Legal
Privacy and POPIA Notice
This notice explains how CardTrade Network handles personal information under South African privacy law. It is a platform notice, not a final legal signoff on every processing activity.
Last updated: 13 May 2026
Responsible party and contact
Privacy requests are handled through account support so identity and account ownership can be verified before action is taken.
CardTrade Network is the marketplace operator for this platform.
Email privacy questions to support@cardtradenetwork.com or submit an authenticated request from your account.
Personal information we process
- Account identity, email, phone number, profile, seller, and account-member details.
- Delivery, courier, order, wallet, payout, payment-status, support, dispute, and trust-safety records.
- Seller verification material, including ID images, selfies, business-registration evidence, VAT, and tax details where required.
- Marketplace content such as listings, inventory, wishlist visibility, decklists, messages, reviews, reports, and advertising campaign data.
- Security and operational signals such as IP-derived country, device token hash, user-agent, signup risk events, audit logs, and rate-limit records.
Why we process it
- Create and secure accounts, prevent abuse, verify sellers, and keep marketplace access fair.
- Run marketplace transactions, shipping, wallet, payout, tax, support, dispute, and fraud-prevention workflows.
- Show public marketplace profiles, listings, ratings, wishlist visibility, seller branding, and opted-in promotional placements.
- Send transactional notices and only send marketing where the user or account preference allows it.
- Maintain logs, audits, reports, and backups needed for security, legal compliance, platform integrity, and support.
Service providers and sharing
- Vercel for application hosting, analytics, speed insights, and public object storage where enabled.
- Neon/PostgreSQL for marketplace database hosting.
- Google for OAuth sign-in where a user chooses Google login.
- PayFast and configured payout rails for payments, settlement, refunds, and financial records.
- Bob Go and its courier providers, email, SMS, WhatsApp, and notification providers for fulfilment and communication.
- Professional advisers, regulators, law enforcement, payment providers, couriers, or affected users where required for disputes, legal duties, or marketplace safety.
Retention posture
- Account and profile records are kept while the account is active and for a reasonable period after closure where legal, dispute, fraud-prevention, payment, or tax duties require it.
- Seller verification evidence is treated as sensitive and private. It should be kept only as long as needed for verification, fraud prevention, disputes, legal duties, or marketplace integrity.
- Orders, payments, payouts, tax/VAT, audit logs, tickets, and disputes may need longer retention because they support financial records and legal defence.
- Marketing preference records are retained so the platform can prove consent, opt-out, or withdrawal decisions.
- Importer diagnostics, telemetry, and operational logs should be minimized, purged when no longer needed, and not used as a general personal-data archive.
Your privacy rights
Some requests can be limited where the platform must retain records for payment, tax, fraud prevention, legal claims, disputes, or marketplace safety.
- Ask what personal information the platform holds about you.
- Ask for correction or deletion of inaccurate, irrelevant, excessive, outdated, incomplete, misleading, or unlawfully obtained personal information.
- Object to processing where POPIA allows an objection.
- Withdraw consent for optional processing such as marketing communications.
- Complain to the Information Regulator if the platform does not handle a privacy concern properly.
Complaints can be escalated to the South African Information Regulator after you give the platform a reasonable chance to respond.