POPIA & how we protect your data

POPIA (the Protection of Personal Information Act, 2013) is South Africa's data-protection law. SA Fashion Mall is registered as a responsible party and complies with all eight POPIA conditions. This is a plain-English summary — the full detail is in our Privacy Policy.

What we collect

• Account data — name, email, phone, hashed password, delivery addresses.
• Order data — items you buy; measurements for custom orders (encrypted at rest); order chat.
• Technical data — IP → approximate city, device fingerprint hash, user-agent, JWT session.
• Seller KYC (approved sellers only) — CIPC document, director ID/passport, DOB, residential address, banking — all encrypted at rest with AES-256-GCM.

How to exercise your rights

• Access — GET /api/me/export from your account profile downloads everything we hold on you as JSON.
• Correction — most fields are editable directly in /account/profile.
• Erasure — Delete account in /account/security; subject to open-order and legal retention.
• Withdraw consent — Unsubscribe link in every newsletter email; disable optional notifications in settings.
• Complaint — direct to Information Regulator (South Africa): inforegulator.org.za.

Who sees your data

• Only the specific seller you bought from sees your delivery details for THAT order.
• SA Fashion Mall admins see order-level data for dispute resolution — every access is audit-logged.
• Our payment processor sees the amount + email at checkout, nothing else.
• We never sell your data to advertisers. We do not run tracking pixels or third-party analytics.