Privacy Policy
Last updated: 2026. This policy explains what SafeList (Pty) Ltd ("SafeList", "we", "us") collects about you, why, and how you can control it, in line with South Africa's Protection of Personal Information Act 4 of 2013 ("POPIA").
1. Who we are
SafeList (Pty) Ltd is the "responsible party" under POPIA for the personal information described in this policy. Questions or requests about your personal information can be sent to our Information Officer at support@safelist.co.za.
2. What we collect
When you create an account, we collect your name, email address, and (optionally) phone number. If you sell on SafeList, seller onboarding collects the additional identity/business details TradeSafe requires to register you as a party on an escrow transaction. If you complete identity verification (KYC), we collect and securely store the ID document and proof-of-address image you upload, and their review status. If you register as an Agent (our referral program), we collect the same account details plus your referral relationships and sales-commission figures. Using the marketplace also creates Listings, Orders, messages, offers, reviews, saved searches, and support tickets (including any file you attach to one) tied to your account. If you boost a listing, we retain a record of the boost purchase (package, amount, and PayFast's own payment reference) - never your card or bank details themselves, see clause 4.
3. Why we collect it, and our lawful basis
We process this information because it is necessary to perform our contract with you (running your account, publishing your Listings, facilitating a purchase), to comply with a legal obligation (identity verification for escrow transactions), or because you've consented to it (e.g. opting into a saved-search alert email). We do not use your personal information for automated decision-making that produces legal or similarly significant effects about you, and we do not sell your personal information to third parties.
4. Payment and banking data - handled by TradeSafe and PayFast, not us
SafeList never collects, stores, or has access to your bank account details or card details. Escrow payment processing for a purchase is handled directly by TradeSafe, an independent, licensed escrow provider - see our Terms for what that means for your transactions. Any bank account details you provide during seller onboarding are sent straight to TradeSafe and are never written to SafeList's own database. A "Boost this listing" payment is handled directly by PayFast (Pty) Ltd, an independent South African payment gateway - the same applies: your card/EFT details go straight to PayFast, and SafeList only ever retains the fact that a payment was made, its reference number, and its status.
5. Who else we share information with
Beyond TradeSafe and PayFast (above), we share information with: the SMTP provider we use to send account, order, and notification emails; and, where legally required, a regulator or law-enforcement body. A buyer and seller matched on an Order can see each other's name, alias/rating history, and delivery details needed to complete that specific transaction. We do not share your personal information with advertisers.
6. How long we keep your data
If you delete your account, it's locked immediately and permanently removed (or anonymized, if it's tied to order/listing history that has to stay intact for the other party's records, or to a completed escrow transaction we're required to keep a record of) 30 days later - see Manage > Delete Personal Data for that flow. You can also download a copy of your personal data at any time from Manage > Personal Data.
7. Security
We apply reasonable technical and organisational measures to protect your personal information against loss, unauthorised access, and disclosure, appropriate to the sensitivity of the data involved (KYC documents and support-ticket attachments, in particular, are stored in access-controlled storage separate from the general application database). No system is completely secure; if you believe your account has been compromised, contact us immediately.
8. Cookies
SafeList uses a small number of essential cookies: your sign-in session, and a preference cookie that remembers your chosen site theme (rose/teal) so emails we send you match it. We don't use advertising or cross-site tracking cookies.
9. Children
SafeList is not directed at children and accounts may only be created by someone old enough to enter into a binding contract under South African law. If we become aware that we've collected personal information from a child without the consent required by POPIA, we will delete it.
10. Your rights under POPIA
You have the right to: access the personal information we hold about you; request that it be corrected or deleted; object to our processing of it on reasonable grounds; and withdraw any consent you've given, at any time. You can exercise most of these directly from your account's Manage pages (clause 6); for anything else, contact support@safelist.co.za.
11. Changes to this policy
We may update this policy from time to time; material changes will be flagged on this page.
12. Contact
Questions about this policy or your data: support@safelist.co.za.
This page is a starting draft consistent with how SafeList's data flows actually work. It has not been reviewed by a South African attorney and should be before it is relied on - in particular, a lawyer should confirm SafeList's Information Officer has been formally registered with the Information Regulator as POPIA requires, and review the lawful-basis analysis in clause 3 against your actual consent/contract flows before launch.