POPIA Compliance Notice

**TOSHZA (Pty) Ltd** · Registration 2025/929932/07

Website: https://toshza.co.za

Version 1.0 · Effective 17 July 2026 · Last updated 17 July 2026

This POPIA Compliance Notice explains how TOSHZA (Pty) Ltd processes personal information under the Protection of Personal Information Act 4 of 2013 (POPIA). It identifies the responsible party, describes collection and processing purposes, outlines security and retention practices, and sets out your rights and how to exercise them.

1. Introduction

TOSHZA (Pty) Ltd respects your privacy and is committed to processing personal information lawfully, reasonably, and securely in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA") and related South African data protection requirements.

This Notice should be read with the TOSHZA Privacy Policy and Cookie Policy published at https://toshza.co.za. Where this Notice and the Privacy Policy address the same topic, they are intended to be consistent; if a conflict arises, the more specific provision applying to the processing activity will guide our approach, without limiting any right you have under POPIA.

2. Responsible Party

The responsible party for personal information processed in connection with the TOSHZA marketplace and related services is:

Legal name: TOSHZA (Pty) Ltd
Registration number: 2025/929932/07
Registered address: Florida Hills, Roodepoort, Gauteng, South Africa
Website: https://toshza.co.za
Privacy contact: privacy@toshza.co.za
Support contact: support@toshza.co.za

For the purposes of POPIA, TOSHZA determines the purpose of and means for processing personal information described in this Notice, except where we act as an operator on behalf of another responsible party under a written agreement.

3. Personal Information We Collect

Depending on how you use TOSHZA, we may collect and process the following categories of personal information:

Identity and contact details (such as name, email address, telephone number, and delivery address).
Account and authentication data (such as login credentials, verification codes, and security logs).
Transaction and order data (such as products purchased, payment references, invoices, refunds, and delivery status).
Supplier and business information (such as company name, registration details, bank account details for payouts, and tax-related documentation).
Driver and logistics information required for fulfilment and verification.
Communications you send to us or through platform messaging.
Technical and usage data (such as device type, IP address, browser information, cookies, and interaction logs), as further described in our Cookie Policy.

We collect information directly from you, automatically through your use of the platform, and, where lawful, from third parties such as payment providers, identity or document verification partners, and logistics partners.

4. Special Personal Information and Identity Documents

In limited circumstances, TOSHZA may process special personal information or identity-related information where necessary for onboarding, verification, fraud prevention, or legal compliance.

In particular, suppliers and drivers may be required to submit South African identity documents (or equivalent lawful identification) and related verification materials. Copies of identity documents and similar records may include information that must be handled with heightened care under POPIA.

We process such information only where a lawful justification exists under POPIA (including consent where required, or another applicable ground such as establishing or exercising a right or obligation in law, or protecting a legitimate interest where permitted), and only for the stated verification, compliance, and security purposes.

Identity documents and related verification files are stored with restricted access, retained only for as long as necessary for the purposes set out in this Notice, and are not used for unrelated marketing.

5. Purposes of Processing

TOSHZA processes personal information for the following purposes:

Creating and managing user, supplier, and driver accounts.
Facilitating marketplace transactions, payments, refunds, and payouts.
Verifying identity, ownership, and business legitimacy during onboarding and ongoing compliance checks.
Coordinating collection, delivery, and OTP or handover verification.
Providing customer support and resolving disputes.
Detecting, preventing, and investigating fraud, abuse, and security incidents.
Improving platform performance, product quality, and user experience.
Complying with legal, tax, accounting, and regulatory obligations.
Communicating service notices, policy updates, and, where permitted, marketing communications (with opt-out available for direct marketing).

We will not process personal information for a purpose that is incompatible with the original purpose, unless we obtain consent or another lawful basis under POPIA applies.

6. Lawful Bases for Processing

Depending on the context, TOSHZA relies on one or more of the following lawful bases under POPIA:

Consent of the data subject, where required.
Processing necessary to conclude or perform a contract with the data subject.
Processing necessary to comply with an obligation imposed by law.
Processing necessary to protect a legitimate interest of the data subject.
Processing necessary for pursuing our legitimate interests or those of a third party, where POPIA permits and where those interests are not overridden by the data subject's rights.

Where processing is based on consent, you may withdraw consent at any time, without affecting the lawfulness of processing before withdrawal. Withdrawal may affect our ability to provide certain services.

7. Storage of Personal Information

Personal information is stored in electronic systems controlled by TOSHZA and/or by carefully selected operators (service providers) who process information on our behalf under written agreements.

Records may be stored on servers located in South Africa or in other jurisdictions. Where information is transferred outside the Republic, TOSHZA takes steps to ensure that such transfer complies with Chapter 9 of POPIA, including appropriate contractual and organisational safeguards.

We maintain structured records for account management, transactions, verification, support, and compliance so that information remains accurate, accessible to authorised personnel, and protected against unauthorised alteration.

8. Security Measures

TOSHZA implements appropriate, reasonable technical and organisational measures to protect personal information against loss, damage, unauthorised access, and unlawful processing, including:

Access controls and role-based permissions.
Encryption in transit where appropriate and secure credential practices.
Monitoring, logging, and incident response procedures.
Vendor due diligence and operator agreements with security obligations.
Staff awareness of confidentiality and data-handling responsibilities.

No method of transmission or storage is completely secure. If you suspect unauthorised access to your account, contact support@toshza.co.za immediately. Security compromise notifications will be handled in accordance with POPIA where applicable.

9. Operators and Recipients

TOSHZA may share personal information with operators and other recipients where necessary for the purposes described in this Notice, including:

Payment service providers and banking partners.
Logistics, courier, and delivery partners.
Identity, document, and fraud-prevention service providers.
Cloud hosting, email, analytics, and customer-support tools.
Professional advisers (such as attorneys, auditors, and accountants) under confidentiality obligations.
Regulators, courts, or law enforcement where required or permitted by law.

Operators process personal information under our authority and for our instructed purposes, subject to agreements requiring them to maintain confidentiality and implement appropriate security measures. We do not sell personal information.

10. Retention

TOSHZA retains personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required or permitted by law, including:

For the duration of your account relationship and a reasonable period thereafter for dispute resolution and audit.
For periods required by tax, financial, consumer-protection, or other legal record-keeping obligations.
For verification and compliance records relating to suppliers and drivers, for as long as needed to manage risk and meet regulatory expectations.

When personal information is no longer required, we will destroy, delete, or de-identify it in a manner that prevents reconstruction in an intelligible form, subject to backup and legal hold constraints.

11. Your Rights as a Data Subject

Subject to the limitations and procedures in POPIA, you have the right to:

Access personal information we hold about you.
Request correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained.
Object to processing in the circumstances provided for in POPIA, including certain direct marketing.
Lodge a complaint with the Information Regulator (South Africa).
Withdraw consent where processing is based on consent.
Request information about the identities of third parties to whom your personal information has been disclosed, where POPIA so provides.

These rights are not absolute. We may refuse a request where POPIA permits or requires us to do so, and we will explain the basis for any refusal where we are able to do so lawfully.

12. How to Submit Access, Correction, or Deletion Requests

To submit a data subject request for access, correction, or deletion, please use one of the following channels:

Online form: https://toshza.co.za/data-request
Email: privacy@toshza.co.za

Please include your full name, the email address associated with your TOSHZA account (if any), a clear description of the request, and sufficient information for us to verify your identity. We may request additional verification before acting on a request.

We aim to respond within a reasonable period and in accordance with POPIA timelines. Complex or voluminous requests may require additional time; where that occurs, we will communicate with you regarding progress where practicable.

13. Objection and Direct Marketing

You may object to certain processing of your personal information where POPIA provides a right of objection. You may also opt out of direct marketing communications at any time by using the unsubscribe mechanism in the communication or by contacting privacy@toshza.co.za.

Even if you opt out of marketing, we may still send you non-marketing service messages that are necessary for account administration, security, transactions, or legal notices.

14. Complaints to the Information Regulator

If you believe that TOSHZA has not handled your personal information in accordance with POPIA, you may lodge a complaint with the Information Regulator (South Africa):

Website: https://inforegulator.org.za
Complaints email: POPIAComplaints@inforegulator.org.za

We encourage you to contact privacy@toshza.co.za first so that we can attempt to resolve your concern promptly and fairly.

15. Children

TOSHZA is directed at persons who are legally capable of contracting under South African law. We do not knowingly process personal information of children contrary to POPIA. If you believe we have collected personal information of a child without a lawful basis, please contact privacy@toshza.co.za so that we can take appropriate steps.

16. Updates to this Notice

TOSHZA may update this POPIA Compliance Notice from time to time. The current version will be published at https://toshza.co.za with an updated effective or last-updated date.

Material changes will be highlighted through the platform or other appropriate notice where required. Continued use of the services after an update constitutes acknowledgement of the revised Notice, without limiting your rights under POPIA.

17. Contact Details

For privacy and POPIA-related enquiries:

Privacy: privacy@toshza.co.za
Support: support@toshza.co.za
Data requests: https://toshza.co.za/data-request
Website: https://toshza.co.za
Address: Florida Hills, Roodepoort, Gauteng, South Africa

TOSHZA (Pty) Ltd · Registration Number 2025/929932/07

Contact: support@toshza.co.za · Privacy: privacy@toshza.co.za