Privacy Policy

Plate2Peer is a brand of Katlego Nexus (Pty) Ltd and is operated by Katlego Nexus (Pty) Ltd, the responsible party for your personal information. You can reach our Information Officer at admin@plate2peer.com.

• Everyone with an account: name, email address, cellphone number and a securely hashed password.
• Buyers: name, cellphone number, optional email, and the delivery address or meeting point for each order.
• Sellers: store details, a contact number, the result of your ID check, and the bank account we pay you into (name on the account, bank, branch code, account type and account number). The account number is kept encrypted; only the people at Plate2Peer who pay sellers can see it, and every time they do is recorded.
• Who sellers are: if you are a student, your university email address (ending in .ac.za) and student number; otherwise your full name, South African ID number and date of birth. They are encrypted with a key kept apart from our database, never shown to buyers, and only people at Plate2Peer who need them (with a reason) can see them. Every look is recorded.
• Orders, payments, refunds, payouts, cancellation requests and reported problems, including any photos you add as evidence.
• Feedback, if you choose to give it after an order: your star ratings of the store, the products and Plate2Peer, any comments, and whether your first name may be shown with your review.
• Messages you send in Plate2Peer: to our team, between a buyer and a seller about an order, and questions about a product.
• WhatsApp: your number and WhatsApp profile name, where your chat is up to and your cart, and whether you replied STOP. We do not keep the text of your WhatsApp messages once they have been answered.
• Security: your IP address, used to stop repeated sign-in attempts and fake orders. It is scrambled before it is stored and the record is deleted within a day.
• Basic usage: which products and pages are viewed and searched, linked to a random code rather than to you. We do not store IP addresses for this.

• Mostly from you, when you sign up, order, sell or message us.
• From the other side of an order: a seller sees the buyer's details, and the buyer sees the seller's.
• From our payment provider (whether a payment went through), and from WhatsApp (your number and profile name).
• From our identity verification partner, if you are a seller (only the result of your check).

• A copy or photo of your ID document or student card, or a selfie.
• Your card details or banking login. Payments are made on our payment provider's own secure page.

• To run your account and process orders, payments, cancellations, refunds, payouts and problems (to perform our agreement with you).
• To send you messages about your orders, your store and your account, by email and WhatsApp (to perform our agreement).
• To know who runs each store, allow one store per person, and act on fraud or illegal sales: with your consent, and in our legitimate interest in keeping buyers safe.
• To keep the platform safe, prevent fraud and abuse, and enforce our terms (our legitimate interest).
• To keep the financial records tax and other laws require (a legal obligation).
• To improve Plate2Peer, using usage data that is not linked to you (our legitimate interest).
• To ask how an order went, keep your feedback, show store and product reviews to other buyers, and act on problems it points to (our legitimate interest in a trustworthy marketplace). Giving feedback is always optional.

We only send marketing if you ask for it, and every marketing message tells you how to stop it. Messages about your orders, your store and your account are not marketing. On WhatsApp you can reply STOP at any time to stop all messages from us.

• The other side of your order: after payment, buyer and seller receive each other's name and number, and the seller receives the delivery details. Only for completing that order.
• Messages: only the people in the conversation, and the Plate2Peer team members whose job is to read and answer messages or resolve problems.
• Our service providers (operators), who process information only on our instructions: Yoco (payments and refunds), Twilio and WhatsApp by Meta (WhatsApp messages), n8n (passes WhatsApp messages between Twilio and our website), Netlify (website hosting), Supabase (database, file storage and sign-in), an email delivery provider, an identity verification partner for seller ID checks where we use one, and Cloudflare (bot protection on some forms).
• Feedback: the seller sees your ratings and comments about their store and products, with your first name and the first letter of your last name (like “Thabo M.”) unless you chose “A buyer”. If the store shows reviews, everyone sees them the same way. What you say about Plate2Peer is seen only by our team.
• A seller's university, only to confirm they are a student there, for example after a complaint about their store.
• The police and other authorities, when the law requires it or to report a crime such as fraud, and professional advisers such as our auditors and attorneys, who must keep it confidential.
• A company that takes over Plate2Peer, which would have to keep this policy's promises.

Our operators must protect your information under written agreements. We never sell your information.

Some of our providers (for example Supabase, Netlify, Twilio and Meta) store or process information outside South Africa, such as in the European Union or the United States. We only use providers that are bound by laws, binding corporate rules or agreements giving protection substantially similar to POPIA, or where the transfer is needed to perform our agreement with you, as section 72 of POPIA allows.

We only check who you are after you agree to it separately. Students confirm their university email with a code we send to it. Everyone else gives their ID number, and a member of our team compares their ID with their face on a short video call. Comparing a face with an ID photo involves biometric information, which POPIA treats as special personal information: we do it only on the call (or on a verification partner's secure page if we use one) and never keep a photo of your ID or your face.

Sellers confirm again every 3 months. Each student number or ID number can be linked to one store only.

Sellers must be 18 or older. People under 18 may only buy with a parent's or guardian's permission, and by using Plate2Peer that parent or guardian consents to us processing the child's information as this policy describes. If you believe we hold a child's information without that permission, tell us and we will delete it.

Some things happen automatically, such as the order of search results, holding stock while you pay, and limiting repeated attempts. We do not make decisions that have legal or similarly serious effects on you, such as closing an account or deciding a problem, without a person reviewing them.

• Account information: while your account is open.
• Orders, payments, refunds, payouts and cancellation requests: for as long as financial and tax law requires (generally five years), even if you delete your account. After that, the personal details on them are removed.
• Photos added to a reported problem: 12 months after the problem is resolved.
• Messages in Plate2Peer: two years after the last message in a conversation, or sooner if you delete your account.
• WhatsApp chat progress and cart: 30 days after your last message.
• A number that replied STOP: kept on a do-not-message list until it replies START, so we can respect the choice, even after an account is deleted.
• Where messages were sent: 30 days, so a failed message can be retried; what they said: 90 days.
• Page views and searches: linked only to a scrambled visit code, never to you, and deleted after 13 months.
• Payout bank details: while your store is open; removed when you delete your account.
• Feedback: star ratings are kept, but comments and your name are removed when you delete your account, and after five years in any case.
• Who a seller is (student or ID details): while the store is open and for five years after it closes, even if the account is deleted, so that fraud and legal claims can be dealt with. Email codes are deleted within a day.

• Sign-in cookies that keep you logged in (needed for the site to work).
• Your cart, and a list of the orders placed on this phone, so you can find them again without an account.
• A random visit code (we keep only a scrambled version of it, for counting views).
• The area you choose when searching, so sellers near you show first next time. Choose “Anywhere” to clear it.

You have the right to:

• ask whether we hold information about you, and for a copy of it;
• ask us to correct or delete information that is wrong, out of date or that we may no longer keep;
• object to how we use it, including for marketing, and withdraw a consent you gave;
• complain to the Information Regulator (inforegulator.org.za).

To make a request, contact our Information Officer at admin@plate2peer.com. We may need to confirm who you are first, and we answer within 30 days. Requests for records can also be made under the Promotion of Access to Information Act.

To delete your account, sign in and choose Delete my account on your account page. We do it within 30 days and email you when it is done. Your name, number and login are removed and any store is closed; order and payment records stay for the period above, without your personal details where the law allows. Sellers need to finish open orders and payouts first.

Connections are encrypted, access to personal information is limited to the people who need it, our team signs in with two-step verification, sellers only see the details of their own paid orders, bank account numbers are encrypted, and access to sensitive information is logged. If a breach affects you, we will tell you and the Information Regulator as soon as reasonably possible, as the law requires.

We will tell you before important changes take effect, and ask for your agreement where the law requires it. The version number at the top of this page shows which version you are reading. See also our Terms and Conditions.