Privacy policy

Last updated 27 October 2026

This policy explains how Shipitall (PTY) LTD, trading as Shipitall ("we"), collects, uses, shares and protects personal information when you shop or sell on our marketplace, as the Protection of Personal Information Act, 2013 (POPIA) requires.

1. Who we are

Responsible party: Shipitall (PTY) LTD
Registration number: 2026/050284/07
Address: 7 Klipkraal Crescent LOUWLARDIA CENTURION GAUTENG 0157
Information Officer: Mayke du Preez (mayke@shipitall.co.za)
PAIA manual: https://shipitall.co.za/paia-manual/

Shipitall is a marketplace: independent sellers list and sell their own products. When you buy, the seller is the seller of record and receives what they need to deliver your order. Each seller is responsible for how they use that information.

2. What we collect

When you shop

Your name, email address, phone number and delivery addresses, or the locker or pick-up point you choose.
Your orders, returns, Shipitall Guarantee claims, store credit and loyalty points.
Messages to sellers and to our support desk, product questions and reviews.
Bank account details, only if you ask for a refund by EFT.
Business details for invoices, if you add them.
Your wishlist, recently viewed items (kept with your account when you are signed in), followed shops, price-drop and back-in-stock alerts, and how you want to be notified.
If you allow app notifications, a notification address from your browser’s push service.

When you sell

Your contact details, business type and company details, pickup addresses and shop settings.
Your identity document, CIPC registration and bank confirmation letter, kept in private storage that only authorised staff can open (every view is logged).
Your bank account number, stored encrypted, and your debit order authority.
Your listings, orders, payouts, balance, ratings and seller level.

When you use the site

Technical information such as your IP address, browser and device, used to keep the site working and secure and to stop fraud and spam.
Searches that found nothing (the words only, with email addresses and long numbers removed), so we can improve search.
Whether you clicked a sponsored listing in the last 7 days before buying it, so sellers’ adverts can be measured. This is not linked to you for advertising elsewhere.
Cookies, described in section 8.

We never see or store your card details: card payments are handled by PayFast on its secure systems.

3. Why we use it

To run your account and process, deliver, return and refund your orders (to perform our agreement with you).
To approve and pay sellers, keep accounts and meet tax and legal duties (legal obligation).
To protect buyers and sellers: checking listings, blocking contact details and abuse in messages, handling disputes and preventing fraud (legitimate interest).
To send the order, account and money notices you need, and the alerts you choose.
To measure and improve the site, only if you accept analytics cookies (consent).
To send marketing only if you agree, or about similar products you bought from us, always with a way to stop.

What you must give us

To buy: your name, email address, phone number and a delivery address or pick-up point. Without them we cannot take or deliver your order. Everything else (a wishlist, alerts, reviews, business details) is up to you.
To sell: your contact details, business details, a bank confirmation letter and your bank account, and for the Verified badge your ID and company registration. Without them we cannot approve your shop or pay you.
The law also requires some of it: invoices need your name and address (the Value-Added Tax Act), and seller payouts need verified bank details (the Financial Intelligence Centre Act, where it applies).

4. Who we share it with

The seller of each item you order: your name, delivery address or pick-up point, phone number and order details, so they can send it.
Couriers and pick-up networks that deliver or return your parcel (The Courier Guy, Internet Express, Courier IT, Aramex, PUDO, Pargo, Paxi and other couriers through our courier partners, depending on the delivery chosen). If you take Extra courier cover, they also receive the parcel's declared value; if a parcel is lost or damaged, they receive what is needed for the claim, such as your photos of the damage.
PayFast, to take payments, and our bank, to pay sellers and refunds.
Anthropic (the Claude AI service), to check new listings and messages for rules and safety and to suggest product categories. It receives the listing or message text and photos, not payment details.
Anthropic (Claude) also helps our support team: it writes a draft reply to emails and tickets sent to our support addresses, and summarises emails sent to our accounts mailbox. It receives the text of that email or ticket and your order’s status, date and total. Before the text is sent, ID numbers, phone numbers, bank and card numbers and the first part of email addresses are taken out. A person reads every draft before anything is sent to you, and Claude never decides a refund, payout or other money matter.
Google, for analytics if you accept analytics cookies.
Anthropic (Claude) helps us write our own adverts. It receives only product details (name, brand, price, category, shop name and a short description), never information about you.

Our hosting and email providers, our image delivery network (Bunny.net, which serves product images and can see your internet address when it does), the browser push services (from Google, Apple, Mozilla and Microsoft) if you allow app notifications, and a WhatsApp messaging provider if you choose WhatsApp messages. They process information only to deliver the service.
Authorities, courts or regulators when the law requires it, and professional advisers under confidentiality.

We do not sell your personal information.

5. Information sent outside South Africa

These providers process information outside South Africa:

Anthropic (Claude), in the United States: listing and message checks, support reply drafts and advert copy, as described above.
Google, in the United States and elsewhere: Google Analytics (if you accept analytics cookies), Google Ads (if you choose "Accept all") and app notifications in Chrome and on Android.
Apple, Mozilla and Microsoft: app notifications in their browsers, if you allow them.
Bunny.net (BunnyWay), in the European Union, with servers worldwide: delivering product images.

We send it only where section 72 of POPIA allows: when the provider is bound by law, binding rules or an agreement that protects it to a standard similar to POPIA, or when it is needed to perform our agreement with you.

6. How long we keep it

Orders, invoices, payouts and the records behind them: at least 5 years, as tax law requires.
Seller documents (ID, registration, bank letter) and the bank account number on the seller record: while the shop is open, and deleted 12 months after it closes unless the law or an open matter needs them longer. Payout records are kept with the other money records.
Messages our safety check blocked, and the log of those checks: 90 days.
Summaries of emails sent to our accounts mailbox: 180 days.
Support tickets: while they are open, and for 2 years after they close, then they are made anonymous.
IP addresses in our security log: 1 year. Failed searches: 1 year. The log of emails we sent: 7 days, and the text of each email is removed as soon as it is sent.
The log of notices we sent you (email, app notification or WhatsApp: what was sent, when and whether it arrived): 90 days.
Store credit: until it is used or expires (3 years after the latest credit).
Everything else: only as long as it is needed for the reason we collected it, or as the law requires. When it is no longer needed, or you ask us to and the law allows it, we delete it or make it anonymous.

7. How we protect it

The site uses encrypted connections (HTTPS). Bank account numbers are encrypted, seller documents sit in private storage, staff access is limited by role, and viewing a document or bank number is logged. If a breach puts your information at risk, we will tell you and the Information Regulator as POPIA requires.

8. Cookies

Needed: your cart, sign-in, checkout and security. These are always on, because the site cannot work without them.
Your choices: data-light mode, recently viewed items and your cookie choice, kept in your browser.
Sponsored listings: a cookie that remembers for 7 days which sponsored listing you clicked, so the seller’s advert can be credited with the sale. It is not used to show you adverts.
Analytics (Google Analytics): only if you click Accept (or Analytics only). They tell us which pages and products people use.

You can change your choice at any time: Cookie settings.

Marketing messages

We send marketing email, SMS or WhatsApp messages only if you agreed to them, or if you bought from us and the message is about similar products, as section 69 of POPIA allows. We ask only once if you say no.
Every marketing message has a way to stop them, and you can change it any time under My account → Notifications. Order, delivery, return and account notices are not marketing and keep coming while you have an account.
Price-drop and back-in-stock alerts are sent only for the items you asked about, and stop when you tell us to.

Decisions made by software

Software helps us check listings and messages, flag possible fraud and draft support replies, but no decision with a legal or similarly serious effect on you (a refund, a payout, a suspension, a Guarantee claim) is made by software alone: a person at Shipitall decides, and you can ask us to reconsider. Card payments are checked by PayFast under its own rules.

9. Your rights

Ask what personal information we hold about you and get a copy. Signed in, you can download it yourself under My account → Privacy.
Ask us to correct it, or to delete it when we no longer need to keep it. Signed in, you can delete your account under My account → Privacy. We keep only what the law requires (such as invoices and payment records), and remove your name, contact details and address from it once the law no longer requires it.
Object to how we use it, and withdraw consent (for example to marketing or analytics) at any time.
Complain to the Information Regulator (South Africa) if you are unhappy with how we handled it: inforegulator.org.za, enquiries@inforegulator.org.za, 010 023 5200, Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191. Use the Regulator's complaint form, and give us a chance to put it right first.

To use these rights, email our Information Officer at mayke@shipitall.co.za or write to us through the Help centre. We may ask you to confirm who you are first.

10. Children

Shipitall is for adults. Anyone under 18 may only use it with a parent or guardian, who is responsible for the account.

11. Changes

We will update this page when the way we handle personal information changes. The date at the top shows the latest version. If a change matters to you, we tell you by email or a notice on the site before it takes effect.

12. Access to records (PAIA)

To ask for records we hold, or to see how we handle requests under the Promotion of Access to Information Act, see our PAIA manual, linked in the footer, or write to the Information Officer above.