Privacy & POPIA Notice
This notice explains what personal information KemyShopping processes, why it is needed, who receives it, how long it is kept and how a person can exercise rights under POPIA.
1. Who this notice covers
It covers customers, visitors, account holders, seller applicants and sellers, delivery drivers, support contacts and other people whose information is processed through the KemyShopping website, apps, marketplace, order, delivery or support systems.
2. Information we collect
| Category | Examples |
|---|---|
| Identity and contact | Name, email, telephone number, billing and delivery address, age or identity verification where lawfully required. |
| Account and security | Login identifiers, password hash, OTP events, device, browser, IP address, access logs and fraud signals. |
| Orders and shopping | Basket, products viewed or saved, orders, invoices, seller, price, payment status, returns, warranty claims, reviews and support history. |
| Payment | Provider, token or transaction reference, amount, status, risk result and refund record. Full card or bank credentials are handled by the selected payment provider. |
| Delivery and location | Address, delivery instructions, assigned driver or courier, tracking events, approximate or live location where enabled, QR/PIN status, signature, handover photograph and proof of delivery. |
| Seller and driver onboarding | Identity, company, address, banking, tax, licence, product sourcing, vehicle or operational information and performance records. |
| Communications | Emails, form submissions, call or chat records, complaints, survey responses and preferences. |
| Cookies and usage | Session, cart, consent choice, pages, clicks, referring source, diagnostics and analytics where permitted. |
3. Where information comes from
Information comes directly from the person; automatically from use of the website or apps; from sellers, drivers and authorised account users; and from payment providers, couriers, fraud-prevention services, communications providers and lawful public or verification sources.
4. Why we process information
- Create, secure and administer accounts.
- Display relevant products and operate baskets, checkout and orders.
- Verify payment, prevent fraud and process cancellations and refunds.
- Give sellers, drivers and couriers the limited information needed to fulfil an order.
- Track, deliver and prove handover of parcels.
- Handle support, complaints, returns, warranties, recalls and disputes.
- Verify and manage sellers and delivery partners.
- Secure, troubleshoot, measure and improve the marketplace.
- Meet accounting, tax, consumer, privacy, safety and legal duties.
- Send marketing only where permitted and respect opt-outs.
5. Lawful justification
Depending on the activity, processing is necessary to conclude or perform a contract, comply with law, protect a legitimate interest of the person, pursue a legitimate interest of KemyShopping or another party that is not overridden by the person's rights, or is based on consent where consent is required. A person may withdraw consent, but that does not invalidate processing already lawfully completed.
6. Required and optional information
Checkout, delivery, refund, seller and security fields marked as required are needed to provide or protect the requested service. If required information is not supplied, KemyShopping may be unable to create the account, accept payment, deliver, verify a seller or resolve the request. Marketing choices and most personalisation are optional.
7. Who receives information
- The seller responsible for the purchased item, limited to fulfilment and support needs.
- The assigned KemyShopping driver, courier or collection operator.
- Payment providers, including Payflex when selected, banks and fraud-prevention services.
- Hosting, security, analytics, messaging, email, customer-support and other technology providers.
- Professional advisers, insurers, auditors and prospective lawful business transaction parties subject to safeguards.
- Authorities, regulators, courts, rights owners or affected persons where disclosure is authorised or required by law.
Sellers and drivers may not use order information for their own marketing or unrelated purposes.
8. Payment and Payflex information
The chosen provider processes payment or credit information under its own privacy notice. KemyShopping receives the result and reference needed to administer the order. Payflex makes its own eligibility decision; KemyShopping does not receive the information required to recreate that decision unless lawfully shared for a dispute or support purpose.
9. Delivery tracking and proof
Location and delivery events are used to assign, secure, track and prove delivery. Customers may see the driver's relevant delivery progress, while drivers receive only information needed for the active job. Delivery PINs, QR events, signatures and photographs are protected as operational and security records.
10. Direct marketing
Electronic marketing is sent only where permitted. Each marketing message provides a practical opt-out. Opting out stops marketing but not necessary order, refund, safety, account or security communications. KemyShopping keeps a limited suppression record so an opt-out is respected.
11. Cookies and similar technologies
Necessary technologies operate accounts, security, carts and checkout. Optional analytics, preferences or marketing technologies are used only after the required choice. Read the Cookie Policy and use the cookie control to review the choice.
12. Automated tools and recommendations
KemyShopping may use rules or automated tools for recommendations, search ranking, fraud signals, delivery allocation and service prioritisation. Human review is available where a decision has a material effect and law requires it. Payment or credit providers may make their own automated decisions under their notices.
13. Cross-border processing
Some approved technology providers may process information outside South Africa. A transfer occurs only on a lawful basis with reasonable contractual, organisational or legal safeguards required by POPIA.
14. Retention
| Record | Retention approach |
|---|---|
| Account | While active and afterwards only as reasonably needed for lawful records, disputes, fraud prevention or deletion handling. |
| Orders, invoices and tax records | Generally at least five years where applicable, or longer when a legal hold or dispute requires it. |
| Delivery, returns and support | For the life of the case and a reasonable period afterwards to administer warranties, complaints and legal claims. |
| Seller and driver records | For the relationship and the period required for tax, transaction, safety, fraud and contractual records. |
| Marketing | Until consent is withdrawn or the person opts out, with a limited suppression record retained afterwards. |
| Security logs | For a proportionate period based on security, investigation and legal needs. |
When information is no longer needed, it is deleted, de-identified or securely restricted as appropriate.
15. Security and compromises
KemyShopping uses reasonable technical and organisational safeguards such as access controls, HTTPS, role-based access, backups, logging and provider due diligence. No online service is risk-free. A suspected compromise is investigated and affected persons and the Information Regulator are notified where POPIA requires it.
16. Your rights
Subject to POPIA and PAIA, a person may ask whether information is held; request access; ask who received it; request correction or deletion; object to certain processing; withdraw consent; object to direct marketing; and complain to the Information Regulator. Identity and authority may be verified before information is disclosed or changed.
17. Children
KemyShopping is not intentionally directed to a child who cannot lawfully transact without a competent person's authorisation. Contact the Information Officer if a child's information may have been supplied improperly.
18. Links and public content
Third-party links have their own notices. Reviews, seller names and other information intentionally posted publicly can be viewed by others; do not publish private or sensitive information in a review or public question.
19. Requests and complaints
Use the PAIA & Data Subject Requests page or contact support@kemyshopping.co.za. If KemyShopping cannot resolve the matter, a person may complain to the Information Regulator South Africa.
Still need help?
Contact support@kemyshopping.co.za. Include the order number and enough detail to investigate. KemyShopping support will never ask for your password, card PIN, banking password or one-time password.