Privacy Policy
Effective date: 12 October 2026 · Version: 0
This policy explains how Chrome Market (chromemarket.co.za) processes personal information under the Protection of Personal Information Act 4 of 2013 (POPIA). It applies to the website, the Telegram bot and mini-app, and our emails.
1. Who we are (responsible party)
| Responsible party | Smart One Fintech South Africa (Pty) Ltd |
| Registration number | 2021/113793/07 |
| Address | 2 Bruton Road, Bryanston, Sandton, Gauteng, 2191 |
| Information Officer | [to be completed] |
| Contact for privacy matters | support@chromemarket.co.za |
The Information Officer is registered with the Information Regulator as required by section 55 of POPIA. [FILL: confirm the registration is done, then delete this marker]
2. What we collect
POPIA protects the personal information of people and of companies (juristic persons). We collect only what the service needs.
| Category | Examples | Source |
|---|---|---|
| Account | name, email address, phone number, Telegram ID and username, Google account ID | you, Google, Telegram |
| Company | company name, registration number, status, registered address and directors from the CIPC register; VAT number; business address you enter | you, CIPC public register, SARS VAT check |
| Identity check | your full name; your ID or passport number is used once to compare with the CIPC director list and is not stored (only its last four digits are kept with the verification record) | you |
| Verification documents | CIPC document, director ID copy, bank confirmation letter, letter of authority | you |
| Bank account for refunds | bank, account holder, account number, branch code, account type | you |
| Trading | orders, deals, contracts, ratings | you, other users |
| Payments | EFT deposit references and amounts, credit balance, invoices, refund requests | you, our bank |
| Technical | IP address on sign-in and verification logs, session cookie, preferences stored in your browser, analytics data | your device |
| Communications | emails and Telegram messages you exchange with us | you |
We do not knowingly collect special personal information (section 26) or information about children (section 34). The service is for businesses and users aged 18 and over.
3. Why we use it (purpose and lawful basis)
| Purpose | Lawful basis (POPIA section 11) |
|---|---|
| Create and secure your account, sign you in, send one-time codes | performance of the contract with you |
| Verify that the company exists and that you may act for it | performance of the contract; legitimate interest in preventing fraud |
| Run the marketplace: list orders, match buyers and sellers, generate sales agreements | performance of the contract |
| Process deposits, unlock fees, subscriptions, invoices and refunds | performance of the contract; legal obligation (tax and accounting records) |
| Service messages (deal requests, payments, account changes) | performance of the contract |
| New-order alerts and the weekly market statistics email | your consent or our existing-customer relationship (section 69); you can opt out in every email |
| Security, abuse prevention, troubleshooting | legitimate interest |
| Comply with law, court orders or regulators | legal obligation |
We do not sell personal information and we do not use it for automated decisions with legal effect on you (section 71).
4. Who sees it
- Other users. Order listings show product, price and volume. The seller's company name is visible only to signed-in members with a positive balance. Company name, email, phone, registered address and VAT number of the counterparty are shared only after both parties agree a deal and pay the unlock fee, and they appear in the sales agreement.
- Operators acting for us (section 20 and 21), under written confidentiality and security obligations: our hosting provider; Google (sign-in, analytics); Telegram (bot messages); Twilio (WhatsApp or SMS, only if you enable it); our bank (deposits and refunds).
- Public registers we query: CIPC (company details) and SARS (VAT number check).
- Authorities when the law requires it.
5. Transfers outside South Africa
Some operators (Google, Telegram, Twilio) process information outside South Africa. We use them only where the recipient is bound by law, binding corporate rules or an agreement that gives protection substantially similar to POPIA, or where the transfer is needed to perform our contract with you (section 72).
6. How long we keep it
| Information | Retention |
|---|---|
| Verification documents | deleted from our server as soon as an administrator has checked them, and in any case within 48 hours of upload; only a record that the document was received and checked is kept |
| Account and company profile | while the account is active, then up to 12 months to resolve disputes |
| Payments, invoices, refunds, sales agreements | 5 years, as required by tax and company law |
| Sign-in codes | expire after 10 minutes; records deleted after 30 days |
| Server and security logs | up to 12 months |
| Marketing preferences | until you change them |
7. How we protect it (section 19)
Encrypted connections (TLS) for the website, email and administration; hashed one-time codes; access to personal information limited to authorised staff; verification documents screened and deleted after checking; regular backups; and monitoring of the systems. If we believe your information has been accessed by an unauthorised person, we will notify you and the Information Regulator as soon as reasonably possible (section 22).
8. Cookies and similar technologies
- Session cookie: keeps you signed in (required, up to 30 days).
- Browser storage: remembers preferences such as light or dark theme (stays on your device).
- Google Analytics: counts visits and pages to improve the service. You can block it with your browser settings or the Google Analytics opt-out add-on.
9. Your rights
Under POPIA you may:
- ask whether we hold your personal information and request a copy (section 23; requests are handled under the Promotion of Access to Information Act);
- ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (section 24);
- object to processing based on legitimate interest, and to direct marketing at any time (section 11(3));
- withdraw consent where processing relies on consent;
- complain to the Information Regulator.
You can update your profile and email preferences in the dashboard. For anything else, email support@chromemarket.co.za from the address on your account. We reply within 30 days. We may ask you to confirm your identity first. Information we must keep by law (section 6) is retained for the required period even if you ask for deletion.
10. Information Regulator
| Website | inforegulator.org.za |
| Complaints | POPIAComplaints@inforegulator.org.za |
| General enquiries | enquiries@inforegulator.org.za |
| Address | JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 |
11. Changes
We may update this policy. The current version and its effective date are always shown at the top of this page; material changes are announced by email.