Privacy Policy

The Brand Market ("Brand Market", "we", "us") is a South African online marketplace based in Durban, KwaZulu-Natal, owned and run by Andile Owen Xulu. We are the "responsible party" for your personal information under the Protection of Personal Information Act 4 of 2013 (POPIA). This policy applies to our website brandmarket.co.za and our Android app.

By using Brand Market you agree to this policy. If you do not agree, please do not use our services.

Information you give us

• Account details: name, email address, mobile number and password (stored only as a secure hash).
• Delivery details: delivery address, PUDO/PAXI collection point and contact details for couriers.
• Order details: products bought, artwork or customisation choices, amounts paid and order history.
• Seller details (sellers only): shop name, legal name, ID or company number, VAT status and banking details for payouts.
• Messages you send us, safety reports and account deletion requests.

Information collected automatically

• Device and browser type, IP address, pages visited and time of visit.
• Small files stored on your device (cookies and local storage) to keep you signed in and remember your cart.

We do not knowingly collect information from children under 18. Children may only use Brand Market with a parent or guardian's consent.

Payments are processed by Ozow (Pty) Ltd, a regulated South African payment provider. You enter your bank login or payment details directly with Ozow or your bank — Brand Market never sees or stores your bank password, card number or PIN. We only receive the payment reference (starting with "BM"), amount and status.

• To create and manage your account (performance of a contract).
• To process payments, deliver orders and handle returns or refunds (performance of a contract).
• To send you order and account notifications (performance of a contract).
• To pay sellers and keep financial and tax records (legal obligation).
• To prevent fraud, protect safety and secure our platform (legitimate interest).
• To improve our website and app (legitimate interest).
• To send marketing messages — only if you have agreed, and you can opt out at any time (consent).

We share only what is needed, and we never sell your personal information.

• Sellers: your name, delivery details and order contents so they can pack and send your order.
• Couriers: PUDO, PAXI or our local riders receive your name, phone number and delivery address.
• Ozow: to process your payment.
• Service providers: secure cloud hosting and database providers who store data on our behalf under confidentiality agreements.
• Authorities: when required by law, court order, SARS or to prevent fraud or harm.

Some of our hosting providers may store data outside South Africa. Where this happens we make sure the country or provider gives protection similar to POPIA, as required by section 72 of POPIA.

Data is sent over encrypted connections (HTTPS) and stored with access controls so staff only see what their role needs. Seller banking details are masked by default and every access is logged. No system is 100% secure; if a breach affects you, we will notify you and the Information Regulator as POPIA requires.

• Account information: while your account is active.
• Orders, invoices and payment records: 5 years, as required by the Tax Administration Act and Companies Act.
• Security and audit logs: up to 2 years.

When information is no longer needed, we delete it or make it anonymous.

Under POPIA you have the right to:

• Ask what personal information we hold about you and get a copy.
• Ask us to correct or update inaccurate information.
• Ask us to delete your information or close your account.
• Object to us using your information, including for marketing.
• Withdraw consent you have given at any time.
• Complain to the Information Regulator.

You can request account deletion on our account deletion page or by emailing us. We respond to requests within 30 days.

We may update this policy from time to time. The "Last updated" date at the top shows the latest version. Significant changes will be announced on our website or app.

Information Officer: Andile Owen Xulu, The Brand Market, Durban, KwaZulu-Natal, South Africa.
Email: support@brandmarket.co.za

Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 · complaints.IR@inforegulator.org.za · inforegulator.org.za