Legal — Data & Privacy

Privacy Policy

At Procure Africa, we are committed to protecting your privacy and processing your personal information responsibly. This Policy explains what data we collect, why we collect it, how we use it, and your rights under the Protection of Personal Information Act (POPIA), No. 4 of 2013.

Entity: Procure Africa (Reg. 2022/460473/07)
Jurisdiction: Republic of South Africa
Governed by: POPIA, No. 4 of 2013
Last updated: 1 June 2025
Section 01

Who We Are

Procure Africa (registration number 2022/460473/07), with registered address at 3340 Manyathela Street, Lawley 2, Johannesburg, 1824, is the Responsible Party as defined under POPIA. We operate a digital procurement platform that connects Buyers and Suppliers across South Africa and the broader African continent.

This Privacy Policy applies to all personal information collected through our website, platform, mobile interfaces, WhatsApp procurement agent, registration forms, and any other interaction you have with Procure Africa.

👤 Our designated Information Officer is responsible for ensuring compliance with POPIA and can be contacted at info@procureafrica.co.za.
Section 02

Information We Collect

We collect information that is necessary to provide our services and improve your experience on our platform. This includes:

2.1 — Personal Information you provide directly

a.Full name, job title, and company name
b.Email address, phone number, and physical/postal address
c.Company registration number and tax/VAT number
d.Banking and payment details (where applicable)
e.Identity verification documents submitted during onboarding
f.Communication history, RFQ submissions, and procurement activity on our platform
g.WhatsApp number and conversation data, where you interact with our WhatsApp Procurement Agent

2.2 — Information collected automatically

a.IP address and approximate geographic location
b.Browser type, version, and device information
c.Pages visited, time spent on pages, and clickstream data
d.Referring URLs and search terms used to reach our site
e.Cookie identifiers and session data (see Section 8)

2.3 — Information from third parties

a.Credit and financial information obtained through our approved credit vetting agency, with your consent
b.Business verification data from publicly available company registries (e.g. CIPC)
Section 03

How We Use Your Information

We process your personal information only for specified, explicit, and legitimate purposes.

Purpose Description
Platform access & account management To register, verify, and manage your Buyer or Supplier account on the Procure Africa platform.
RFQ & procurement services To facilitate the creation, sending, and management of Requests for Quotation between Buyers and Suppliers.
Communication To respond to your enquiries, send platform notifications, and provide updates relevant to your account or RFQs.
Credit vetting & compliance To conduct credit checks through an approved third-party agency for the integrity and security of our platform, with your prior consent.
Billing & payments To process subscription payments and issue VAT invoices in accordance with applicable law.
Platform improvement To analyse usage patterns, identify issues, and improve the performance and features of our platform.
Legal & regulatory compliance To comply with applicable South African laws, including POPIA, the Companies Act, and tax legislation.
Security & fraud prevention To monitor for suspicious activity, investigate potential violations, and protect the integrity of the platform.
Section 04

Legal Basis for Processing

⚖️ Under POPIA, we are required to have a lawful basis for every instance in which we process your personal information. The bases we rely on are set out below.
a.Contract performance — Processing necessary to enter into or perform a contract with you (e.g. onboarding, account management, RFQ services).
b.Legal obligation — Processing required to comply with applicable South African legislation, including POPIA, tax law, and financial regulations.
c.Consent — Where we rely on your explicit consent, such as for credit vetting, marketing communications, or WhatsApp interactions. You may withdraw consent at any time by contacting us.
d.Legitimate interests — Where processing is necessary for our legitimate business interests (e.g. platform security, fraud prevention, analytics), provided these interests are not overridden by your rights.
Section 05

Sharing of Information

🔒 We do not sell, trade, or rent your personal information to third parties. We only share your data where necessary, lawful, and with appropriate safeguards in place.

5.1 — When we may share your information

a.With other platform users: Limited profile and RFQ information is shared with Buyers or Suppliers as necessary to facilitate procurement transactions on the platform.
b.With service providers: Trusted third parties who assist us in operating our platform (e.g. cloud hosting, payment gateways, IT support) under strict confidentiality obligations.
c.With credit vetting agencies: With your consent, as described in Sections 2.3 and 4.
d.For legal compliance: Where required by law, court order, or lawful instruction from a regulatory authority.
e.Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to equivalent privacy protections.

5.2

All third parties with whom we share personal information are required to maintain appropriate confidentiality and security measures, and are only permitted to use your information for the specified purpose for which it was shared.

5.3

We require your written consent before sharing your personal information with any third party not described in clause 5.1 above.

Section 06

Data Security

We implement appropriate technical and organisational security measures to protect your personal information against unauthorised access, loss, destruction, alteration, or disclosure. These measures include, but are not limited to:

a.Encryption of data in transit and at rest using industry-standard protocols
b.Access controls and role-based permissions limiting data access to authorised personnel only
c.Regular security assessments and monitoring of our IT systems
d.Secure cloud-based storage infrastructure with redundancy and disaster recovery provisions
e.Staff training on data protection obligations and confidentiality requirements

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the Information Regulator as required under Section 22 of POPIA, without undue delay.

⚠️ While we take all reasonable steps to protect your information, no method of transmission over the internet is 100% secure. You are responsible for maintaining the confidentiality of your login credentials.
Section 07

Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our general retention principles are as follows:

a.Active accounts: Personal information is retained for the duration of your relationship with Procure Africa.
b.Terminated accounts: Following termination, data is securely deleted or anonymised, subject to any legal retention obligations (e.g. financial records retained for 5 years per South African tax law).
c.RFQ and transaction records: Retained for a minimum of 5 years for audit, dispute resolution, and regulatory compliance purposes.
d.Marketing communications: Until you withdraw consent or unsubscribe.

Note: Confidentiality obligations set out in our Terms of Use survive termination of the Customer relationship indefinitely.

Section 08

Cookies & Tracking Technologies

8.1 — What are cookies?

Cookies are small text files placed on your device when you visit our website. We use cookies and similar technologies (such as web beacons and pixel tags) to improve your browsing experience, analyse site performance, and personalise content.

8.2 — Types of cookies we use

a.Essential cookies: Required for the basic operation of our website (e.g. session management, login authentication). These cannot be disabled.
b.Analytical / performance cookies: Help us understand how visitors interact with our site, including pages visited and time spent. Data is aggregated and anonymous.
c.Functional cookies: Remember your preferences and settings to enhance your experience on return visits.
d.Marketing cookies: Used to deliver relevant advertising and track the effectiveness of our campaigns. Only placed with your consent.

8.3 — Managing cookies

You can manage or disable cookies at any time through your browser settings. Please note that disabling certain cookies may affect the functionality of our website. For more information on managing cookies, visit allaboutcookies.org.

Section 09

Third-Party Websites

Our website and platform may contain links to third-party websites, applications, or services that are not owned or controlled by Procure Africa. This Privacy Policy applies only to information collected through our own platform and website.

We are not responsible for the privacy practices, content, or security of any third-party websites. We strongly encourage you to review the privacy policies of any external sites you visit before submitting any personal information.

Section 10

Your Rights Under POPIA

🛡️ As a data subject under POPIA, you have the following rights in relation to your personal information held by Procure Africa. To exercise any of these rights, contact our Information Officer at info@procureafrica.co.za.

📋 Right to Access

Request a copy of the personal information we hold about you and how it is being used.

✏️ Right to Correction

Request that inaccurate, incomplete, or outdated personal information be corrected or updated.

🗑️ Right to Deletion

Request the deletion of your personal information where it is no longer necessary for the purpose it was collected, subject to legal retention obligations.

🚫 Right to Object

Object to the processing of your personal information for direct marketing or where processing is based on legitimate interests.

↩️ Right to Withdraw Consent

Withdraw your consent for processing at any time where consent is the legal basis, without affecting the lawfulness of prior processing.

📢 Right to Complain

Lodge a complaint with the Information Regulator of South Africa if you believe your rights have been violated. Visit www.justice.gov.za/inforeg.

We will respond to all verified requests within 30 days of receipt. In complex cases, we may extend this period by a further 30 days and will notify you accordingly.

Section 11

Cross-Border Transfers

In the course of providing our services, your personal information may be transferred to and processed in countries outside of South Africa, for example where our cloud service providers are located. Where such transfers occur, we ensure that:

a.The receiving country provides an adequate level of data protection as recognised under POPIA; or
b.Appropriate contractual safeguards are in place to protect your personal information in accordance with POPIA requirements.
Section 12

Children's Privacy

The Procure Africa platform is intended solely for use by business entities and individuals who are 18 years of age or older. We do not knowingly collect personal information from minors. If you believe that a minor has provided us with personal information, please contact us immediately and we will take steps to remove that information.

Section 13

Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, platform features, or applicable legal requirements. When material changes are made, we will notify registered users by email and update the "Last updated" date at the top of this page.

We encourage you to review this Policy periodically. Continued use of our platform following notification of changes constitutes acceptance of the updated Policy.

Section 14

Contact Us

If you have any questions, requests, or concerns about this Privacy Policy or the way we handle your personal information, please contact our Information Officer:

Information Officer — Procure Africa

Procure Africa

Reg. No. 2022/460473/07

3340 Manyathela Street, Lawley 2, Johannesburg, 1824

📧 info@procureafrica.co.za

🏛️ You also have the right to lodge a complaint directly with the Information Regulator of South Africa:
Website: www.justice.gov.za/inforeg  ·  Email: inforeg@justice.gov.za

Consent

By using the Procure Africa website and platform, you confirm that you have read and understood this Privacy Policy and consent to the collection, use, and processing of your personal information as described herein.

Last updated: 1 June 2025  ·  Governed by the Protection of Personal Information Act, No. 4 of 2013