Privacy Policy

1. Introduction

This Privacy Policy explains how OAR SUM AUTO MERCHANTS CC (Registration No: 2009/197406/23), trading as SurplusStock, collects, uses, shares, and protects your personal information when you use our website at www.surplusstock.co.za ("the Platform").

This policy is drafted in compliance with the Protection of Personal Information Act 4 of 2013 ("POPIA") and the Electronic Communications and Transactions Act 25 of 2002 ("ECT Act").

By using the Platform, you consent to the collection and processing of your personal information as described in this policy. If you do not agree, please discontinue use of the Platform.

2. Information Officer

In terms of POPIA, our designated Information Officer is:

The Information Officer is responsible for ensuring compliance with POPIA, handling data subject requests, and serving as the point of contact for the Information Regulator.

3. Personal Information We Collect

We collect the following categories of personal information:

3.1 Information you provide directly

• Account registration: Full name, email address, phone number, password (hashed)
• Delivery information: Physical address, suburb, city, postal code
• Seller registration: Business name, company registration number, VAT number, bank account details, authorised representative details
• Payment information: Card and banking details are collected by Stitch directly — we do not store card numbers, CVVs, or PINs
• Communications: Messages, offers, support tickets, and feedback submitted through the Platform

3.2 Information collected automatically

• Device and browser information: IP address, browser type, operating system, screen resolution
• Usage data: Pages visited, search queries, products viewed, time spent on pages
• Cookies and local storage: Authentication tokens, cart contents, user preferences (see Section 9)

3.3 Information from third parties

• Stitch: Payment confirmation status, transaction references
• Bob Go: Shipping quotes, tracking status, delivery confirmation

4. Purpose of Collection

We process your personal information for the following lawful purposes as defined in Section 11 of POPIA:

5. Third-Party Data Sharing

We do not sell, rent, or trade your personal information. We share data only with the following third parties, strictly for the purposes described:

• Stitch (Pty) Ltd: Payment processing. Stitch receives your payment and banking details directly via their secure, PCI-DSS compliant checkout. We receive only transaction status confirmations.
  Privacy Policy: stitch.money/legal/privacy
• Bob Go (Pty) Ltd: Shipping and logistics. We share your delivery address, phone number, and parcel details to generate shipping quotes and arrange delivery.
  Privacy Policy: bobgo.co.za/privacy
• Supabase Inc: Database hosting and user authentication. Your account data and transaction records are stored on Supabase infrastructure in the EU (Ireland region).
  Privacy Policy: supabase.com/privacy
• Netlify Inc: Website hosting and serverless function execution.
• Cloudflare Inc: Content delivery, DDoS protection, and DNS services.
• Sellers/Buyers: After payment confirmation, buyer delivery details are shared with the seller to enable fulfilment. Seller business details are shared with the buyer for order tracking and communication purposes.
• Legal authorities: We may disclose personal information if required by law, court order, or regulation, or to protect the rights, safety, and property of SurplusStock, its users, or the public.

6. International Data Transfers

To provide our services, your personal data may be transferred to and processed by service providers located outside of South Africa:

• Supabase — EU (Ireland)
• Netlify — United States and global CDN
• Cloudflare — Global network (nearest point of presence)
• Stitch — South Africa

In accordance with Section 72 of POPIA, these transfers are subject to appropriate safeguards including contractual data protection agreements, encryption in transit (TLS 1.2+), and encryption at rest. Recipients are bound to process data only for the purposes specified and to maintain equivalent levels of data protection.

7. Seller Anonymity

Sellers are displayed anonymously to buyers (e.g., "Verified Seller - PE") until a transaction is completed and payment confirmed. This protects seller business information from price-shopping, competitive intelligence, and unwanted direct solicitation. After payment confirmation, the buyer receives only the information necessary for delivery and communication about the specific order.

8. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

• Active accounts: Data is retained for the duration of your account plus 12 months after closure.
• Transaction records: Retained for 5 years from the date of the transaction, as required by the Tax Administration Act and Companies Act.
• Invoices and financial records: Retained for 5 years as per SARS requirements.
• Dispute records: Retained for 3 years after resolution.
• Marketing communications: Until you unsubscribe or withdraw consent.
• Server logs: Automatically purged after 90 days.

After the retention period, data is securely deleted or anonymised so that it can no longer identify you.

9. Cookies & Local Storage

The Platform uses cookies and browser local storage for the following purposes:

9.1 Essential cookies (strictly necessary)

• Authentication: Session tokens to keep you logged in securely
• Cart: Shopping cart contents stored in local storage
• Security: CSRF protection and request validation

9.2 Functional cookies

• Preferences: Theme selection (light/dark mode), language settings
• Recent activity: Recently viewed products, search history

We do not use third-party advertising or tracking cookies. We do not serve targeted advertisements.

You can manage cookies through your browser settings. Disabling essential cookies may affect Platform functionality (e.g., you may not be able to remain logged in or maintain a shopping cart).

10. Your Rights Under POPIA

As a data subject under the Protection of Personal Information Act, you have the following rights:

• Right to access (Section 23): You may request confirmation of whether we hold personal information about you and request a copy of such information.
• Right to correction (Section 24): You may request correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully.
• Right to deletion (Section 24): You may request the destruction or deletion of personal information that we are no longer authorised to retain, subject to legal retention requirements.
• Right to object (Section 11(3)(a)): You may object to the processing of your personal information on reasonable grounds relating to your particular situation, unless legislation provides for such processing.
• Right to withdraw consent: Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
• Right not to be subject to automated decision-making (Section 71): You have the right not to be subject to a decision based solely on automated processing that produces legal effects or significantly affects you.
• Right to lodge a complaint: You may lodge a complaint with the Information Regulator (see Section 12 below).

To exercise any of these rights, please contact our Information Officer at support@surplusstock.co.za. We will respond to your request within 30 days as required by POPIA. We may request proof of identity before processing your request.

11. Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, destruction, or alteration:

• All data transmitted between your browser and our servers is encrypted using HTTPS (TLS 1.2+).
• Passwords are hashed using industry-standard algorithms — we never store plaintext passwords.
• Database access is protected by Row Level Security (RLS) policies, ensuring users can only access their own data.
• Payment data is handled exclusively by Stitch's PCI-DSS certified infrastructure.
• Administrative access is restricted and requires multi-factor authentication.
• We conduct regular security reviews and monitor for suspicious activity.

While we take all reasonable precautions, no system is 100% secure. We encourage you to use a strong, unique password and to notify us immediately if you suspect any security breach.

12. Complaints & The Information Regulator

If you believe your personal information has been processed in violation of POPIA, you have the right to lodge a complaint with the Information Regulator of South Africa:

We encourage you to contact us first at support@surplusstock.co.za so that we may attempt to resolve your concern before escalation.

13. Children's Privacy

The Platform is not intended for use by persons under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal information from a child under 18, we will take immediate steps to delete such information. If you believe a child has provided us with personal information, please contact us at support@surplusstock.co.za.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations. Material changes will be communicated via:

• Email notification to registered users
• A prominent notice on the Platform

The "Last updated" date at the top of this policy indicates the most recent revision. We encourage you to review this policy periodically. Continued use of the Platform after changes constitutes acceptance of the updated policy.

15. Contact Us

For any privacy-related questions, concerns, or to exercise your data subject rights, please contact us: