South African Artisan Marketplace

Privacy Policy

Last updated: September 2026

1. Introduction & Who We Are

Craft Connect (the "Platform") is operated by Craft Connect Marketplace (Pty) Ltd (Registration No. 2026/759773/07). We respect your privacy and are committed to handling your personal information in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA"). This Privacy Policy explains what we collect, why, how we use it, and the rights you have over your data.

2. Information We Collect

Information you provide to us:

  • Account registration: full name, email address, phone number, and password.
  • Profile information: bio, craft specialty, location, and profile photo.
  • KYC documentation for artisans: identity document, proof of address, bank account details, and proof of bank account; used solely to verify your identity and set up payouts.
  • Order information: shipping addresses, contact phone, items purchased, payment reference, dispute descriptions and supporting evidence photos.
  • Communications: messages you send to our support team and any feedback you submit.

Information collected automatically:

  • Usage data: pages visited, time spent, and actions taken on the Platform.
  • Device and connection data: browser type, operating system, screen size, and IP address.
  • Cookies and similar technologies (see Section 5).
3. How We Use Your Information

We process your personal information for the following purposes:

  • Creating and managing your account, including authentication and session management.
  • Processing payments, holding funds in escrow, releasing payouts, and processing refunds through Paystack (our payment processor).
  • Verifying artisan identities, contact details, and bank account information (KYC) before allowing listings or payouts.
  • Communicating order updates, shipping confirmations, dispute outcomes, and support responses.
  • Improving and personalising the Platform experience.
  • Preventing fraud, abuse, and prohibited content, and enforcing our Terms & Conditions.
  • Sending service-related notices and (with your opt-in consent) marketing communications. You may opt out at any time (see Section 12).
4. Legal Basis for Processing (POPIA Section 11)

POPIA requires that we have a lawful basis for each processing activity. We rely on the following grounds:

  • Consent (POPIA s11(1)(a)): where you have given us explicit permission, e.g. for marketing emails or for processing special-category data.
  • Performance of a contract (POPIA s11(1)(b)): to fulfil orders, process payments, release payouts, and provide the services you signed up for.
  • Legal obligation (POPIA s11(1)(c)): to comply with tax, anti-money-laundering, and consumer protection laws.
  • Legitimate interest (POPIA s11(1)(d)): to operate, secure, and improve the Platform; balanced against your privacy rights.
  • Protecting your legitimate interests (POPIA s11(1)(e)): processing your data to prevent fraud or recover funds you are owed.
5. Cookies & Tracking

We use cookies and similar technologies to keep you signed in, remember your preferences, and analyse Platform usage. You can control cookies via your browser settings, but disabling essential cookies will break core features.

Types of cookies we use:

  • Essential cookies: required for login, session, and checkout. These cannot be disabled.
  • Analytics cookies: anonymous usage data to help us improve the Platform.
  • Preference cookies: remember your language, currency, and layout preferences.

By continuing to use the Platform, you consent to our use of cookies as described. POPIA requires us to obtain consent for non-essential cookies; the cookie banner on every page lets you accept or decline.

6. Information Sharing & Disclosure

We do not sell your personal information. We share it only with:

  • The counterparty to your transaction: artisans see your shipping name, address, and phone to fulfil orders; buyers see the artisan's public profile and contact details.
  • Our payment processor, Paystack (PCI-DSS Level 1), which processes card payments and refunds on our behalf under a strict data-processing agreement.
  • Cloud hosting, email-delivery, and analytics providers, all bound by confidentiality and data-protection agreements.
  • Law-enforcement, tax, or regulatory authorities when required by a valid South African legal process.
  • A potential acquirer in the event of a merger, sale, or restructuring; with a binding undertaking that the acquirer honours this Privacy Policy.
7. Data Security

We implement appropriate technical and organisational safeguards (POPIA s19) including TLS-encrypted traffic in transit, encryption of sensitive data at rest, role-based access controls, audit logging, and two-factor authentication for admin users. No system is 100% secure; if we identify a material breach affecting your personal information we will notify you and the Information Regulator as required by law.

8. Data Retention

We retain your personal information for as long as your account is active and for a reasonable period thereafter to handle returns, refunds, tax obligations (typically 5 years for financial records per SARS), and dispute resolution. When retention is no longer required we securely delete or anonymise the data. You may request earlier deletion of data we are not legally required to keep.

9. Your Rights Under POPIA

POPIA grants you the following rights over your personal information. To exercise any of them, contact us using the details in Section 14:

  • Access (POPIA s23): request a copy of the personal information we hold about you.
  • Correction (POPIA s24): ask us to correct or complete inaccurate information.
  • Deletion (POPIA s24): request erasure of your data, subject to legal retention obligations.
  • Objection (POPIA s11(3)): object to processing based on legitimate interest, and we will reassess.
  • Withdraw consent (POPIA s11(2)): withdraw consent at any time for consent-based processing, without affecting prior lawful processing.
  • Direct marketing opt-out (POPIA s11(5)): object to direct marketing at any time.
  • Complain to the Information Regulator: lodge a complaint with the South African Information Regulator if you believe we have interfered with your information rights.

We will respond to your request within the timeframe required by POPIA (typically 30 days). Identity verification may be required to prevent unauthorised disclosure.

10. International Data Transfers

Some of our service providers (Paystack, cloud hosting, analytics) may process your personal information outside South Africa. Where we do so, we ensure the recipient is bound by POPIA-equivalent safeguards (binding corporate rules, contractual data-protection clauses, or equivalent recognised frameworks). We will not transfer your data to a recipient in a country with weaker privacy protections without your consent or a POPIA s72 lawful basis.

11. Children's Privacy

The Platform is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact support and we will delete it within a reasonable time.

12. Marketing Communications & Opt-Out

We only send marketing emails to users who have explicitly opted in. Every marketing email contains an unsubscribe link. You can also opt out at any time from your account settings or by contacting support. Service-related emails (order updates, dispute outcomes, security alerts) are not marketing and will continue regardless of your marketing opt-out.

13. Data Breach Notification

In the event of a data breach that compromises your personal information, we will notify affected users and the Information Regulator without unreasonable delay and, where feasible, within 72 hours of becoming aware of the breach, in line with POPIA's security-compromise obligations. Notifications will include what happened, what data was affected, what we are doing, and what you can do.

14. How to Contact Us

For any privacy-related questions, complaints, or rights requests, contact us:

  • Operating entity: Craft Connect Marketplace (Pty) Ltd
  • CIPC registration number: 2026/759773/07
  • Registered address: 21 Bergrivier Drive, Terenure, Kempton Park, Gauteng, 1619, South Africa
  • Email: support@craftconnect.net.za

If we are unable to resolve your complaint, you have the right to lodge a complaint with the Information Regulator of South Africa (POPIA) or the Companies and Intellectual Property Commission (CIPC) at the addresses published on their official websites.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email and a notice on the Platform. The latest version always applies to your use of the Platform; continued use after a change takes effect indicates acceptance.