Privacy Policy

Responsible party: OnePart (Artomotiv Media (Pty) Ltd). Our Information Officer can be reached at popia@onepart.co.za.

What we collect: account info, ID type and number, ID document image, selfie (biometric — special personal information under POPIA s26), contact details, location (province, city, suburb), listings, messages, transaction and payment metadata, device and usage data, and cookies.

Why we collect it: to create your account, verify your identity, prevent fraud and trade in stolen goods, facilitate transactions and payments, ensure safety, comply with legal obligations, send service communications, and — only with your consent — marketing.

Lawful basis: your express consent (captured at signup), our legitimate interest in fraud prevention, and legal obligations.

Special personal information (biometric/selfie): collected ONLY for identity verification, stored encrypted in a private bucket, access strictly limited to authorised staff, and deleted after our defined retention period.

How we protect it: encryption at rest, private storage, signed-URL access, role-based access controls, one-way hashing of ID numbers, and staff access limits.

Sharing: with our KYC verification provider, our regulated payment partner, couriers (for delivery), and law-enforcement on lawful request. We do NOT sell your personal information.

Cross-border: data is hosted on Supabase infrastructure. Where data leaves South Africa, we rely on the POPIA Section 72 safeguards.

Retention: KYC documents are kept for the period required to combat fraud and meet legal obligations, then deleted. Transaction records are kept as required by law.

Your rights (POPIA s5): access, correction, deletion, objection, withdrawal of consent, and the right to complain to the Information Regulator at https://inforegulator.org.za. To exercise your rights, email privacy@onepart.co.za.

Cookies: see our Cookie Notice.