAIA, we will guide you on applicable forms, any prescribed fees, and the process for inspecting or receiving copies. We balance access rights against lawful grounds for refusal (e.g., confidential commercial information, third-party privacy, privilege) and will explain any refusal with reference to PAIA/POPIA.

Complaints to the Information Regulator

If you are dissatisfied with our response, you may lodge a complaint with the Information Regulator (complaints.IR@justice.gov.za, https://www.justice.gov.za/inforeg/). We will cooperate with the Regulator and any relevant lawful instructions.

Special personal information and children

Special personal information (e.g., religious or philosophical beliefs, race/ethnic origin, trade union membership, political persuasion, health/biometrics, criminal behaviour) is processed only when lawful grounds under POPIA apply, such as explicit consent, legal obligations, protecting life/health, medical/healthcare contexts, or non-profit contexts aligned with their purposes. Such data is access-restricted, encrypted, logged, and subject to necessity assessments.

Children’s information (<18) is collected only with consent from a competent person or where another lawful ground under POPIA applies. We use age gates and proportionate age assurance; behavioural tracking and targeted advertising for minors are disabled. Age-restricted content/features are segregated. Guardians can request pause/deletion via simple channels, and actions are auditable. Defaults for minors prioritize privacy (no public sharing) unless a competent person authorizes otherwise.

Automated decision-making (ADM) and profiling

Where ADM or profiling is used (e.g., fraud checks, risk scoring, personalization), we apply human oversight for decisions with legal or similarly significant effects. We provide meaningful information about logic and potential consequences where required and offer opt-out from direct marketing profiling. Models and thresholds are reviewed to reduce bias and unintended impacts; risk-based assessments are conducted for high-risk ADM.

Example controls for ADM

• Human review for adverse decisions (e.g., account/transaction blocks) unless immediate risk requires temporary holds.
• Regular testing for false positives/negatives and bias across relevant user segments.
• Documented escalation/appeal paths for affected users.
• Model/versioning logs and rollback plans for unintended behaviours.

Cookies and similar technologies

We use strictly necessary cookies for core functionality and security. Performance/analytics and marketing cookies/trackers are used only with consent where required. Users can manage preferences via our cookie banner/control centre or browser settings. Our Cookie Policy (https://legal.tanqory.com/legal/platform/cookie-policy) describes categories, purposes, retention, and how to withdraw consent.

Cross-border transfers

When transferring personal information outside South Africa, we ensure either (a) the recipient is subject to a law, binding corporate rules, or binding agreement that provides an adequate level of protection; (b) the data subject consents; (c) the transfer is necessary for contract performance, legal claims, or the interests of the data subject; or (d) other POPIA Section 72 conditions apply. We disclose destinations, recipients, purposes, categories, retention, and rights/choices. Technical and organizational measures include encryption, access controls, logging, and minimization of transferred data. Transfer risk assessments and justifications are recorded, and safeguards are updated as guidance evolves. South Africa-based hosting options may be offered to reduce transfers. Common overseas recipients: cloud/hosting, payment providers, email/communication services, security/fraud detection, analytics; adequacy/risk evaluations and rationale are retained for audit.

Data localization and architecture transparency

Where customers request local storage, we can offer South Africa or regional hosting where feasible. Some platform telemetry may transit other regions for resilience and security monitoring; such flows are covered by transfer safeguards. Architecture and data-flow summaries (under NDA) can be provided to support residency and transfer assessments.

Security and retention

We protect personal information with encryption in transit/at rest (e.g., TLS 1.3/AES-256), RBAC/MFA, segregation of duties, 24x7 monitoring (SIEM/SOC), vulnerability management, and secure development lifecycle. Operators/subprocessors are vetted against standards such as SOC 2, ISO 27001, and PCI DSS (for payments). Personal information is retained only as long as necessary for stated purposes and legal requirements (e.g., tax, finance, accounting) per our retention schedule (https://legal.tanqory.com/legal/data-protection/data-retention-policy); South Africa-specific summaries are available on request. Data is deleted or de-identified when no longer needed, including from backups on scheduled cycles, with deletion logs kept. National ID/passport data (if processed) is restricted, encrypted, and minimized in line with best practices.

Retention illustrations

• Account and billing data: Contract duration plus statutory finance/tax periods.
• Payment/transaction data: Retained per financial/AML obligations and chargeback windows.
• Security logs: Retained for periods necessary to investigate incidents and meet regulatory expectations.
• Marketing consents/suppressions: Retained to demonstrate compliance and honour opt-outs.
• Backups: Purged on rolling cycles with documented timelines.

Breach notification and incident response

If personal information is accessed or acquired without authorization, we will assess promptly, contain and mitigate, and notify customers within 24 hours. We notify the Information Regulator and affected data subjects “as soon as reasonably possible” (targeting within 72 hours of awareness) in line with Section 22. Notifications include incident details, affected data/systems, likely impacts, remediation steps, and guidance to reduce risk. Post-incident reviews are conducted, controls improved, and notification decisions/timing are documented.

Anonymization and pseudonymization

When data is anonymized for analytics or product development, it is rendered non-identifiable and re-identification is prohibited. Pseudonymous data is used internally with mapping kept separately, access-restricted, and not shared externally. If purposes change in a way that affects individuals, notices will be updated.

Data accuracy, fairness, and minimality

We take reasonable steps to keep information accurate and up to date for its intended use, prompt users/merchants to correct inaccuracies, and restrict use of stale data in decisioning. Minimality and fairness are applied across design, collection, storage, and access. We assess fairness when introducing new analytics or ADM to avoid discriminatory outcomes inconsistent with POPIA and Regulator guidance.

Operators (subprocessors) and payments

We use third-party providers (hosting, cloud, security, analytics, payments) under contracts requiring POPIA-equivalent protections and PCI DSS for payment data. Access is limited to need-to-know, and providers are periodically reviewed. For overseas providers, approved transfer mechanisms are applied and consent/notice is provided where required. Current subprocessors: https://legal.tanqory.com/legal/data-protection/subprocessor-list.

Operator instructions and oversight

When Tanqory acts as an Operator, we process personal information only on the Responsible Party’s documented instructions, assist with security, breach notifications, and data subject requests where applicable, and delete/return data at the end of the engagement unless law requires retention. Contracts include confidentiality, technical/organizational measures, audit/inspection rights where appropriate, and flow-down obligations to sub-operators. We maintain records of processing on behalf of Responsible Parties and provide evidence of controls on request (under NDA).

Record-keeping, DPIA, and governance

We maintain Records of Processing Activities for POPIA-covered processing, documenting purposes, categories, recipients, transfers, and retention. Impact assessments are performed for high-risk processing (e.g., large-scale profiling, special personal information, ADM with significant effects); outcomes inform controls and disclosures. Governance assigns owners for key processes; training covers POPIA, security, incident response, and privacy by design. Change management logs material updates to data flows or purposes.

Vendor oversight and audits

Vendors and operators undergo due diligence (security, privacy, compliance, financial stability). Contracts include confidentiality, data protection, breach notification, audit/inspection rights where appropriate, and flow-down obligations. High-risk vendors may require periodic reassessment, certification review, and evidence of control effectiveness.

Marketing and communications

Direct marketing is sent only where lawful. Recipients can object at any time, and opt-out instructions are included in every message. Consent is used where required; soft opt-in is applied only where legally permitted and appropriate. Marketing preferences are honoured promptly, and suppression lists are maintained to enforce opt-outs.

Interaction with other Tanqory terms

This notice supplements the Tanqory Privacy Policy, DPA, Cookie Policy, and service terms. If there is a conflict, the stricter or more specific document or applicable law prevails. Product- or region-specific notices may add complementary requirements.

Updates to this notice

We update this notice when POPIA/Information Regulator guidance or our services change. Material changes will be communicated in advance (e.g., dashboard/email) with version/date and a summary. If you disagree, you may adjust settings or stop using the services. Change history is retained for reference and audit.

Contact

• Privacy: privacy@tanqory.com
• Data Protection Officer: dpo@tanqory.com
• South Africa channel: sa@tanqory.com
• Policy site: https://legal.tanqory.com/

Change history