Privacy policy
This explains what kwamaj collects about you, why, who else sees it and how long we keep it. It is written to meet the Protection of Personal Information Act 4 of 2013 (POPIA).
Draft — not yet reviewed by counsel.
This document is incomplete: passages marked in square brackets are facts the platform has not yet supplied, or questions that need a South African lawyer to answer. It is published here so it can be reviewed, not so it can be relied on.
Who is responsible
kwamaj (registration number 2026/866439/07), trading as kwamaj, of 18 St James Street, Westdene, Johannesburg, 2019, is the responsible party for the personal information described here.
Our Information Officer is Othembele, reachable at info@kwamaj.shop. You may complain to us first, and to the Information Regulator if we do not resolve it: complaints.IR@justice.gov.za.
What we collect, and why
If you buy from us: your name, email address, phone number and delivery address, so we can take payment and get the item to you. Your order history, because we are the merchant of record and have to account for every sale. The IMEI and serial number of any device you buy, so we can prove it was checked against the national blacklist before it was sold to you.
If you sell through us: your SA ID number, date of birth, bank account details and a photograph of your face, because we may not pay money to somebody we have not identified. Proof of address, a tax reference and, where applicable, second-hand goods dealer registration.
Everyone: the pages you visit and the actions you take, kept in an audit log so we can investigate fraud against you or against us.
We do not sell your personal information, and we do not use it to make automated decisions with legal consequences for you.
Who else sees it
We share only what each of these needs to do its job. Sellers never receive your identity: they are given a delivery address and nothing else, and you are never told which seller supplied your item, because we are the merchant of record on every order.
| Who | What for | What they get |
|---|---|---|
| Datanamix / pbVerify | Verifying a seller's identity against Home Affairs and their bank account | ID number, names, date of birth, bank account details, selfie |
| Stitch | Card, Apple Pay, Google Pay and instant EFT payments | Name, email address, order amount, payment instrument details |
| Paystack | Payouts to sellers | Seller name and bank account details |
| PayJustNow | Buy-now-pay-later instalments | Email address, order amount, line items |
| Happy Pay | Buy-now-pay-later instalments | Email address, order amount, line items |
| Bob Go | Courier collection, delivery and tracking | Recipient name, delivery address, phone number |
| Resend | Transactional email — order, dispatch, delivery and case notifications | Email address, order details |
| Supabase | Database, authentication and file storage for the whole platform | Everything described in this policy |
How long we keep it
POPIA says we may not keep personal information longer than the purpose requires. Our retention schedule is published in this policy once the periods are settled; the platform enforces them on a nightly job rather than leaving them as an aspiration.
[to be confirmed by counsel] — the periods for identity documents, device evidence, IMEI records and audit data are being determined against FICA's record-keeping duties and POPIA's minimisation principle.
Some records outlive the schedule by necessity: an invoice we are required to keep, and the IMEI of a handset reported stolen.
Your rights
You may ask what we hold about you, ask us to correct it, and ask us to delete it. Do that from your account, under Privacy — the request is tracked and a person answers it within 30 days.
Deletion is not always total. Invoices, payment records and ledger entries are kept for the period the law requires; where we cannot delete, we anonymise, and we tell you exactly what was kept and why.
Where your information goes
Some of the services above process data outside South Africa. Where that happens we rely on section 72 of POPIA, and we contract for protection substantially similar to what POPIA requires. [to be confirmed by counsel] — the specific hosting regions and transfer mechanisms are being confirmed.
Cookies
We set one cookie, and it is the one that keeps you signed in. We run no advertising trackers and no third-party analytics, which is why you are not being asked to consent to any — a consent banner for cookies nobody sets is theatre, not compliance.
If that changes, we will ask before setting anything non-essential.
Questions about this page go to info@kwamaj.shop.