Last updated: 11/5/2025

1. Introduction

Welcome to PlantBay.co.za (“PlantBay”, “we”, “our”, “us”).

We respect your privacy and are committed to protecting your personal information in compliance with the Protection of Personal Information Act (POPIA) of South Africa and applicable international data protection laws such as the General Data Protection Regulation (GDPR).

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit or use our website www.plantbay.co.za (the “Platform”), whether you are a vendor, customer, or visitor.

By using our Platform, you agree to the terms of this Privacy Policy. If you do not agree, please discontinue using the Platform.

2. What Personal Information We Collect

We may collect and process the following personal information:

2.1 Information You Provide Directly

• Full name and contact details (email address, phone number, postal/billing address).
• Account login credentials (username, password).
• Vendor business details (company name, business registration number, tax/VAT information).
• Payment and banking details for processing transactions.
• Communication history, support requests, or correspondence with us.

2.2 Information We Collect Automatically

When you visit our Platform, we may automatically collect:

• Your IP address and browser type.
• Device and operating system details.
• Website usage data (pages visited, links clicked, time spent).
• Cookies and similar tracking technologies (see our Cookies Policy for details).

2.3 Information from Third Parties

We may receive personal information from:

• Payment processors and financial service providers.
• Delivery and logistics partners.
• Marketing or analytics services (e.g., Google Analytics).

3. How We Use Your Information

We use your personal information for the following purposes:

• To operate, manage, and maintain the PlantBay.co.za Platform.
• To register and manage user and vendor accounts.
• To facilitate product listings, orders, and transactions between customers and vendors.
• To process payments and deliver products or services.
• To communicate with you regarding orders, updates, or customer service requests.
• To send marketing and promotional messages (only where you have consented).
• To detect, prevent, and respond to fraud, abuse, or security threats.
• To comply with legal and regulatory obligations.

We only collect information necessary for our legitimate business operations and will never sell or rent your data to third parties.

4. Legal Basis for Processing (POPIA & GDPR)

We process your personal information under one or more of the following legal bases:

• Your consent — where you have given explicit permission (e.g., subscribing to our newsletter).
• Performance of a contract — to fulfill an order, provide customer support, or manage your vendor account.
• Legal obligation — where processing is required by law (e.g., tax or record-keeping).
• Legitimate interests — to improve services, prevent fraud, and ensure platform security.

5. How We Share Your Information

We may share personal information only when necessary to provide our services or comply with legal requirements:

• With vendors: Customer details (e.g., delivery address, name) are shared with vendors to fulfill orders.
• With customers: Vendor contact or business details may be displayed publicly on listings.
• With service providers: Payment processors, couriers, hosting providers, and analytics services assisting in platform operations.
• With regulators or law enforcement: If required by law, court order, or government request.

All third parties are required to maintain confidentiality and process data in compliance with POPIA and GDPR standards.

6. Data Retention

We retain your personal information only for as long as necessary to:

• Fulfill the purposes described in this Policy;
• Comply with legal and tax obligations;
• Resolve disputes and enforce agreements.

After this period, your information will be securely deleted, anonymized, or archived according to industry best practices.

7. Data Security

We take appropriate technical and organizational measures to safeguard your information against loss, theft, unauthorized access, disclosure, alteration, or destruction.

These include:

• SSL encryption for data transmission.
• Restricted access to personal data within our organization.
• Secure storage and password protection.
• Regular system updates and monitoring.

However, please note that no online system is completely secure, and we cannot guarantee absolute protection of your information.

8. Your Rights (Under POPIA & GDPR)

You have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion of your personal data (where legally permissible).
• Withdraw consent for certain processing activities.
• Object to data processing for direct marketing purposes.
• Request data portability (to receive your data in a structured format).

To exercise any of these rights, please contact us at privacy@plantbay.co.za.

We may require proof of identity before fulfilling your request to protect your privacy.

9. International Data Transfers

If we transfer or store your personal information outside South Africa (for example, on secure cloud servers or analytics tools located internationally), we ensure that appropriate safeguards are in place to protect your data in compliance with POPIA and GDPR requirements.

10. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your browsing experience, analyze site traffic, and personalize content.

For more details about how cookies work and how you can manage them, please review our [Cookies Policy] (link to be added).

11. Marketing Communications

We may send you marketing or promotional content about PlantBay and participating vendors if you have opted in to receive it.

You may opt out of marketing emails at any time by clicking the “unsubscribe” link in any message or by contacting us directly.

12. Third-Party Links

Our Platform may include links to external websites operated by third parties. We are not responsible for the privacy practices or content of such websites. We encourage you to review the privacy policies of any external sites you visit.

13. Children’s Privacy

Our Platform is not directed toward children under 18. We do not knowingly collect personal information from minors. If we discover that we have inadvertently collected data from a minor, we will delete it promptly.

14. Changes to This Privacy Policy

We may update or amend this Privacy Policy from time to time to reflect changes in our practices or legal obligations. The updated version will be posted on this page with a new “last updated” date.

We encourage you to review this page periodically to stay informed of how we protect your information.