Privacy Policy

TOSHZA processes personal information in line with the Protection of Personal Information Act 4 of 2013 (POPIA).

We collect only information reasonably required to operate the marketplace, process payments, fulfil deliveries, support users, and meet legal obligations.

You may request access, correction, deletion, or objection to processing through our data request channels.

We process customer names, email addresses, phone numbers, delivery addresses, order history, payment status metadata, and support communications.

Customer data is used to create accounts, process orders, arrange delivery, send transactional notifications, and improve service reliability.

Delivery drivers and relevant suppliers receive only the information needed to fulfil an order.

Supplier data includes business details, contact numbers, identity information required for onboarding, store and product data, banking details for payouts, and performance records.

Banking details are used solely for payout processing and related fraud/compliance checks.

Driver data includes identity documents, licence and vehicle information, contact details, verification status, delivery assignments, location events related to deliveries, and earnings records.

Verification documents are retained for compliance and safety purposes for as long as reasonably necessary.

Card and wallet payments are processed by licensed payment providers such as PayFast. TOSHZA does not store full card numbers on its servers.

We store payment references, amounts, statuses, provider identifiers, and audit events needed for reconciliation, refunds, and dispute handling.

We use essential cookies and similar technologies for session management, security, and cart continuity. Analytics or preference cookies, where used, are described in our Cookie Policy.

You can control non-essential cookies through your browser settings where applicable.

Under POPIA you may request confirmation of whether we hold your personal information, access to that information, correction of inaccurate data, and deletion where retention is no longer required.

You may also object to certain processing or lodge a complaint with the Information Regulator of South Africa.

Submit requests via /data-request or privacy@toshza.co.za. We may need to verify your identity before acting.

We apply administrative and technical safeguards appropriate to the sensitivity of the information we process.

Information is retained for as long as needed for orders, payouts, legal claims, tax, and regulatory requirements, then securely deleted or anonymised where practical.