Privacy Policy

1Introduction & Responsible Party

1.1 HmperCo (Pty) Ltd, registration number 2019/474625/07, of 203 LaGuardia Building, Centurion, Gauteng, 0157 ("HmperCo", "we"), is the responsible party for personal information processed in connection with the Platform, as defined in the Protection of Personal Information Act 4 of 2013 ("POPIA").

1.2 This Privacy Policy explains what personal information we collect, why, how we use and protect it, who we share it with, and your rights as a data subject.

2Legal Framework

• Protection of Personal Information Act 4 of 2013 ("POPIA") — the principal statute governing our processing of your personal information.
• Promotion of Access to Information Act 2 of 2000 ("PAIA") — governs your right to request access to records HmperCo holds, including our PAIA manual, available on request.
• Electronic Communications and Transactions Act 25 of 2002 ("ECTA") — governs electronic communications and unsolicited marketing (section 45).
• Cybercrimes Act 19 of 2020 — informs our security obligations regarding unlawful access to data we hold.
• Consumer Protection Act 68 of 2008 ("CPA") — section 11 governs your right to restrict unwanted direct marketing, which operates alongside your POPIA rights.

3Personal Information We Collect

4Lawful Basis for Processing

We process your personal information where necessary: to perform our contract with you (fulfilling Orders, Stokvel, and SnS arrangements); to comply with a legal obligation (for example, tax or FICA record-keeping); on the basis of your consent (for example, direct marketing); or for our legitimate interests (for example, fraud prevention and service improvement), balanced against your rights and reasonable expectations as required by POPIA.

5How We Use Your Information

• Creating and managing your Account;
• Processing, fulfilling, and delivering your Orders, including Stokvel and SnS arrangements;
• Processing payments and preventing fraud;
• Communicating with you about your Orders, Account, and support queries;
• Sending direct marketing, where you have consented or as otherwise permitted under clause 11;
• Improving the Platform and understanding usage patterns (in aggregate/anonymised form where possible); and
• Complying with our legal obligations, including tax, consumer protection, and law-enforcement requests.

6Who We Share Information With

We share personal information, only to the extent necessary, with: our payment service provider (for payment processing); logistics and Driver Partners (for delivery); cloud hosting and IT service providers (for operating the Platform); professional advisors (legal, audit) where necessary; and law enforcement or regulators where required by law. We require these parties, as operators under POPIA, to protect your information and use it only for the purpose we've engaged them for. We do not sell your personal information.

7Cross-Border Processing

Where a service provider (for example, a cloud hosting provider) processes personal information outside South Africa, we take reasonable steps to ensure that country or the recipient is subject to a law, binding agreement, or other arrangement that provides an adequate level of protection substantially similar to POPIA, as required by section 72 of POPIA.

8Security Safeguards

We implement reasonable technical and organisational measures to protect personal information against loss, unauthorised access, interference, or disclosure, consistent with section 19 of POPIA and having regard to the Cybercrimes Act, including access controls, encryption of sensitive data in transit, and staff confidentiality obligations.

9Retention & Deletion

We retain personal information only for as long as necessary for the purpose it was collected, or as required by law (for example, tax records under the Tax Administration Act, or FICA records for payment-related information). Where you request deletion of your Account, we will delete or de-identify personal information we are not otherwise required to retain, as described in clause 4 of the Master Terms.

10Your Rights as a Data Subject

Under POPIA, you have the right to: be notified that your information is being collected; access the personal information we hold about you; request correction of inaccurate or outdated information; request deletion of information we no longer have a lawful basis to hold; object to processing of your information in certain circumstances (for example, direct marketing); and complain to the Information Regulator (see clause 15). To exercise any of these rights, contact us using the details in clause 16.

11Direct Marketing

We send direct marketing communications only where you have consented, or where you are an existing customer and we are marketing similar products/services, consistent with section 69(3) of POPIA, and you may opt out at any time via the unsubscribe link in any marketing communication or by contacting us. See also the Promotions, Events, Competitions & Marketing Policy.

12Cookies

Our use of cookies and similar tracking technologies is described in full in the Cookies Policy.

13Children's Information

The Platform is not directed at children, and we do not knowingly collect personal information from a minor without the consent of a parent or legal guardian, as required by section 35 of POPIA. If we become aware that we have inadvertently collected a minor's information without appropriate consent, we will take reasonable steps to delete it.

14Data Breach Notification

In the event of a security compromise that has, or is reasonably suspected to have, resulted in unauthorised access to your personal information, we will notify the Information Regulator and affected data subjects as soon as reasonably possible, in accordance with section 22 of POPIA.

15Complaints & the Information Regulator

If you are unhappy with how we have handled your personal information, please contact us first using the details below. You also have the right to lodge a complaint directly with the Information Regulator of South Africa:

16Information Officer & Contact Details