Privacy Policy

**TOSHZA (Pty) Ltd** · Registration 2025/929932/07

Website: https://toshza.co.za

Version 1.0 · Effective 17 July 2026 · Last updated 17 July 2026

This Privacy Policy explains how TOSHZA (Pty) Ltd (Registration 2025/929932/07) collects, uses, shares, stores, and protects personal information when you use the TOSHZA multi-vendor marketplace at https://toshza.co.za, including customer shopping, supplier portals, payments, delivery fulfilment, and support. We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and other applicable South African law.

1. Who we are and how to contact us

TOSHZA (Pty) Ltd (“TOSHZA”, “we”, “us”, or “our”) is a private company registered in the Republic of South Africa under registration number 2025/929932/07, with its registered address in Florida Hills, Roodepoort, Gauteng, South Africa.

TOSHZA operates a multi-vendor online marketplace that connects customers with independent suppliers and logistics partners. For POPIA purposes, TOSHZA is generally the responsible party for personal information it determines the purpose and means of processing for, and may also act as an operator when processing information on behalf of another party under written instructions.

Website: https://toshza.co.za

Privacy enquiries and data subject requests: privacy@toshza.co.za
General support: support@toshza.co.za
Commercial / onboarding: info@toshza.co.za

You may also submit certain access, correction, deletion, or objection requests through our data-request channel on the website where available.

2. Scope of this policy and platform roles

This policy applies to personal information processed in connection with:

Customer accounts and guest checkout flows on the public marketplace
Supplier password-protected portals used to manage stores, products, orders, and payouts
Driver password-protected portals used for delivery assignments and proof of delivery
Admin dashboard access for authorised TOSHZA operations staff
Payments, refunds, fulfilment, notifications, analytics (if enabled), and customer support

Different categories of users interact with different data. Customers typically authenticate with email one-time passcodes (OTP). Suppliers and drivers typically authenticate with password-based portal credentials. Administrators access restricted operational tools under internal access controls.

Independent suppliers remain responsible for personal information they process outside TOSHZA systems (for example, offline records they create themselves). Where a supplier receives customer fulfilment details through TOSHZA, they must use that information only to fulfil the relevant order and must not reuse it for unrelated marketing without a lawful basis.

3. Customer personal information we collect

Depending on how you use the platform, we may collect and process:

Identity and contact details: name, email address, mobile number, and account identifiers
Authentication data: email OTP codes, verification timestamps, session tokens, and device/browser signals used for security
Delivery and collection details: delivery addresses, preferred pickup points, special delivery instructions, and recipient contact details you provide
Order and transaction history: cart contents, order status, fulfilment method, invoices/receipts metadata, and support tickets
Communications: emails, in-app notifications, SMS or WhatsApp messages related to your orders and account, and messages you send to support
Preferences and settings: notification preferences and other account settings you choose

We collect this information when you register or log in, place orders, update your profile, contact support, complete OTP or QR delivery verification, or otherwise interact with TOSHZA services.

4. Supplier personal information we collect

To onboard and operate supplier accounts, we may process business and personal information, including:

Business identity: legal entity name, trading name, CIPC registration details, tax clearance information, and proof of business address
Authorised representative details: full name, South African identity document details, contact email and phone number, and portal login credentials
Banking and payout information: bank account details, bank confirmation letters, payout preferences, and payout history
Store and catalogue data: store profile, product listings, pricing, stock, images, and performance metrics
Compliance and risk records: verification status, document review outcomes, commission arrangements, refunds attributable to the supplier, fraud or dispute flags, and suspension history

Supplier documentation is collected for identity verification, anti-fraud controls, payout integrity, tax and regulatory compliance, and marketplace trust and safety. Selfie capture is primarily used in driver verification workflows; suppliers are generally asked for identity and business documents rather than selfie biometrics, unless additional verification is reasonably required in a specific risk case.

5. Driver and administrator personal information

For drivers, we may process:

Identity verification materials: selfie image, South African ID details, driver’s licence, and vehicle documentation
Contact and account data: phone number, email, password credentials, and profile status
Operational data: delivery assignments, pickup and drop-off events, OTP/QR completion records, earnings and payout-related metadata, and support interactions
Location data: GPS or location pings generated during active delivery assignments to support tracking, safety, and fulfilment integrity

For authorised administrators and internal operators, we process limited employment or contractor identity details, role-based access credentials, audit logs of dashboard actions, and security event records necessary to operate and secure the platform.

Driver location data is collected for delivery operations and is not intended for continuous surveillance outside active delivery contexts. Access to driver and admin data is restricted on a need-to-know basis.

6. Payment information

Customer payments on TOSHZA are processed through PayFast and/or other licensed payment service providers. TOSHZA does not store full card Primary Account Numbers (PANs) on its own servers.

We may store and process payment-related metadata such as:

Payment amount, currency, status, and timestamps
Merchant and provider transaction references
Method category indicators (for example card, Instant EFT, or wallet-type methods supported by the provider)
Refund, chargeback, and reconciliation records

Refunds are assessed by TOSHZA operations according to our refund and return rules and, where approved, are processed via the original payment method where the payment provider and banking rails allow. We do not claim that all refunds are executed through a fully automated PayFast API workflow in every case; some refunds may require manual operational handling with the provider.

Supplier banking details are used to calculate and release payouts after applicable commission, holds, chargebacks, and adjustments. Default platform commission is typically 10% unless a different commercial arrangement is agreed in writing. Payouts are ordinarily subject to a holding period of approximately seven (7) days, subject to risk, dispute, and compliance review.

7. Cookies and similar technologies

We use cookies and similar technologies that are necessary for the platform to function securely and reliably. Essential cookies and local storage may be used for session management, authentication state, security controls, cart continuity, and preference persistence needed to deliver the service you request.

At present, analytics and marketing cookies are generally not deployed as a standard part of the live customer experience. If we enable analytics, advertising, or other non-essential tracking technologies in future, we will update this Privacy Policy and, where required, our Cookie Policy, and provide appropriate notices or choices.

You can control cookies through your browser settings. Blocking essential cookies may prevent login, checkout, or other core features from working correctly.

Essential: required for security, sessions, and core marketplace functions (currently in use)
Analytics / performance: may be introduced later to understand usage patterns (not generally deployed today)
Marketing / advertising: may be introduced later for campaigns or remarketing (not generally deployed today)

8. Location tracking, delivery proof, and Google Maps

TOSHZA uses location-related processing to support fulfilment:

Customers may search and select addresses or pickup-related places using Google Maps Places functionality embedded in or called by the platform
Drivers may transmit location pings while an assigned delivery is in progress so that status, ETA, and operational oversight can be maintained
Delivery completion may require OTP codes, QR confirmation, or similar verification to evidence handover
Collection workflows may involve PAXI pickup points, supplier collection with OTP, or other fulfilment methods offered on the platform

When you use Google Maps Places or related Google services through TOSHZA, Google may process certain technical and location-related data under Google’s own terms and privacy notices. We receive place details you select (such as formatted address and place identifiers) needed to create and fulfil orders.

We do not sell precise location data. Location information associated with deliveries is retained for operational, dispute, safety, and fraud-prevention purposes for as long as reasonably necessary.

9. Notifications by email, SMS, WhatsApp, and in-app channels

We send transactional and service communications that are necessary to operate your account and orders. These may include login OTPs, order confirmations, payment status updates, dispatch notices, delivery OTPs, payout notices, security alerts, and support responses.

Channels we may use include:

Email, including messages sent via Resend or similar transactional email providers
SMS, including messages sent via Twilio or similar messaging providers
WhatsApp, where you choose to use or we reasonably enable optional WhatsApp-based service messaging
In-app notifications within customer, supplier, driver, or admin interfaces

Transactional messages are not marketing and are generally required for the service. Where we send direct marketing communications, we will do so only where permitted by POPIA and the Electronic Communications and Transactions Act 25 of 2002 (ECTA) and related rules, and you may opt out of marketing messages using the unsubscribe mechanism or by contacting privacy@toshza.co.za or support@toshza.co.za. Opting out of marketing does not stop essential service messages.

10. Purposes of processing and lawful bases under POPIA

We process personal information for purposes that include:

Creating and securing accounts, including email OTP login for customers and password portals for suppliers and drivers
Processing orders, payments, fulfilment, collection, and delivery verification
Verifying supplier and driver identities and documents for trust, safety, and compliance
Calculating commission, holding and releasing payouts, and reconciling refunds or chargebacks
Providing customer support and handling disputes, complaints, and chargebacks
Detecting, investigating, and preventing fraud, abuse, and security incidents
Meeting tax, accounting, consumer-protection, and other legal obligations
Improving platform reliability and, if enabled, analysing aggregated or de-identified usage trends

Depending on the context, our lawful bases under POPIA include processing that is necessary to conclude or perform a contract with you, necessary to pursue our legitimate interests in operating a secure marketplace (balanced against your rights), necessary to comply with a legal obligation, or based on your consent where consent is required (for example certain marketing or optional channels).

11. Operators, service providers, and sharing

We share personal information only as needed to operate the marketplace, and with appropriate safeguards. Categories of recipients include:

Payment providers such as PayFast for payment capture, confirmation, and refunds where applicable
Logistics and collection partners such as PAXI, or suppliers fulfilling collection or dispatch
Communications providers such as Resend (email), Twilio (SMS), and WhatsApp-related providers where used
Maps and location technology providers such as Google for Places search and related map services
Hosting, infrastructure, database, monitoring, and security vendors that process data as operators under our instructions
Professional advisers, insurers, auditors, and regulators where legally required or reasonably necessary
Other users only to the limited extent needed for fulfilment (for example a supplier receiving a delivery address for an order, or a driver receiving drop-off details)

We require operators who process personal information on our behalf to apply appropriate security measures and to process information only for agreed purposes. We do not sell personal information.

12. Cross-border transfers

Some of our service providers may process or store information on servers located outside the Republic of South Africa. Where personal information is transferred outside South Africa, we take steps consistent with POPIA section 72, which may include transferring to a jurisdiction with an adequate level of protection, relying on contractual or other appropriate safeguards, or obtaining your consent where required.

By using TOSHZA services that necessarily involve cloud hosting, email, SMS, maps, or payment infrastructure, you acknowledge that certain processing may occur in other countries subject to those safeguards.

13. Security measures

We implement administrative, technical, and organisational measures appropriate to the sensitivity of the personal information we process. These measures may include access controls, role-based permissions for admin tools, encrypted transport (HTTPS), credential hashing for password portals, OTP-based customer authentication, logging and monitoring, and staff confidentiality expectations.

No method of transmission or storage is completely secure. You are responsible for keeping devices, email access, OTP codes, and supplier/driver passwords confidential. Notify us promptly at support@toshza.co.za or privacy@toshza.co.za if you suspect unauthorised access to your account.

If a security compromise is reasonably likely to affect your personal information, we will notify you and the Information Regulator where required by POPIA.

14. Retention of personal information

We retain personal information only for as long as reasonably necessary for the purposes described in this policy, including:

Active account and service provision
Order, payment, payout, refund, and dispute history
Legal, tax, accounting, and regulatory record-keeping
Fraud prevention, chargeback defence, and security investigations
Document retention for supplier and driver verification where required for compliance and risk management

When information is no longer required, we take reasonable steps to delete, destroy, or de-identify it, subject to backups and legal holds. Retention periods may vary by data category. Verification documents and financial records are often retained longer than routine marketing preferences or ephemeral session data.

15. Your rights under POPIA

Subject to the limitations in POPIA and other law, you may have the right to:

Request confirmation of whether we hold personal information about you
Request access to your personal information
Request correction or updating of inaccurate, incomplete, or out-of-date information
Request deletion or destruction of information that is no longer needed, or where processing is unlawful
Object to processing based on legitimate interests or for direct marketing
Withdraw consent where processing is based on consent (without affecting prior lawful processing)
Lodge a complaint with the Information Regulator (South Africa)

To exercise these rights, email privacy@toshza.co.za or use the website data-request process where available. We may need to verify your identity before acting and may refuse or limit a request where POPIA permits (for example where retention is required by law, or where disclosure would unreasonably affect another person’s rights).

Information Regulator website: https://inforegulator.org.za · Complaints: POPIAComplaints@inforegulator.org.za

16. Children

TOSHZA’s marketplace services are directed at adults and businesses. We do not knowingly collect personal information from children under 18 years of age without the involvement of a competent person as contemplated in POPIA.

If you believe a child has provided personal information to us without appropriate authorisation, contact privacy@toshza.co.za and we will take reasonable steps to delete or restrict the information as required.

17. Marketing communications

We may send you marketing emails or other promotional messages about TOSHZA products, suppliers, features, or offers where we have a lawful basis to do so, including consent or another basis permitted under POPIA and ECTA.

You can opt out of marketing at any time. Transactional messages about accounts, OTPs, orders, deliveries, payouts, and security will continue as needed to provide the service.

We do not currently rely on a broad suite of marketing cookies or advertising pixels across the site. If that changes, we will update this policy and related cookie disclosures.

18. Consumer protection and electronic communications

Where you are a consumer under the Consumer Protection Act 68 of 2008 (CPA), nothing in this Privacy Policy is intended to limit rights that cannot lawfully be limited.

Electronic communications, notices, and agreements related to this policy may be concluded or provided electronically in accordance with ECTA. Keeping an active email address on your account is important so that we can reach you with privacy notices, security alerts, and service updates.

19. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect operational, legal, or regulatory changes. The effective and last-updated dates published with the legal documents package indicate the current version.

Material changes will be published on https://toshza.co.za. Where required by law, we may provide additional notice. Continued use of the platform after an update constitutes acknowledgement of the revised policy, except where consent is specifically required for a new processing activity.

20. Contact, complaints, and further information

For privacy questions, data subject requests, or complaints about how we handle personal information, contact:

privacy@toshza.co.za (preferred for privacy matters)
support@toshza.co.za (account and order support)
Postal / registered address region: Florida Hills, Roodepoort, Gauteng, South Africa

If you are not satisfied with our response, you may escalate to the Information Regulator (South Africa) at https://inforegulator.org.za or POPIAComplaints@inforegulator.org.za.

This Privacy Policy should be read together with the TOSHZA Terms and Conditions, Supplier Agreement, Cookie Policy (when published or updated), and any product-specific notices presented at the point of collection.

Contact: support@toshza.co.za · Privacy: privacy@toshza.co.za