BaZAR Live — Privacy Policy

How we handle your personal information — Protection of Personal Information Act 4 of 2013 (POPIA)

Republic of South Africa

Version Rev 01.1

Effective Date: 2026-09-05

Important

This document is provided for information and does not constitute legal advice.

Text in square brackets [ ] is pending confirmation.

1. Who we are, and who is responsible for your information

1.1 BaZAR Live is a live shopping platform. Sellers host live streams, buyers bid and buy, and the platform handles payment, shipping and disputes. To do that we have to process personal information about you.

1.2 The responsible party — the person who decides why and how your information is processed — is:

1.3 This policy forms part of the BaZAR Live Terms and Conditions of Use. Words defined in those Terms — Order, Sale Line, Live Sale, Dispute, Seller, Buyer — carry the same meaning here.

1.4 Sellers are independent merchants. When a Seller receives your name, address and phone number in order to ship your Order, that Seller becomes a responsible party in its own right for what it then does with your information. The Terms require every Seller to use it only for that transaction, to protect it, and not to add you to a mailing list.

The short version

We collect what we need to run a marketplace: who you are, how to reach you, where to send your parcel, what you bought, what you paid, and what happened if something went wrong. Sellers get paid through Paystack, so Paystack — not us — handles card data and bank verification.

We do not sell your information. We do not use advertising cookies, tracking pixels or third-party analytics.

We do not record live streams.

Our emails never contain links, so any "BaZAR Live" email with a link in it is a fake.

2. What this policy covers

2.1 This policy covers the personal information we process about buyers, sellers, viewers and anyone who contacts us, through the BaZAR Live app and website.

2.2 It does not cover: what a Seller does with your information after we pass it on for delivery; what your bank or card issuer does; or any other website you reach from ours.

3. The information we process

3.1 Information you give us

Your identity number is checked and then discarded.

When a Seller completes verification, the South African identity number is passed straight to our payment partner to confirm that the bank account belongs to that person. We do not write it to our database and we do not write it to our logs. What we keep is the result of the check and the verified banking details — nothing more.

3.2 Information we create about you

3.3 Information collected automatically

3.4 Live streams, chat and viewer data — what we do and do not keep

3.4.1 We do not record live streams. The video and audio of a Live Sale are transmitted in real time by our streaming provider and are not saved by us. There is no recording function in the app and no stored copy afterwards — not for marketing, not for training and not as evidence in a Dispute.

3.4.2 What we do keep from a stream is: the listing and Item photographs, the chat messages sent in the stream, the bids placed, and the resulting Sale Lines and Order.

3.4.3 Chat messages are stored with the stream. Do not post personal information — your phone number, your address, your banking details — in a public chat.

3.4.4 If we ever introduce stream recording, we will say so in the app and update this policy before we start.

3.5 Special personal information and children

3.5.1 We do not deliberately collect special personal information as defined in POPIA — information about your race, health, religion, political or trade-union affiliation, sex life, or criminal behaviour. Please do not send it to us. If it appears in something you upload to a Dispute, we will process it only to resolve that Dispute.

3.5.2 The platform is for adults. You must be 18 or older to register. We do not knowingly process the personal information of a child. If we learn that we hold information about a child, we will delete it.

4. Where the information comes from

4.1 Most of it comes from you: when you register, complete your delivery details, apply to sell, bid, buy, chat, or raise a Dispute.

4.2 Some is created by the platform as you use it — your order history, your performance metrics, our logs.

4.3 A small amount comes from other people: our payment partner tells us whether a payment succeeded and whether a bank account is valid; the courier tells us where your parcel is; and the other party to a transaction tells us their side of a Dispute.

5. Why we process your information, and our lawful basis

POPIA requires us to have a lawful basis for everything we do with your information. Here is the full list.

5.1 Where we rely on your consent — marketing is the main example — you can withdraw it at any time. Withdrawing marketing consent does not stop the transactional messages we must send about your Orders.

5.2 We do not make decisions about you by purely automated means that have legal consequences for you. Deadlines in the Dispute process do run automatically — for example, a Dispute resolves in the buyer's favour if a seller does not respond within 2 business days — but those outcomes follow rules published in the Terms, both parties are told the deadline in advance, and a person can be asked to look at the result by writing to refund@bazarlive.co.za.

6. Who we share it with

6.1 We do not sell your personal information, and we do not share it for anyone else's marketing.

6.2 We share it with the service providers we need to run the platform. Each is an operator under POPIA, bound to process the information only on our instructions and to keep it secure.

6.3 We also share information between the parties to a transaction: a Seller receives the delivery name, address and contact number for an Order they must ship, and both parties to a Dispute see what the other has submitted in it.

6.4 If BaZAR Live is sold, merged or restructured, personal information may transfer with the business. You will be told, and the protections in this policy will continue to apply.

7. Sending information outside South Africa

7.1 Some of our service providers process information outside South Africa. Where that happens, section 72 of POPIA applies, and we transfer information only where at least one of the following is true:

• the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection, including principles for lawful processing and onward transfer that are substantially similar to POPIA;
• the transfer is necessary to perform our contract with you, or to conclude or perform a contract in your interest; or
• you have consented.

7.2 In practice we rely on the data-processing agreements and standard terms of our providers, and on the necessity of the transfer to perform your Order.

7.3 Card data does not leave our payment partner's environment through us. We never hold your full card number.

8. How long we keep it

8.1 When a retention period ends, we delete the information or de-identify it so that it can no longer be linked to you.

8.2 Closing your account does not delete records we are required to keep — an invoice, a refund, a Dispute record. It does remove your profile and stop us using your information for anything new.

9. How we protect your information

9.1 We apply reasonable technical and organisational measures, as section 19 of POPIA requires. The main ones are:

• Encryption in transit. The app and every connection to it use HTTPS.
• Authentication. Sign-in is handled by Firebase Authentication. A signed session cookie protects logged-in pages, and administrative pages are protected separately.
• Separation of privileges. The parts of the system that can read and write the database directly run only on our servers, never in your browser. Database rules stop one user reading another user's orders, disputes or profile.
• Protected fields. Fields such as your account identifier, email address, administrator status, seller status and account-freeze status cannot be changed from a browser at all.
• Data minimisation. We do not collect identity documents or selfies, and the identity number used for bank verification is never stored (see section 3.1).
• Evidence photographs behind short-lived secure links. Photographs uploaded to a Dispute are not public. They are served through links that expire, and only to the parties to that Dispute and to us. A photograph you upload as evidence cannot be found by searching the internet.
• Emails without links. Our emails never contain a link, a button or an attachment. This is a deliberate anti-phishing measure: it means any email with a link claiming to be from us is identifiable as fraudulent without you having to judge how convincing it looks. See section 12.
• Rate limiting. Sensitive actions are rate limited per account and per IP address to blunt automated attacks.
• Audit logging. Payment and order state changes and administrative actions are written to an audit log.
• Payment isolation. Card details are captured and processed by our PCI-DSS compliant payment partner. We receive only tokens and references.

9.2 No system is perfectly secure. Please help us: use a strong and unique password, keep your device and browser up to date, never share a one-time PIN, and tell us at hello@bazarlive.co.za if you think your account has been accessed by someone else or if you find a security weakness.

10. If something goes wrong — security compromises

10.1 If there are reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you, as section 22 of POPIA requires.

10.2 We will notify you as soon as reasonably possible after discovering the compromise, unless a public body or the Regulator tells us to delay so as not to impede a criminal investigation.

10.3 The notification will describe, as far as we know it: what happened, the possible consequences for you, what we are doing about it, what you can do to protect yourself, and the identity of the unauthorised person if we know it.

11. Your rights

11.1 Under POPIA you have the right to:

• be told what personal information we hold about you, and who has had access to it (sections 23 and 24);
• ask for a copy of that information;
• correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully (section 24);
• object to processing that we base on legitimate interests, on reasonable grounds (section 11(3));
• withdraw consent where we rely on it, including for marketing;
• object to direct marketing at any time (section 69);
• complain to the Information Regulator (section 74); and
• claim compensation for damage suffered through a breach of POPIA (section 99).

11.2 How to exercise a right. Email refund@bazarlive.co.za, or write to the Information Officer at robbert@bazarlive.co.za. Tell us who you are, which right you want to use, and what information you are asking about. We may need to verify your identity before we act — that protects you.

11.3 We will respond as soon as reasonably possible and, in any event, within the time allowed by law. Access and correction requests under POPIA are made on the prescribed forms, and a request for access to a record may attract the fee prescribed under the Promotion of Access to Information Act 2 of 2000. We will tell you if a fee applies before we do the work.

11.4 We may refuse a request only on a ground the law allows — for example where the record must be kept for tax or audit reasons, where it contains someone else's personal information, or where releasing it would prejudice an investigation. If we refuse, we will tell you why and what you can do next.

11.5 Some information cannot be deleted on request because we are required to keep it: an invoice, a refund record, a Dispute record. In that case we will restrict what we use it for instead.

12. Marketing, and our no-links email policy

12.1 We send you transactional messages because you have an Order — for example, that a seller has been asked to ship, that a Dispute needs your response, or that a return reminder is due. You cannot unsubscribe from these while you have an active Order, because they are how the platform works.

12.2 We send marketing only where you have asked for it or have not objected, as section 69 of POPIA permits. Every marketing message includes a way to unsubscribe, and unsubscribing takes effect immediately.

Our emails never contain links or buttons.

A genuine BaZAR Live email tells you what has happened and asks you to log in at bazarlive.co.za and open the order yourself.

Any email that appears to be from BaZAR Live and contains a link, a button, a QR code or an attachment asking you to click, sign in, verify an account, confirm a payment or change banking details is fraudulent. Do not click it. Forward it to hello@bazarlive.co.za and delete it.

We will never ask you by email, message or phone for your password, a one-time PIN, your full card number or your card's CVV.

12.3 Emails from our payment partner about a payment or a refund are sent by Paystack under its own name and may follow its own format.

13. Cookies and similar technologies

13.1 We use the minimum needed to keep you signed in and to keep the platform secure:

13.2 We do not use advertising cookies, tracking pixels, third-party analytics or cross-site tracking. There is no analytics or advertising software in the app.

13.3 You can clear cookies and site data in your browser at any time. Doing so signs you out.

14. Complaints

14.1 Please raise a privacy concern with us first, at refund@bazarlive.co.za or with the Information Officer at robbert@bazarlive.co.za. We would rather fix it than have you go elsewhere.

14.2 You may complain to the Information Regulator at any time:

14.3 A complaint about goods or a refund, rather than about privacy, goes to refund@bazarlive.co.za, and from there to the routes set out in clause 21 of the Terms.

15. Changes to this policy

15.1 We may update this policy. The current version, with its version number and effective date, is always published in the app and on the website.

15.2 Where a change materially affects your rights, we will tell you by email or in-app notice at least 14 days before it takes effect, unless the law requires the change sooner.

15.3 We keep previous versions and will provide the version in force on a stated date on request.

16. How to contact us

End of document.

This policy forms part of our Terms & Conditions.