Privacy Policy

TOSHZA processes personal information in line with the Protection of Personal Information Act 4 of 2013 (POPIA).

We collect only information reasonably required to operate the marketplace, process payments, fulfil orders, support users, and meet legal obligations.

You may request access, correction, deletion, or objection to processing through our data request channels.

We process customer names, email addresses, phone numbers, delivery addresses, order history, payment status metadata, and support communications.

Customer data is used to create accounts, process orders, arrange fulfilment, send transactional notifications, and improve service reliability.

Suppliers and logistics partners receive only the information needed to fulfil an order.

Supplier data includes business details, contact numbers, identity information required for onboarding, store and product data, banking details for payouts, and performance records.

Banking details are used solely for payout processing and related fraud/compliance checks.

Where courier shipping providers are used, we share only the fulfilment details those partners need (such as pickup/drop-off addresses, contact details for handover, and parcel references).

Tracking and OTP/QR handover records are retained for order support, fraud prevention, and dispute handling for as long as reasonably necessary.

Card, Instant EFT, and wallet payments are processed by licensed payment providers. TOSHZA does not store full card numbers on its servers.

We store payment references, amounts, statuses, provider identifiers, and audit events needed for reconciliation, refunds, and dispute handling.

We use essential cookies and similar technologies for session management, security, and cart continuity. Analytics or preference cookies, where used, are described in our Cookie Policy.

You can control non-essential cookies through your browser settings where applicable.

Under POPIA you may request confirmation of whether we hold your personal information, access to that information, correction of inaccurate data, and deletion where retention is no longer required.

You may also object to certain processing or lodge a complaint with the Information Regulator of South Africa.

Submit requests via /data-request or privacy@toshza.co.za. We may need to verify your identity before acting.

We apply administrative and technical safeguards appropriate to the sensitivity of the information we process.

Information is retained for as long as needed for orders, payouts, legal claims, tax, and regulatory requirements, then securely deleted or anonymised where practical.