Privacy notice
Draft template — pending legal review before public launch.
Who we are
Uppsalir is a South African craft-market platform operated by the Uppsalir team. The responsible party under POPIA is Uppsalir (registration details to be confirmed at go-live). Contact the information officer at privacy@uppsalir.co.za.
What we collect
- Account info. Display name, email address, and role (organiser, vendor, or shopper) — required to sign in and for organisers to communicate with vendors.
- Vendor profile. Business name, category, description, logo, Instagram handle, website URL — displayed on applications and, once approved, on public event pages.
- Event information. Event names, dates, venues, floor plans, stall details — supplied by organisers.
- Application data. Notes to the organiser, application status, and, once decisions are made, notes from the organiser back to the vendor.
- Payment metadata. Payment status, amount, and PayFast payment reference. We never store card numbers, CVVs, or any full card data — PayFast’s hosted checkout takes those directly from the vendor’s browser.
- Session cookies. Supabase authentication cookies, required to keep you signed in. We do not use marketing or third-party analytics cookies at this time.
Why we collect it
The purposes are limited to running the marketplace: creating accounts, verifying identity for sign-in, matching vendors to stalls, processing PayFast payments, and (for organisers only) reviewing applicants to their own events. We do not sell personal information.
Your rights under POPIA
You have the right to:
- Ask what personal information we hold about you and receive a copy.
- Correct information that is inaccurate or out of date.
- Request deletion of your account and personal information. Some records (audit logs, tax-relevant payment records) may be retained under South African law with your identity removed.
- Object to processing you believe is unlawful or excessive.
- Lodge a complaint with the Information Regulator (South Africa) — inforegulator.org.za.
How to exercise your rights
Sign in and open Data & privacy to request account deletion or export your data. For anything else, email privacy@uppsalir.co.za.
How long we keep it
Account and profile information is retained for as long as your account is active. On a deletion request we mark the record for hard-deletion after a 30-day grace period. Payment records may be retained for the period required by South African tax and financial-services legislation.
How we protect it
The database enforces row-level security so a vendor cannot read another vendor’s data and an organiser can only see applications for their own events. Payments are handled by PayFast under their PCI-DSS obligations; our systems never see card data. Passwords are salted and hashed by our authentication provider.
Changes to this notice
Material changes will be announced by email to signed-in users at least 14 days before they take effect.