Privacy policy
Draft notice: This is a first draft written for the build, not legal advice, and has not yet been reviewed by a South African legal adviser. It does not assert POPIA, CPA or ECTA compliance.
Markplek is a storefront and WhatsApp ordering platform for small South African businesses (“tenants”). Each tenant business is the “responsible party” for its customers' personal information under the Protection of Personal Information Act (POPIA); Markplek acts as an “operator”, processing data on each tenant's behalf.
What we collect
- Customer name, phone number, optional email, and order details (products, quantities, collection time) entered at checkout.
- Tenant staff account data: name, email, and sign-in activity for admin users.
- WhatsApp message content exchanged with a store, where WhatsApp ordering is enabled.
- Basic technical logs (IP address, request metadata) kept for security and debugging.
Why we collect it
To take and fulfil orders, send order and account notifications, prevent abuse, and operate the storefront and admin tools.
How long we keep it
Default retention periods ([ASSUMPTION], configurable per tenant, docs/SPEC.md §14A): order and payment records 5 years; WhatsApp message bodies 90 days; webhook payloads 14 days; shopping carts 30 days after expiry; audit logs 2 years.
Who it is shared with
- The tenant business you ordered from (the responsible party for your order).
- Our payment provider, to process card/EFT payments.
- Meta, to deliver and receive WhatsApp messages.
- Our email provider, to send order and account notifications.
We do not sell personal information.
Your rights and how to ask
You can ask to access, correct, or delete your personal information, or ask what we hold about you. Contact the business you ordered from directly, using the contact details on its storefront. For requests about platform-operator-level data (for example a tenant staff account), contact the Markplek operator — contact details to be published here once the operator registers one.