This notice explains how Vendu Cape (Pty) Ltd ("we", "us") processes personal information in terms of the Protection of Personal Information Act, 4 of 2013 ("POPIA").
1. Who is the responsible party?
Vendu Cape (Pty) Ltd, registered in the Republic of South Africa, is the responsible party in respect of all personal information processed through the Platform. Our information officer can be reached at info@venducape.co.za.
2. What personal information do we collect?
- Identity and contact data — name, surname, email, phone, ID or passport number where FICA requires it.
- FICA verification data — ID document, proof of address, and any supplementary documents requested for customer-due-diligence.
- Financial data — deposit payment reference, invoice history, and bank details where you have voluntarily provided them for a refund.
- Activity data — bids placed, lots viewed, watchlist contents, login events, IP address, user agent, and timestamps.
- Communication data — emails you send us, messages exchanged with our support staff, and any calls we record (we will tell you before recording).
3. Why do we process it?
- To create and administer your account.
- To verify your identity and meet our FICA obligations.
- To process bids, sales, invoices, and payouts.
- To comply with audit, tax, and legal obligations.
- To communicate with you about auctions you have shown interest in (you may opt out of marketing messages at any time; transactional messages are required for the operation of your account).
- To detect and prevent fraud, abuse, and misuse of the Platform.
4. Legal basis
We process personal information on one or more of the following lawful bases: performance of a contract with you (Section 11(1)(b)), compliance with a legal obligation (Section 11(1)(c)), and our legitimate interests in operating a secure and auditable auction Platform (Section 11(1)(f)). Marketing messages are sent only with your opt-in consent, which you may withdraw at any time.
5. Sharing
We share personal information only with (a) the seller of a lot you win (limited to the details necessary to complete delivery), (b) regulators and law-enforcement where legally required, (c) our operators (hosting, email, SMS, document-storage, and payment providers) who process data on our instruction under a written agreement, and (d) professional advisors bound by confidentiality. We do not sell personal information.
6. Cross-border transfers
Some of our operators store data on servers outside South Africa. Where that is the case we ensure the receiving country has adequate protections in place, or we rely on binding corporate rules or standard contractual clauses, as permitted by Section 72 of POPIA.
7. Retention
We keep personal information only as long as necessary for the purposes above and to meet our legal obligations. FICA records are retained for 5 years after our last transaction with you. Bid and invoice history is retained for 7 years for tax and audit reasons. You may request earlier deletion of data we are not required to retain — see section 9.
8. Security
We apply appropriate technical and organisational measures to protect personal information, including encrypted storage of FICA documents, role-based access control, TLS in transit, and audit logging. No system is perfectly secure; if we become aware of a breach likely to cause real harm to you we will notify you and the Information Regulator as required by Section 22 of POPIA.
9. Your rights
You have the right to:
- Access the personal information we hold about you.
- Correct inaccurate or outdated information.
- Request deletion of information we are not required to retain.
- Object to processing on legitimate-interests grounds.
- Withdraw consent to marketing at any time.
- Lodge a complaint with the Information Regulator.
You can exercise access and deletion rights from your account page (Data export and Delete account), or by emailing info@venducape.co.za. Deletion requests are honoured subject to the retention obligations in section 7 — in that case we anonymise your personal information and retain only the records we are legally required to keep.
10. The Information Regulator
The Information Regulator (South Africa) can be contacted at inforegulator.org.za, or via email at complaints.IR@justice.gov.za.
11. Changes
This notice may be updated from time to time. The "effective from" date at the top of this page shows the version in force. We will highlight material changes via the re-accept prompt on the Platform.