Privacy Policy

KasiRoots (Pty) Ltd ("KasiRoots", "we", "us") is committed to protecting your privacy in compliance with the Protection of Personal Information Act 4 of 2013 (POPIA) and all applicable South African data protection law. This Privacy Policy explains how we collect, use, store, and share your personal information when you use the KasiRoots platform as a buyer or seller.

Account data: name, email address, phone number, and profile photo.

Store data: store name, description, product listings, prices, and images.

Identity & banking data (sellers): ID document, bank account holder name, bank name, account number, and branch code — collected for payout verification and FICA compliance.

Order & payment data: shipping address, order history, and transaction records. Card details are processed directly by PayFast and are never stored on KasiRoots servers.

Usage data: IP address, browser type, device type, pages visited, and time spent — collected via cookies and server logs.

• To create and manage your account and store.
• To process orders, payments, and payouts.
• To verify seller identity and banking details as required by law.
• To investigate and resolve disputes.
• To send transactional emails (order confirmations, payout receipts, dispute notifications).
• To send marketing communications — only with your consent, which you may withdraw at any time.
• To improve platform security and detect fraud.
• To comply with our legal obligations under POPIA, the Consumer Protection Act, and FICA.

All card payments are processed by PayFast (Pty) Ltd, a PCI DSS compliant payment gateway. When you proceed to checkout, your card details are entered directly into PayFast's secure environment. KasiRoots receives only a transaction token and status notification — never your full card number, CVV, or bank credentials.

PayFast's privacy practices are governed by their own Privacy Policy.

Your data is stored on secure cloud servers hosted in South Africa or within jurisdictions that provide an adequate level of protection under POPIA. We implement industry-standard encryption (TLS in transit, AES-256 at rest), access controls, and regular security audits to protect your information.

Banking and identity documents are encrypted at rest and accessible only to authorised KasiRoots staff for verification purposes.

We do not sell your personal information. We share it only with:

• PayFast — to process payments.
• Courier partners — shipping address shared with the seller's chosen courier to fulfil delivery.
• Legal authorities — if required by a court order or applicable law.
• Buyers & sellers — limited order details are shared between the parties to an order (e.g., a seller receives the buyer's delivery address).

We use essential cookies (for authentication and security), analytical cookies (to understand how users interact with the platform), and preference cookies (to remember your settings). You can control non-essential cookies in your browser settings, but disabling essential cookies may affect platform functionality.

We retain your account data for as long as your account is active. Transaction records are retained for 5 years as required by the Companies Act and SARS regulations. After account deletion, personal data is anonymised or securely deleted within 30 days, except where longer retention is legally required.

You have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion of your data (subject to legal retention obligations).
• Object to processing of your data for direct marketing.
• Lodge a complaint with the Information Regulator of South Africa.

To exercise these rights, email legal@kasiroots.co.za.

KasiRoots is not intended for use by persons under 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, contact us immediately.

We may update this Privacy Policy from time to time. We will notify you of material changes via email at least 14 days before they take effect. Continued use of the platform constitutes acceptance of the updated policy.

For privacy-related queries or to exercise your POPIA rights, contact our Information Officer at legal@kasiroots.co.za.