Version 1.0 · Last updated: 5 July 2026 · Responsible Party: Charmaine Swinburn trading as EquiCloset · [email protected]
Also available: United Kingdom Privacy Notice (UK GDPR)
1. Who We Are
EquiCloset is operated by Charmaine Swinburn trading as EquiCloset (“we”, “us”, “our”). We are the Responsible Party for personal information collected through the Platform in South Africa, as defined in POPIA.
Information Officer contact: [email protected]
2. What Personal Information We Collect
| Category | Examples | When collected |
|---|---|---|
| Account information | Name, email address, username, password (hashed) | Registration |
| Profile information | Profile photo, bio, location (province/region), seller settings | Profile setup |
| Listing information | Item title, description, photos, price, category | When you list an item |
| Transaction information | Order details, item price, delivery charge, payment status, escrow status | When you buy or sell |
| Payment information (buyers) | Payment method type (held by Peach Payments — we do not store full card details) | At checkout |
| Bank account information (sellers) | Account holder name, bank name, branch code, account number, account type — stored by EquiCloset to send payout by EFT | When you add payout details |
| Communications | Messages sent between buyers and sellers via the Platform | When you use in-app messaging |
| Device & usage information | IP address, browser type, pages visited, session duration | Automatically on each visit |
| Identity verification information | Identity documents (held by Peach Payments for FICA compliance where required for buyer payments) | When required |
3. Purpose of Processing (Section 13, POPIA)
| Purpose | Lawful basis (POPIA) |
|---|---|
| Creating and managing your account | Performance of a contract (s13(1)(b)) |
| Processing payments and managing escrow | Performance of a contract (s13(1)(b)) |
| Facilitating transactions between buyers and sellers | Performance of a contract (s13(1)(b)) |
| Handling disputes and buyer protection claims | Performance of a contract / Legitimate interests (s13(1)(b)(f)) |
| Preventing fraud and complying with legal obligations | Legal obligation / Legitimate interests (s13(1)(c)(f)) |
| Sending transactional communications | Performance of a contract (s13(1)(b)) |
| Improving the Platform | Legitimate interests (s13(1)(f)) |
We do not share your personal information with third parties for their marketing purposes, and we do not sell your data.
4. Who We Share Your Information With
| Recipient | Purpose | Location |
|---|---|---|
| Peach Payments | Payment processing, escrow, seller FICA verification | South Africa |
| Cloudflare | Content delivery and media storage | Global CDN (adequacy safeguards in place) |
| Render | Cloud hosting (servers and database) | EEA |
| Courier providers | Parcel delivery (tracking number only) | South Africa |
| Law enforcement / regulators | When required by law or court order | South Africa |
Where personal information is transferred outside South Africa, we ensure that an equivalent level of protection is maintained as required by POPIA section 72.
5. Cookies
We use only essential cookies needed to operate the Platform (session management, CSRF protection). We do not use advertising or analytics cookies. See our Cookie Policy for details.
6. How Long We Retain Your Information
| Information type | Retention period |
|---|---|
| Account information | For the duration of your account, plus 2 years after closure |
| Transaction and financial records | 5 years (South African tax and accounting requirements) |
| Messages | 2 years from the date of the message |
| Device & usage logs | 90 days |
7. Your Rights Under POPIA
You have the following rights regarding your personal information:
- Right of access (s23) — request details of the personal information we hold about you
- Right to correction or deletion (s24) — ask us to correct inaccurate information or delete information we are not entitled to hold
- Right to object (s11(3)) — object to our processing of your information on grounds relating to your particular situation
- Right to submit a complaint — lodge a complaint with the Information Regulator
To exercise any of these rights, email our Information Officer at [email protected]. We will respond within 30 days.
8. Security Safeguards (Section 19, POPIA)
We implement appropriate technical and organisational safeguards to protect your personal information from loss, damage, or unauthorised access, including: encrypted data storage and transmission; access controls and authentication; regular security reviews. In the event of a data breach, we will notify the Information Regulator and affected data subjects as required by POPIA section 22.
9. Complaints and the Information Regulator
If you are unhappy with how we handle your personal information, please contact us first at [email protected]. You also have the right to lodge a complaint with the Information Regulator of South Africa:
The Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Email: [email protected]
10. Changes to This Notice
We may update this Privacy Notice from time to time. We will notify you of material changes by email or via a Platform notice. The latest version is always available on this page.
