SSparePatLink
← Back to home

Privacy Policy

Version 1.0 — Draft pending legal review

SparePatLink (Pty) Ltd — Privacy Policy

Compiled in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA)

1. Who we are

SparePatLink (Pty) Ltd ("SparePatLink", "we", "us", "our") is a private company incorporated in the Republic of South Africa, registration number [REGISTRATION NUMBER], with its registered address at Westview Security Estate, 1374 Fossil Street, Ext 06 Andeon, 0183, South Africa.

SparePatLink operates an automotive commerce platform that connects auto parts retail shops, workshops, delivery drivers, and customers through the websites and applications at sparepatlink.co.za, shop.sparepatlink.co.za, workshop.sparepatlink.co.za, my.sparepatlink.co.za, drive.sparepatlink.co.za and admin.sparepatlink.co.za (together, the "Platform").

For the purposes of POPIA, SparePatLink (Pty) Ltd is the "responsible party" in respect of the personal information described in this policy.

2. Information Officer

Our designated Information Officer is:

  • Name: XW Shange
  • Email: admin@sparepatlink.co.za
  • Address: Westview Security Estate, 1374 Fossil Street, Ext 06 Andeon, 0183

You may contact the Information Officer with any question, request, or complaint regarding your personal information.

3. Who this policy applies to

This policy applies to all persons whose personal information we process, including:

  • Shop users: owners, managers, and staff of auto parts retail shops registered on the Platform;
  • Workshop users: owners and staff of vehicle workshops using the Platform;
  • Drivers: independent delivery drivers and vehicle owners registered to perform deliveries;
  • Customers: individuals who search for, order, or purchase parts through the Platform;
  • Suppliers and business contacts: including persons who interact with us via quotation links, WhatsApp, email, or our website contact form;
  • Website visitors: any person visiting our websites.

POPIA protects the personal information of both natural persons (individuals) and juristic persons (companies). Where we process information about a shop, workshop, or other business, that business enjoys equivalent protections under this policy.

4. What personal information we collect

4.1 Identity and contact information

  • Full name, identity or passport number (drivers), business registration details;
  • Email address, phone number, WhatsApp number, physical and business addresses.

4.2 Account and profile information

  • Usernames, roles (e.g. owner, manager, staff), account settings, and profile details;
  • For drivers: vehicle type, registration, licence details, and vetting documentation.

4.3 Transactional information

  • Orders, quotations, part requests, sales, deliveries, settlements, and payment references;
  • Banking details where required for settlements and payouts. We do not store full card numbers; card payments are processed by our payment service providers.

4.4 Location information

  • Business addresses and delivery addresses;
  • For drivers on active deliveries: real-time GPS location, used for delivery assignment, tracking, and proof of delivery.

4.5 Communications

  • Messages sent through in-Platform chat, WhatsApp communications with us, emails, and contact-form submissions;
  • Support requests and dispute records.

4.6 Technical information

  • Device information, IP address, browser type, usage logs, and cookies or similar technologies necessary for the Platform to function and remain secure.

5. How we collect personal information

  • Directly from you, when you register, transact, communicate with us, or submit documents;
  • Automatically, through your use of the Platform (e.g. logs, device data, GPS during deliveries);
  • From third parties where lawful, e.g. payment providers confirming payment status, or a sales partner introducing your business to the Platform;
  • From publicly available business directories or mapping services when inviting businesses to join the Platform.

6. Why we process your information (purposes and lawful basis)

We process personal information only where POPIA permits it, including where processing is necessary to perform a contract with you, to comply with the law, to protect your or our legitimate interests, or with your consent. Our purposes include:

  • Creating and administering your account and verifying your identity or business;
  • Facilitating part requests, quotations, orders, sales, payments, settlements, and deliveries;
  • Assigning deliveries to drivers and enabling real-time tracking of active deliveries;
  • Communicating with you about your account, transactions, and service updates;
  • Sending onboarding invitations and, where permitted, direct marketing (see section 9);
  • Preventing fraud, securing the Platform, and enforcing our terms and conditions;
  • Complying with legal obligations, including tax and financial record-keeping;
  • Analysing Platform usage to improve our services.

7. Sharing of personal information

We do not sell personal information. We share it only as necessary:

  • Between Platform participants: to complete a transaction, relevant details are shared between the parties involved — e.g. a shop sees a workshop's request details; a driver sees the pickup and delivery addresses and contact details for an accepted job; a customer sees order and delivery status;
  • Service providers (operators): trusted providers who process information on our behalf under written agreements, including hosting and infrastructure (e.g. Vercel, Supabase), email delivery (e.g. Google Workspace, Resend), payment processing (e.g. PayFast, YoCo), and mapping services (e.g. Google Maps);
  • Legal and regulatory: where disclosure is required by law, court order, or a regulator, or to protect rights, property, or safety;
  • Business transactions: in the event of a merger, acquisition, or sale of assets, subject to this policy's protections.

8. Cross-border transfers

Some of our service providers store or process information outside South Africa (for example, cloud hosting and email infrastructure located in other countries). Where personal information is transferred across borders, we do so in accordance with section 72 of POPIA, ensuring the recipient is subject to laws, binding corporate rules, or agreements that provide an adequate level of protection substantially similar to POPIA.

9. Direct marketing

Where we send direct marketing by electronic means (including WhatsApp, SMS, or email), we do so in accordance with section 69 of POPIA:

  • If you are an existing customer, we may market similar services to you, and every message will offer a simple way to opt out;
  • If you are not an existing customer, we will only market to you with your consent, and we will not approach you again if you decline;
  • You may opt out of direct marketing at any time, free of charge, by using the opt-out mechanism in the message or contacting admin@sparepatlink.co.za.

10. Security safeguards

We implement appropriate, reasonable technical and organisational measures to protect personal information against loss, damage, unauthorised access, or unlawful processing, including:

  • Encryption of data in transit (HTTPS/TLS) across all Platform domains;
  • Role-based access controls and row-level security on our databases;
  • Segregated administrative systems with restricted access;
  • Reputable, security-certified infrastructure providers;
  • Regular review of access rights, security advisories, and backups.

Where we use operators to process information on our behalf, we require them by written agreement to maintain equivalent security safeguards.

11. Data breach notification

If we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and, unless your identity cannot be established, notify you as soon as reasonably possible, in accordance with section 22 of POPIA.

12. Retention of personal information

We retain personal information only for as long as necessary to fulfil the purposes described in this policy, unless a longer period is required or permitted by law (for example, financial and tax records, which we retain for at least five years). When information is no longer required, we delete, destroy, or de-identify it in a manner that prevents its reconstruction.

13. Your rights

Under POPIA, you have the right to:

  • Be notified when your personal information is collected or has been compromised;
  • Request access to the personal information we hold about you;
  • Request correction or deletion of inaccurate, irrelevant, excessive, outdated, or unlawfully obtained information;
  • Object, on reasonable grounds, to the processing of your information;
  • Object to direct marketing and opt out at any time;
  • Not be subject to a decision based solely on automated processing that has legal consequences for you, except as permitted by law;
  • Submit a complaint to the Information Regulator;
  • Institute civil proceedings regarding alleged interference with the protection of your personal information.

To exercise any of these rights, contact our Information Officer at admin@sparepatlink.co.za. We may require proof of identity before acting on a request. Access requests are handled in terms of the Promotion of Access to Information Act 2 of 2000 (PAIA) and our PAIA manual, where applicable.

14. Cookies and similar technologies

Our websites use cookies and similar technologies that are necessary for the Platform to function (such as keeping you signed in) and, where applicable, to analyse usage so we can improve our services. You can control cookies through your browser settings; disabling necessary cookies may affect Platform functionality.

15. Children

The Platform is intended for use by persons 18 years and older and by businesses. We do not knowingly process the personal information of children. If you believe a child's information has been provided to us, please contact the Information Officer and we will take appropriate steps to delete it.

16. Changes to this policy

We may update this policy from time to time. The current version will always be published at www.sparepatlink.co.za, with its effective date. Material changes will be communicated through the Platform or by email.

17. Contact and complaints

Information Officer: XW Shange — admin@sparepatlink.co.za

Registered address: Westview Security Estate, 1374 Fossil Street, Ext 06 Andeon, 0183, South Africa

If you are not satisfied with how we handle your personal information or a complaint, you may lodge a complaint with the Information Regulator (South Africa):