Privacy Policy
Last updated: [EFFECTIVE DATE]
In short
We collect only what we need to run a private car marketplace: your account details, your listings, payment records (never your card number) and messages you send us. Your listing is public once it goes live. We don't sell your information, we only send marketing if you say yes, and you can ask us to see, fix or delete your information at any time.
1. About this policy
This policy explains how Private Wheels handles your personal information when you visit our website, join our pre-launch list, create an account, list a car, pay a listing fee or contact us. It's written to meet the Protection of Personal Information Act 4 of 2013 (“POPIA”), and the words “personal information”, “processing”, “responsible party”, “operator” and “data subject” mean what they mean in POPIA.
Please read it together with our Terms of Use and Refund Policy.
2. Who we are (the responsible party)
The responsible party for your personal information is PRIVATEWHEELS (PTY) LTD, trading as Private Wheels (“we”, “us”, “our”).
- PRIVATEWHEELS (PTY) LTD, trading as Private Wheels
Company registration number: 2025/889931/07 - Address: 18 Peter Rd, Ruimsig, Roodepoort, 1724, Gauteng, South Africa
- Email: hello@private-wheels.co.za
- Phone and WhatsApp: +27 82 813 9950
- Website: www.private-wheels.co.za
Information Officer
Our Information Officer is responsible for making sure we comply with POPIA. You can contact them directly about anything in this policy:
- Name: Wilhelm Stoltz (Director)
- Email: hello@private-wheels.co.za
- Postal and physical address: 18 Peter Rd, Ruimsig, Roodepoort, 1724, Gauteng, South Africa
3. What we collect, why, and on what basis
POPIA only lets us process personal information if we have a lawful reason (section 11). The table below sets out what we collect, what we use it for and the lawful reason we rely on.
| Information | What we use it for | Lawful basis |
|---|---|---|
| Account details: email address and password (we only ever store a one-way hashed version of your password, never the password itself) | Creating your account, signing you in, account and security emails | Needed to perform our contract with you (s11(1)(b)) |
| Contact details: your name and phone number | Showing buyers how to reach you (if you choose to), contacting you about your listing or payment, and support | Contract (s11(1)(b)); your consent where you choose to display them |
| Listing details and photos: make, model, year, mileage, price, condition, location, description and photos of the vehicle | Reviewing your listing and publishing it on the marketplace. Once approved, your listing is public and anyone can see it | Contract (s11(1)(b)) |
| Payment metadata: amount, date, payment reference, status, and the card type and last four digits that Paystack returns | Confirming your listing fee, processing refunds, accounting and tax records, preventing fraud | Contract (s11(1)(b)); legal obligations such as tax record-keeping (s11(1)(c)); our legitimate interest in preventing fraud (s11(1)(f)) |
| Pre-launch list and messages: the name and mobile number you leave on our coming-soon form, whether you agreed to marketing, and any WhatsApp messages or emails you send us | Contacting you about your request, sending your launch voucher, answering questions, and (only if you agreed) launch news and offers | Steps you asked us to take before entering a contract (s11(1)(b)); your consent for marketing (s11(1)(a) and s69) |
| Technical information: IP address, browser type, device information and server logs | Keeping the site secure and working, investigating abuse and errors | Our legitimate interest in running a secure service (s11(1)(f)) |
| Identity verification (coming later): your ID document, ID number, a selfie or short video, and the verification result | Confirming that sellers are who they say they are, to protect buyers from scams. This may involve biometric information (a comparison of your face with your ID photo) | Your explicit consent (s27(1)(a)), which we'll ask for separately before you start verification |
We collect this information directly from you. Paystack and, later, Smile ID send us the outcome of a payment or verification, but not your full card or biometric details. You're not obliged to give us any of it, but without the account and listing details we can't list your car.
Card details
Payments are handled by Paystack. You enter your card details on Paystack's secure payment page and Private Wheels never sees, receives or stores your card number, expiry date or CVV.
Special personal information
Biometric information is “special personal information” under POPIA. We will only process it once identity verification is introduced, only with your explicit consent, and only to verify your identity. You can choose not to verify, although some features (such as a “verified seller” badge) may then not be available to you.
Children
Private Wheels is meant for adults. You must be 18 or older to create an account or list a car, and we don't knowingly collect information about children.
5. Sending information outside South Africa
Some of our providers store or process information on servers outside South Africa, for example in the European Union, the United Kingdom or the United States. Section 72 of POPIA allows this only in certain cases. We rely on the following:
- the provider is bound by a law, binding corporate rules or a binding agreement (such as a data processing agreement) that gives your information protection substantially similar to POPIA (s72(1)(a));
- the transfer is necessary to perform our contract with you, for example to host your listing or process your payment (s72(1)(c)); and
- by using Private Wheels after reading this policy, you consent to the transfer (s72(1)(b)).
6. How long we keep it
We keep personal information only as long as we need it for the reasons above, or as long as the law requires (POPIA section 14). Then we delete or de-identify it.
| Information | How long |
|---|---|
| Account and contact details | While your account is open, and 12 months after you close it |
| Listings and photos | Taken off the public site as soon as the listing is sold, removed or rejected; kept privately for 12 months after that to handle disputes and fraud reports |
| Payment and refund records | 5 years from the transaction, as tax and company laws require (such as the Tax Administration Act and the Companies Act) |
| Pre-launch list and messages | Until 12 months after launch, unless you become a customer or ask us to delete them sooner |
| Marketing preferences | Until you unsubscribe; after that, we keep a record of your opt-out so we don't contact you again |
| Identity verification | The verification result while your account is open and 12 months after you close it; ID images and selfies for no longer than [ID IMAGE RETENTION PERIOD] |
| Server and security logs | Up to 90 days, unless needed to investigate an incident |
7. How we keep it safe
We take reasonable technical and organisational steps to protect your information against loss, damage and unauthorised access (POPIA section 19), including:
- encrypting all traffic to and from the site (HTTPS);
- storing passwords only as one-way hashes;
- database rules (row-level security) so that you can only see and change your own account and unpublished listings;
- limiting staff access to those who need it, protected by strong passwords and, where available, two-factor authentication;
- leaving card handling entirely to Paystack, which is PCI-DSS certified; and
- choosing providers with recognised security practices and written agreements.
No system is perfectly secure. If we believe your personal information has been accessed by someone without authority, we'll tell you and the Information Regulator as soon as reasonably possible, as section 22 of POPIA requires.
9. Direct marketing
We only send you marketing by email, SMS or WhatsApp if you've agreed to it (for example by ticking the box on our pre-launch form), or if you're already a customer and the message is about similar services from us, as section 69 of POPIA allows.
Every marketing message tells you how to opt out, and you can also opt out at any time by emailing hello@private-wheels.co.za or replying “STOP” on WhatsApp. Opting out doesn't affect service messages about your account, listing or payment.
10. Your rights
Under POPIA you have the right to:
- Access: ask whether we hold personal information about you and for a copy of it (section 23). We may charge a small fee allowed under the Promotion of Access to Information Act, and we'll tell you upfront.
- Correction and deletion: ask us to correct, update or delete information that is inaccurate, out of date, incomplete, excessive or that we no longer have a reason to keep (section 24).
- Objection: object to us processing your information based on our legitimate interests, and object to direct marketing at any time (section 11(3)).
- Withdraw consent: withdraw any consent you've given. This doesn't affect processing that already happened.
- Automated decisions: not to be subject to a decision based solely on automated processing that has legal or similarly significant effects on you (section 71). Listing reviews are done by people.
- Complain: lodge a complaint with the Information Regulator (see below).
To use any of these rights, email hello@private-wheels.co.za or our Information Officer. We may ask you to prove your identity first, so we don't hand your information to someone else. We'll respond within a reasonable time, and normally within 30 days. You can also delete your listings yourself from your dashboard.
Some information we must keep by law, such as payment records, even if you ask us to delete it. If so, we'll tell you what we kept and why.
11. Complaints
If you're unhappy with how we've handled your information, please talk to us first so we can try to put it right. If you're still not satisfied, you have the right to complain to the Information Regulator:
- Information Regulator (South Africa)
- Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
- Email: enquiries@inforegulator.org.za
- Phone: 010 023 5200
- Website and complaint forms: inforegulator.org.za
12. Changes to this policy
We may update this policy as Private Wheels grows, for example when we introduce identity verification. The date at the top shows when it last changed. If a change materially affects how we use your information, we'll let you know by email or on the site before it takes effect.