Privacy Policy

PRIVACY POLICY Last updated: 29 May 2026 1. INTRODUCTION The Paperback Society is a trading name of Flowlancer (Pty) Ltd, a company duly registered in the Republic of South Africa under registration number 2025/916850/07 ("we", "us", "our"). We consider the privacy of individuals and the protection of personal data a priority. We ensure that the processing of personal data complies with the Protection of Personal Information Act 4 of 2013 ("POPIA"), the Electronic Communications and Transactions Act 25 of 2002 ("ECTA"), and all other applicable South African legislation. This Privacy Policy explains how we collect, use, store, share and protect your personal information when you use our mobile application and related services (collectively, the "Platform"). By registering an account or using the Platform, you acknowledge that you have read, understood, and agree to the processing of your personal information as described in this Privacy Policy. 2. INFORMATION WE COLLECT 2.1 Information You Provide When you create an account or use the Platform, we may collect: • Your name, surname, and display name • Email address • Phone number • Physical address and delivery address • Profile photo • Bank account details (for withdrawal purposes only) • Book listing information (titles, descriptions, photos, prices) • Reading preferences (favourite genres, authors, and reading tags you select) • Messages sent to other users through the Platform • Reviews and ratings you leave for other users • Dispute evidence (photos and descriptions) 2.2 Information Collected Automatically When you use the Platform, we may automatically collect: • Device information (device type, operating system) • Location data (with your consent, for delivery and locker pickup purposes) • Push notification tokens (for sending you order updates) • App usage data and interaction patterns (anonymised) 2.3 Information from Third Parties We may receive information from: • PayFast (payment confirmation, transaction references) • Courier service providers (delivery status updates) • Google Books and Open Library APIs (book metadata when you scan an ISBN) 3. HOW WE USE YOUR INFORMATION We use your personal information for the following purposes: 3.1 To provide and maintain the Platform — enabling you to list, buy, and sell books. 3.2 To process transactions — facilitating payments, safekeeping of funds, wallet top-ups, and withdrawals. 3.3 To facilitate deliveries — sharing necessary delivery information with courier service providers. 3.4 To communicate with you — sending order updates, payment confirmations, and push notifications. 3.5 To personalise your experience — providing book recommendations based on your reading preferences (favourite genres, authors, and tags), browsing history, purchase history, and the sellers you follow. See Section 18 of our Terms & Conditions for a full description of how our recommender system works. 3.6 To resolve disputes — mediating between buyers and sellers when issues arise. 3.7 To ensure safety and security — detecting fraud, enforcing our Terms & Conditions, and protecting users. 3.8 To improve our service — analysing anonymised usage data to enhance the Platform. We process your personal data based on: • Your consent (e.g., location data, push notifications) • Performance of a contract (e.g., processing transactions) • Legitimate interest (e.g., fraud prevention, service improvement) • Legal obligation (e.g., financial record-keeping) 4. INFORMATION SHARING AND DISCLOSURE 4.1 With Other Users When you buy or sell a book, certain information is shared with the other party: • Sellers see the buyer's delivery address (for shipping purposes) and display name • Buyers see the seller's display name, location (city level), and ratings • Messages between users are visible only to the participants in that conversation 4.2 With Service Providers We share information with trusted third parties who assist us in operating the Platform: • PayFast (Pty) Ltd — payment processing • Courier service providers (e.g., The Courier Guy, Pargo/PUDO) — delivery fulfilment • Supabase Inc. — cloud database and authentication infrastructure • Firebase (Google) — push notification delivery • Sentry — error monitoring (anonymised crash reports only) We require all service providers to process your data only on our instructions and in accordance with applicable data protection laws. 4.3 Legal Requirements We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others. Where required by South African law, we may share income or transaction data with the South African Revenue Service (SARS) or other competent authorities. 4.4 We Do Not Sell Your Data We do not sell, rent, or trade your personal information to any third party for marketing or advertising purposes. 5. DATA STORAGE AND SECURITY 5.1 Your data is stored on secure cloud infrastructure provided by Supabase (hosted on Amazon Web Services). Data is encrypted in transit (TLS 1.2+) and at rest. 5.2 We implement appropriate technical and organisational security measures, including: • Row-level security policies on all database tables • Certificate pinning on API connections • Secure server-side payment signature generation • Atomic database operations with row-level locking for financial transactions • Rate limiting on sensitive operations 5.3 While we take reasonable steps to protect your data, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security. 5.4 Bank account details provided for withdrawals are stored securely and used solely for processing withdrawal requests to your specified bank account. 5.5 CROSS-BORDER DATA TRANSFERS Your personal data may be transferred to and processed in countries outside of South Africa, including: • Amazon Web Services (AWS) infrastructure used by Supabase for database hosting and cloud functions • Google Cloud Platform used by Firebase for push notifications and analytics These transfers are necessary for the operation of the Platform. We ensure that appropriate safeguards are in place, including contractual obligations on our service providers to protect your data in accordance with POPIA and applicable data protection standards. By using the Platform, you consent to these cross-border transfers. 6. DATA RETENTION AND ACCOUNT DELETION 6.1 We retain your personal data for as long as your account is active or as needed to provide you with our services. 6.2 When you delete your account through the app, your personal information (name, phone number, address, avatar, shop details, preferences, wishlist, reading list, and unread notifications) is anonymised or removed immediately. Your active marketplace listings are removed from the marketplace. 6.3 Records that South African law requires us to retain are kept for the periods set out below, with your name replaced by "Deleted User" in any view of these records. After the retention period ends, these records are permanently deleted by our automated daily purge process. 6.3.1 Order, payment, and transaction records — 5 (five) years from the date of the transaction, in accordance with section 73A of the Income Tax Act, 1962 and section 55 of the Consumer Protection Act, 2008. 6.3.2 Wallet transactions and withdrawal records — 5 (five) years from the date of the transaction, in accordance with section 24 of the Financial Intelligence Centre Act, 2001 ("FICA"). 6.3.3 KYC verification documents (where applicable) — 5 (five) years from the date your account was deleted (end of business relationship), in accordance with FICA section 24. 6.4 Once your account is anonymised, you will not be able to log in again with that email address. If you wish to use the Platform again, you must register a new account. 6.5 Messages you sent in conversations with other users are preserved with your name shown as "Deleted User", because the other party retains the right to refer back to them (for example, in a future dispute). 6.6 Reviews you have written remain visible with your name shown as "Deleted User", to preserve the rating record for the seller you reviewed. 6.7 Anonymised and aggregated data (which cannot be used to identify you) may be retained indefinitely for analytics and service improvement. 7. YOUR RIGHTS UNDER POPIA In accordance with POPIA, you have the right to: 7.1 Access — Request confirmation of whether we hold personal information about you and request access to that information. 7.2 Correction — Request correction of any inaccurate, incomplete, or misleading personal information. 7.3 Deletion — Request deletion of your personal information, subject to the legal retention requirements set out in Section 6 above. You may delete your account at any time through the app's profile settings; we will anonymise your personal data immediately and permanently delete the remaining legally-retained records once their retention period has elapsed. 7.4 Objection — Object to the processing of your personal information on reasonable grounds. 7.5 Data portability — Request a copy of your personal information in a structured, commonly used format. 7.6 Withdrawal of consent — Withdraw your consent for processing at any time, which will not affect the lawfulness of processing prior to withdrawal. 7.7 Complaint — Lodge a complaint with the Information Regulator (South Africa) if you believe your rights have been infringed. To exercise any of these rights, please contact us at the details provided in Section 11. 8. CHILDREN'S PRIVACY The Platform is not intended for use by children under the age of 18. We do not knowingly collect personal information from anyone under 18 years of age. If we become aware that we have collected personal data from a child under 18, we will take steps to delete that information promptly. 9. PUSH NOTIFICATIONS With your consent, we send push notifications for: • Order status updates (payment confirmed, shipped, delivered) • New messages from other users • Price drops on books in your wishlist • Book recommendations matching your interests You can disable push notifications at any time through your device settings. 10. CHANGES TO THIS PRIVACY POLICY We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy in the app and, where appropriate, sending you a notification. Your continued use of the Platform after such changes constitutes your acceptance of the updated Privacy Policy. 11. CONTACT US If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal information, please contact our Information Officer: Flowlancer (Pty) Ltd t/a The Paperback Society Registration No. 2025/916850/07 Email: support@thepaperbacksociety.co.za Physical address: 23 Wavell Drive, Wembley, Pietermaritzburg, 3201, KwaZulu-Natal, South Africa The Information Officer is the director of Flowlancer (Pty) Ltd. All POPIA-related queries may be addressed to the email above. You may also lodge a complaint directly with the Information Regulator (South Africa): Website: https://inforegulator.org.za Email: inforeg@justice.gov.za