Version 1.0 — Effective Date: 1 May 2026 — Review Date: 1 May 2027
Terms and Conditions
At shopX, your privacy is a fundamental right. Whether you are a customer, seller, service provider, or employee, we treat
your personal information with respect, care, and transparency. This Privacy Policy explains what personal information we
collect about you, why we collect it, how we use it, who we share it with, and what rights you have over it.
1. Who we are
In this Privacy Policy, “shopX”, “we”, “us”, and “our” refer to shopX (Pty)
Ltd., a private company registered in the Republic of South Africa
(Registration number: 2026/093860/07) together with its subsidiaries, associated companies, and
Affiliates that provide services under the
shopX brand.
This policy statement aims to inform our business stakeholders clearly,
transparently, and simply about how we collect, use, share, store
(processing), and protect their personal information. It also explains their rights related to this.
2. Who this policy applies to
This Policy applies to all persons whose personal information shopX collects and
processes, including:
2.1 Customers: individuals who browse, register for, or
purchase products on the shopX Site;
2.2 Sellers and shopX Site Participants: businesses and
individuals who register to sell products on the shopX platform;
2.3 Service Providers and Suppliers: companies and individuals
who supply goods or services to shopX;
2.4 Employees, Contractors, and Job Applicants: current,
former, and prospective employees, contractors, and consultants;
2.5 Business Partners and Affiliates; and
2.6 Website and App Visitors: any person who accesses the shopX
Site or mobile application.
Not all categories of personal information described in this Policy apply to all
persons. What we collect and process depends on your relationship with shopX and the services you
use.
3. Collection of your personal data
shopX will only use the personal information you provide for its specified
purposes. We collect information from you for business or legal purposes, such as financial, labour,
health, and safety laws, and do so with your prior consent. It may be:
3.1 Provided directly by you or your representative;
3.2 Collected from a device associated with you and/or your
business’s devices associated with your profile;
3.3 Collected through any cookies or website tag management
tool on our website and/or seller portal, as specified in such platforms;
3.4 Collected from other companies within shopX, its
subsidiaries, associated companies, and Affiliates;
3.5 Collected from other parties such as Credit Bureaus and
Government Institutions
We will make reasonable efforts to keep your information accurate, complete, and
updated. We require that you notify us in writing of any updates needed for your personal
information from time to time.
4. What personal information we collect
We will process personal data only in accordance with applicable laws, including
the Protection of Personal Information Act (POPIA) and other relevant data privacy laws in the
countries where we operate.
The personal information we collect depends on your relationship with shopX and
the services you use. The following categories may apply:
4.1 Personal identifiers, such as name, contact details,
address, age, date of birth, nationality, gender and race;
4.2 Device and online identifiers and related information;
4.3 Internet, application, and network activity, such as
cookies, browser visits and use of our networks;
4.4 Government identifiers, such as CIPC registration numbers,
national identification numbers and driver’s license numbers;
4.5 Credit Bureau information;
4.6 Financial information, such as annual financial statements,
bank statements, credit and debit card numbers and claims information;
4.7 Purchase history information, such as products our
customers have bought, rented, and returned;
4.8 Payment-related information;
4.9 Certifications and Know Your Customer (KYC) documentation;
4.10 Location information, such as geo-location to confirm our
closest store or facility;
4.11 Ratings and reviews of our products and/or services by our
customers and/or third parties;
5. Special personal information
POPIA places heightened restrictions on the processing of special personal
information, which includes information about race, ethnic origin, health or medical condition,
biometric information, political persuasion, religious or philosophical beliefs, trade union
membership, sexual orientation, and criminal behaviour.
shopX will only process special personal information where:
5.1 You have given explicit written consent;
5.2 Processing is required by a legal obligation imposed on
shopX;
5.3 Processing is necessary for the establishment, exercise, or
defence of a legal right or obligation;
5.4 Processing relates to information you have made public; or
5.5 Processing is permitted by a specific provision of POPIA or
applicable law.
shopX does not collect biometric data (fingerprints, facial recognition) through
the shopX Site. CCTV footage may be captured at shopX’s physical premises for security purposes and
used only for security and legal compliance.
6. How we collect your personal information
6.1 Directly from you
Most of the personal information we hold comes directly from you when you:
6.1.1 Register for a customer or seller account
6.1.2 Place an order or complete a transaction;
6.1.3 Contact our customer service or seller support team;
6.1.4 Complete a survey, competition, or feedback form;
6.1.5 Apply for employment with shopX;
6.1.6 Subscribe to newsletters or promotional communications;
6.1.7 Submit a product review or seller rating; or
6.1.8 Access Seller Hub or the Selling Partner API.
6.2 Automatically through technology
When you visit the shopX Site or use our mobile application, we automatically
collect information through cookies, web beacons, tracking pixels, and similar technical
technologies. This includes your IP address, device information, browsing behaviour, and session
data.
6.3 From third-parties
We may receive personal information about you from:
6.3.1 Credit bureaus and financial verification services (with
your consent or as permitted by law);
6.3.2 Payment processors and banking institutions;
6.3.3 Companies within the shopX corporate group;
6.3.4 Logistics and courier partners;
6.3.5 Government institutions and regulatory authorities
(including SARS and CIPC); and
6.3.6 Social media platforms where you connect your social
media account to your shopX account.
6.4 From sellers (customer personal information)
Where a seller provides us with personal information about their customers (for
example, for multi-channel fulfillment), shopX processes that information as an operator on the
seller’s behalf. The seller remains the responsible party, and shopX will process that information
only in accordance with the seller’s instructions and the applicable Data Processing Agreement.
7. How we share your personal information
shopX does not sell your personal information to third parties. We share your
personal information only in the following circumstances and only to the extent necessary.
7.1 Within shopX corporate
shopX may share your personal information with other companies within the shopX
corporate group, where necessary for the purposes in Section 6. All group companies process your
personal information in compliance with POPIA and this Policy.
7.2 With service providers and operators
shopX engages third-party service providers who process your personal
information on our behalf as operators under POPIA. These include:
7.2.1 Payment processors and banking partners;
7.2.2 Logistics and courier companies;
7.2.3 Cloud computing and IT infrastructure providers;
7.2.4 Customer relationship management and communications
platforms;
7.2.5 Analytics firms (processing aggregated, anonymised data
only);
7.2.6 Legal, audit, and compliance advisers;
7.2.7 Credit bureaus (for FICA verification with your consent
or as permitted by law); and
7.2.8 Physical security monitoring services at shopX premises.
All operators are required to enter into a written Data Processing Agreement
confirming they will process your personal information only on our instructions, implement
appropriate security measures, and comply with POPIA.
7.3 Business Transfers
If shopX is involved in a merger, acquisition, sale of assets, or similar
transaction, your personal information may be transferred to the acquiring or successor entity. We
will ensure the successor entity treats your personal information in accordance with this Policy and
will notify you where required by law.
7.4 Legal and regulatory disclosure
shopX may disclose your personal information to law enforcement, regulatory
bodies, courts, or government agencies where:
7.4.1 Disclosure is required by South African law (including in
response to a court order or valid legal process);
7.4.2 Disclosure is necessary to comply with FICA, SARS
reporting, or other statutory obligations;
7.4.3 Disclosure is necessary to protect vital interests of any
person;
7.4.4 Disclosure is necessary to prevent or address fraud or
illegal activity; or
7.4.5 Disclosure is necessary to establish, exercise, or defend
a legal claim.
Where permitted by law, shopX will attempt to notify the affected person before
making such disclosure.
7.5 Between customers and sellers
To facilitate transactions, we share certain information between customers and
sellers as necessary. For example, a seller receives the delivery address and contact details of a
customer who placed an order. Sellers may only process this information for order fulfillment
purposes and must comply with POPIA.
8. Cross-Border transfers of personal information
In certain circumstances, your personal information may be transferred to or
accessed from countries outside South Africa. Where we need to transfer your personal information
outside the country’s borders, we will ensure that the transfer is made in accordance with POPIA or
any other relevant data privacy and protection laws.
9. Your rights
As a data subject under POPIA, you have the following rights:
9.1 Right to Access
You may request confirmation of whether shopX holds personal information about
you and, if so, receive a copy of that information, along with details of how it is used.
9.2 Right to Correction
You may request that shopX correct, update, or complete any inaccurate,
incomplete, or outdated personal information. You may update most information directly through your
shopX account or Seller Hub.
9.3 Right to Deletion
You may request deletion of your personal information where it is no longer
necessary for the purpose for which it was collected, you have withdrawn consent, and there is no
other lawful basis for retention, or it has been unlawfully processed. We may decline where
retention is required by law or for legal proceedings.
9.4 Right to Restrict Processing
You may request that shopX restrict processing of your personal information in
certain circumstances, for example, while we verify disputed information or assess an objection.
9.5 Right to Object
You may object at any time, on reasonable grounds, to processing where shopX
relies on legitimate interest. You have an absolute right to object to the processing of your data
for direct marketing purposes at any time.
9.6 Right to Opt Out of Direct Marketing
You have an absolute right to opt out of receiving direct marketing
communications from shopX at any time, without providing any reason and without any adverse
consequence. You may opt out by clicking the unsubscribe link in any marketing email, updating your
communication preferences in your shopX account, or contacting our Information Officer.
9.7 Right to Transfer
Where technically feasible and where processing is based on consent or a
contract, you may receive your personal information in a structured, machine-readable format and
request that it be transmitted to another provider.
9.8 Right to Lodge a Complaint
You may lodge a complaint with the Information Regulator of South Africa if you
believe shopX has violated your rights under POPIA using the contact details below.
To exercise any of these rights, submit a written request to our Information
Officer (Section 13). We may verify your identity before processing the request. Standard data
subject rights requests are free of charge.
10. How we protect your personal information
shopX implements appropriate technical, organisational, and physical security
measures to protect your personal information against unauthorised access, loss, destruction,
alteration, or disclosure. Our security measures include:
10.1 Encryption of personal information in transit using
TLS/SSL technology;
10.2 Encryption of sensitive personal information at rest;
10.3 Role-based access controls limiting access to those who
need it;
10.4 Multi-factor authentication for access to sensitive
systems;
10.5 Regular security assessments, vulnerability scanning, and
penetration testing;
10.6 Data loss prevention monitoring;
10.7 Staff training and awareness on data protection and
cybersecurity;
10.8 Physical access controls at shopX offices and facilities;
10.9 Incident response procedures for detecting and managing
data breaches; and
10.10 Regular audits of third-party operator security
practices.
Despite these measures, no system can be guaranteed completely secure. shopX
cannot guarantee nor does it accept any liability of whatsoever nature for any unauthorised or
unlawful disclosure and/or use of your personal information, either by employees and/or made by any
third parties, not under our control, unless resulting from our gross negligence. If you suspect
your account has been compromised, contact us immediately.
10.11 Information Officer
shopX has designated an Information Officer as required by POPIA, responsible
for overseeing POPIA and PAIA compliance and handling data subject requests and complaints.
10.12 Unsubscribe
In addition, you may unsubscribe from communications you receive from us. This
can be done within the communication email or message.
10.13 Policy Review
We may review our statement to ensure that they accurately reflect our
processing activities. Amended statements or information will be made available or posted on the
shopX Site Privacy Centre.
10.14 How to Submit a Data Subject Request
If you have any questions concerning your personal information or how to
exercise these rights, contact us at privacy@shopX.com. Your request should include:
10.14.1 Your full name and contact details;
10.14.2 A clear description of the right you wish to exercise
and the personal information concerned;
10.14.3 A copy of your identity document or other proof of
identity; and
10.14.4 Any other information that may help us locate and
process your request.
10.15 Information Regulator of South Africa
If you are not satisfied with shopX response to your request or complaint, you
may lodge a complaint with the Information Regulator:
Woodmead, Johannesburg, 2191
11. Access to records: PAIA Manual
Under the Promotion of Access to Information Act 2 of 2000 (PAIA), you have the
right to request access to records held by shopX that are required for the exercise or protection of
any right. shopX has compiled a PAIA Manual in accordance with Section 51 of PAIA, available:
11.1 On the shopX Site at www.shopX.com, in electronic format from our
Information Officer upon written request; and from the offices of our Information Officer during
business hours.
11.2 PAIA requests must be submitted to the Information Officer. shopX reserves
the right to charge a fee for processing PAIA requests.
12. Consent
12.1 By making a request and/or registering for shopX services
on the shopX Site or with our Representatives, you confirm your express and informed consent for
shopX to process your personal information in order to fulfil your request.
12.2 Where information is being requested for or in respect of
a child, such requests will only be carried out with the prior consent of a competent person, being
any person who is legally competent to consent to any action or decision being taken in respect of
any matter concerning a child.
13. Direct marketing and communications
shopX may send you marketing communications about our products, services,
promotions, and events where:
13.1 You have given us prior consent to receive such communications; or
13.2 You are an existing customer, and we are marketing similar products or
services to those you have previously purchased, and you have not opted out.
Every marketing communication will clearly identify shopX as the sender and will
provide a simple, free, and effective means to opt out. You may opt out at any time by:
13.3 Clicking the unsubscribe link in any marketing email;
13.4 Updating your communication preferences in your shopX account;
13.5 Sending a written opt-out request to our Information Officer; or
13.6 Replying STOP to any SMS marketing message.
Opting out of marketing does not affect transactional or service-related
communications necessary for your orders or account management.
14. Updates to this Privacy Policy
shopX may update this Privacy Policy from time to time. We will notify you of
material changes by posting the updated Policy on the shopX Site with a new effective date; sending
an email notification to registered customers and sellers; and/or displaying a prominent notice on
the shopX Site or Seller Central for not less than 30 days before the change takes effect.
Your continued use of the shopX platform after the effective date of any update
constitutes acceptance of the updated Policy. Where a material change requires a new consent from
you, we will seek that consent separately and will not rely on continued use as implicit consent. We
recommend you review this Policy periodically.