Privacy Policy — YouCommerce

YouCommerce is committed to protecting your personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA). This policy explains what information we collect, why we collect it, and how we use and protect it.

1. Who We Are

Responsible Party: YouCommerce (Pty) Ltd
Registration Number: 2026/507600/07
Address: 81 Steenoven Street, Bothasig, Cape Town, Western Cape, 7441
Email: hello@youcommerce.co.za

As a responsible party under POPIA, YouCommerce determines the purpose and means of processing personal information. Where we process personal information on behalf of Merchants (for example, Customer data collected through a Merchant's store), we act as an operator.

2. What Information We Collect

2.1 Merchant information

When you sign up as a Merchant, we collect:

Name and contact details (email address, phone number)
Business name, address, and registration details
Billing information (processed securely by our payment provider — we do not store card details)
Login credentials (passwords are hashed and never stored in plain text)
Communications with our support team

2.2 Customer information (collected through Merchant stores)

When a Customer places an order or makes an enquiry through a Merchant's YouCommerce store, we may process on behalf of the Merchant:

Name and contact details
Delivery address
Order history and transaction records

The Merchant is the responsible party for this data. Customers should refer to the relevant Merchant's privacy policy for information on how their data is used.

2.3 Website visitor information

IP address and browser type (for security and analytics)
Pages visited and time spent (via anonymous analytics)

3. Why We Collect It — Purpose of Processing

Information	Purpose	Legal basis (POPIA)
Merchant contact details	Account management, support, billing communications	Contract performance
Billing information	Processing subscription payments	Contract performance
Business details	Onboarding, compliance verification	Contract performance / legal obligation
Customer order data	Processing orders on behalf of the Merchant	Operator processing under Merchant instruction
Website analytics	Improving the platform and marketing	Legitimate interest
Support communications	Resolving queries and improving service	Legitimate interest / contract performance

We will not process your personal information for any purpose other than those listed above without your consent or a lawful basis under POPIA.

4. How We Store and Protect Your Information

All data is stored on servers located within the European Economic Area (EEA), which the South African Information Regulator has recognised as providing an adequate level of protection equivalent to POPIA.

We implement the following safeguards:

All data in transit is encrypted using TLS.
Passwords are hashed using industry-standard algorithms and never stored in plain text.
Access to personal information is restricted to personnel who need it to perform their duties.
Database access is protected by row-level security policies.
We do not store cardholder data — card payments are processed directly by our PCI-DSS compliant payment provider.

5. Who We Share Information With

We do not sell personal information. We share information only with the following categories of third parties where necessary to provide the service:

Payment gateway provider — to process subscription and transaction payments.
Email service provider — to send transactional and account emails (Brevo).
Hosting and infrastructure providers — Supabase (database and storage), Cloudflare (DNS and CDN), Netlify (website hosting).

All third-party providers are contractually required to process personal information only as instructed and in accordance with applicable data protection laws.

6. Retention of Personal Information

We retain personal information for as long as necessary to fulfil the purposes set out in this policy, or as required by law. Specifically:

Merchant account data is retained for the duration of the subscription and deleted within 90 days of account closure, unless a longer retention period is required by law.
Transaction records are retained for 5 years to comply with tax and financial record-keeping obligations.
Support communications are retained for 2 years.

7. Your Rights Under POPIA

As a data subject, you have the right to:

Access — request a copy of the personal information we hold about you.
Correction — request correction of inaccurate or incomplete information.
Deletion — request deletion of your personal information where we no longer have a lawful basis to retain it.
Objection — object to processing based on legitimate interest.
Complaint — lodge a complaint with the Information Regulator of South Africa.

To exercise any of these rights, email us at hello@youcommerce.co.za. We will respond within 30 days.

To contact the Information Regulator: www.justice.gov.za/inforeg

8. Cookies

Our website uses minimal cookies necessary for the site to function. We do not use tracking or advertising cookies. Anonymous analytics data may be collected to help us understand how visitors use the site.

9. Children's Privacy

The YouCommerce platform is not directed at children under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify active Merchants of material changes by email at least 14 days before they take effect. The most current version will always be available at youcommerce.co.za/privacy.

11. Contact Our Information Officer

For any privacy-related queries or to exercise your rights:

Email: hello@youcommerce.co.za
Address: YouCommerce (Pty) Ltd, 81 Steenoven Street, Bothasig, Cape Town, 7441