This notice explains how ShopLink SA (Pty) Ltd (“ShopLink SA”) uses personal information, as required by the Protection of Personal Information Act, 2013 (POPIA). Our Information Officer is Chris Mhlongo, reachable at privacy@shoplinksa.co.za, 915 phumulani createst street.
1. Who is responsible
- Seller accounts and the platform: ShopLink SA is the responsible party.
- Customers' orders: the seller you buy from is the responsible party for your order details; ShopLink SA processes them on the seller's behalf (as an operator) to run the store, take payment and deliver. ShopLink SA is also responsible party for customer accounts, security and fraud prevention.
2. What we collect and why
- Account details (name, email, phone, password stored only as a secure scrambled hash, two-step sign-in data) — to give you an account and keep it secure.
- Seller business details (business name, address, VAT and registration numbers, PayFast account details stored encrypted) — to run the store, bill the subscription and print invoices.
- Order details (name, email, cellphone, delivery address, map pin and driver directions if you give them, PAXI point, items, notes) — to fulfil the order, send updates and keep the records the law requires.
- Payments — handled by PayFast. We never see or store card numbers; we keep payment references and amounts.
- Reviews and support messages you send us.
- Technical data — sign-in times and IP addresses for security, and counts of store visits without cookies or tracking.
We rely on these lawful grounds: carrying out a contract with you (your account or order), legal obligations (tax and consumer law records), legitimate interests (security, fraud prevention, improving the service), and your consent for marketing — which you can withdraw at any time.
3. Who we share it with
- The seller you order from (they need your details to send the order).
- PayFast (payments), couriers and PAXI (delivery, if the seller uses them), our email provider, Google Maps (address search, only if you use it), our hosting, database and file-storage providers, and error-monitoring (with personal details removed).
- Authorities, where the law requires it.
Some of these providers store data outside South Africa (for example in the European Union or the United States). We only use providers bound by agreements or laws that protect personal information to a standard similar to POPIA (section 72).
We never sell personal information.
4. How long we keep it
- Paid orders, invoices and credit notes: 5 years (Tax Administration Act).
- Orders that were never paid: customer details removed after 90 days.
- Sign-in sessions and email links: deleted 30 days after they expire. Email delivery logs: 1 year. Store-visit counts: about 13 months.
- Closed accounts: login details removed straight away; records we must keep are kept for the legal period only.
5. Your rights
You may ask what information we hold about you and get a copy (in your account: Download my data), ask us to correct or delete it (Delete my account / Close my store), object to processing, and withdraw marketing consent. Email privacy@shoplinksa.co.za for anything else. We respond within 30 days.
If you're unhappy with how we handle your information you may complain to the Information Regulator (South Africa): inforegulator.org.za (complaints are lodged on its eService portal), enquiries@inforegulator.org.za.
6. Security and cookies
Data is encrypted in transit; payment and two-step secrets are also encrypted at rest. Each seller can only access their own data, enforced by the database itself. We use only essential cookies (to keep you signed in) and your browser's storage for your shopping cart. No advertising or tracking cookies.