Privacy Policy

1. Who we are

Indabazi ("Indabazi", "we", "us", "our") operates the hyperlocal community-commerce platform available at indabazi.co.za and through our mobile applications (the "Platform").

We are based in Johannesburg, South Africa, South Africa, and we are the responsible party (data controller) for the personal information described in this policy, as defined in the Protection of Personal Information Act 4 of 2013 ("POPIA").

2. Information Officer

Our Information Officer is registered with the Information Regulator of South Africa and is responsible for ensuring compliance with POPIA.

• Information Officer: The Indabazi Information Officer
• Email: hello@indabazi.co.za
• Phone: +27 10 000 0000
• Address: Johannesburg, South Africa, South Africa

You may contact the Information Officer at any time to exercise your rights, ask questions about this policy, or lodge a complaint.

3. Scope of this policy

This policy applies to all personal information we process when you:

• visit or browse the Platform;
• create an account, verify your identity, or list an item;
• submit a contact form, register interest, or apply to become a Champion;
• subscribe to our newsletter or other communications;
• communicate with us by email, phone, or in-app chat; or
• interact with our advertising, social media, or third-party integrations.

It does not apply to third-party websites, apps, or services linked from the Platform, which have their own privacy policies.

4. Information we collect

We collect the following categories of personal information:

4.1 Information you give us

• Identity data: full name, date of birth, South African ID number (or equivalent), profile photograph.
• Contact data: mobile number, email address, neighbourhood / area, and (where you provide it) a physical address or collection point.
• Account data: username, password (stored in hashed form), verification status, vouches, ratings, and transaction history.
• Listing content: photographs, descriptions, prices, and location data attached to items you list.
• Communications: messages you send us or other users via in-app chat, contact forms, or email.
• Champion application data: information you provide when applying to become a Khaya Champion, including your motivation and community involvement.

4.2 Information we collect automatically

• Device & technical data: IP address, browser type and version, operating system, device type, and screen size.
• Usage data: pages viewed, links clicked, search terms, features used, and time spent on the Platform.
• Location data: approximate location derived from your IP address, and — where you grant permission — precise device location used solely to match you with your Indabazi.
• Cookie & tracking data: as described in section 8 below.

4.3 Information we receive from third parties

• Identity-verification providers: confirmation that your ID number and mobile number are valid and belong to you.
• Payment infrastructure partners: confirmation that a PayShap, EFT, or QR payment has settled (we do not receive or store your full banking credentials).
• Authentication providers: if you sign in with a third-party service, the basic profile data that service shares with us.

5. How we collect it

We collect personal information:

• directly from you, when you register, list, transact, or contact us;
• automatically, when you use the Platform (see section 4.2);
• from verification and payment partners (see section 4.3); and
• from public sources where necessary to prevent fraud.

Where we are required to collect information by law, or where it is necessary for us to provide a service you have requested, we will make this clear at the point of collection.

6. Why we process it (lawful basis)

Under POPIA we must have a lawful basis for processing your personal information. We rely on the following bases:

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. Where we rely on legitimate interest, we have conducted a balancing assessment and concluded that our interest does not override your rights and freedoms.

7. Special personal information

We do not intentionally collect special personal information (such as race, health, religious belief, political persuasion, trade-union membership, sexual orientation, or biometric data), except where it is strictly necessary to:

• comply with a legal obligation; or
• establish, exercise, or defend a legal claim.

If we ever need to process special personal information for another reason, we will obtain your explicit consent first, or rely on an authorisation under section 27 of POPIA.

8. Cookies & similar technologies

We use cookies and similar technologies (such as local storage and pixel tags) to operate the Platform and improve your experience. Cookies fall into four categories:

• Strictly necessary: required for the Platform to function (login sessions, CSRF protection, load balancing). These cannot be disabled.
• Functional: remember your preferences (language, region, display settings).
• Analytics: help us understand how the Platform is used (see section 9).
• Advertising: used to serve relevant ads and measure their performance (see section 9).

Where required by law, we will ask for your consent before setting non-essential cookies. You can change or withdraw your cookie preferences at any time via our Cookie Notice or your browser settings. Disabling strictly necessary cookies may prevent the Platform from working correctly.

9. Google Analytics, AdSense & advertising

We use Google Analytics to understand how visitors use the Platform, and Google AdSense to display advertising that helps keep the Platform free. These services are provided by Google LLC and its affiliates.

Google may collect information such as your IP address, device identifiers, browser type, pages visited, and interactions with ads. This information is used to:

• produce aggregated analytics reports for us;
• serve ads that are more relevant to you; and
• measure the effectiveness of advertising campaigns.

Google may use cookies — including the DoubleClick DART cookie — to serve ads based on your prior visits to this and other websites. You can opt out of personalised advertising by visiting Google Ads Settings, or opt out of third-party vendor cookies by visiting aboutads.info.

For more information, see Google's Privacy Policy and How Google uses information from sites that use its services.

10. Sharing with third parties

We do not sell your personal information. We share it only with the following categories of recipients, and only to the extent necessary:

• Other users: your public profile (first name, area, rating, vouches, and active listings) is visible to other members of your Indabazi. Your email address, phone number, and ID number are never shown publicly.
• Identity-verification providers: to confirm your identity and mobile number.
• Payment infrastructure partners: to confirm that payments have settled.
• Cloud hosting & infrastructure providers: who host the Platform on our behalf under strict data-processing agreements.
• Analytics & advertising partners: including Google (see section 9).
• Professional advisers: lawyers, auditors, and insurers, where necessary.
• Law enforcement and regulators: where we are required to do so by law, court order, or a lawful request from a competent authority.
• Successors in title: in the event of a merger, acquisition, or sale of assets, subject to the successor honouring this policy.

11. Cross-border transfers

Some of our service providers (including Google and certain cloud-hosting providers) process data outside South Africa. Where we transfer personal information across borders, we do so in accordance with section 72 of POPIA, ensuring that the recipient is subject to laws or binding agreements that provide an adequate level of protection substantially similar to POPIA.

12. Data retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Indicative retention periods:

When retention periods end, we securely delete or irreversibly anonymise the data.

13. Security

We take the security of your personal information seriously. Our safeguards include:

• encryption of data in transit (HTTPS/TLS) and at rest;
• hashed and salted storage of passwords;
• CSRF protection and rate-limiting on all forms;
• role-based access controls and least-privilege principles;
• regular security reviews and dependency updates; and
• staff and contractor confidentiality obligations.

No system is perfectly secure. If we become aware of a security compromise that affects your personal information, we will notify you and the Information Regulator as required by section 22 of POPIA.

14. Your rights under POPIA

As a data subject under POPIA, you have the right to:

• Be notified that we collect your personal information, and why.
• Access the personal information we hold about you.
• Request correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained.
• Object to processing on reasonable grounds.
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with the Information Regulator (see section 18).
• Not be subject to a decision based solely on automated processing that significantly affects you, without human intervention.

To exercise any of these rights, email hello@indabazi.co.za. We will respond within 30 days. We may ask you to verify your identity before actioning a request, to protect your data from unauthorised access.

Exercising your rights is free of charge, except where a request is manifestly unfounded or excessive, in which case we may charge a reasonable administrative fee or refuse the request.

15. Direct marketing

We will only send you marketing communications (such as our monthly newsletter) if you have opted in, or where you are an existing customer and the communication relates to similar products or services, in line with section 69 of POPIA and section 11 of the CPA.

Every marketing email we send contains a one-click unsubscribe link. You can also unsubscribe at any time by emailing hello@indabazi.co.za. Unsubscribing from marketing does not affect service and transactional communications (such as verification PINs or transaction confirmations), which we are required to send.

16. Children

The Platform is intended for users aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at hello@indabazi.co.za and we will delete it promptly.

17. Changes to this policy

We may update this policy from time to time to reflect changes in our practices, technology, or the law. If we make material changes, we will notify you by email or by a prominent notice on the Platform at least 14 days before the changes take effect.

The "Last updated" date at the top of this page reflects the most recent revision.

18. Complaints

If you believe we have breached POPIA, please contact our Information Officer first at hello@indabazi.co.za so that we can try to resolve the matter directly.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Regulator of South Africa:

• Website: inforegulator.org.za
• Email: complaints.IR@justice.gov.za
• Phone: 010 023 5200
• Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

19. Contact us

For any question about this policy or your personal information:

• Email: hello@indabazi.co.za
• Phone: +27 10 000 0000
• Based in: Johannesburg, South Africa, South Africa

See also: Terms of Service · Cookie Notice · Contact