Privacy notice

VINSTORE is a product of Tech for African Problems (Pty) Ltd (registration 2026/535581/07). That company is the responsible party for the personal information described here, and “VINSTORE”, “we” and “us” in this notice mean that company. Address: Steyn City, Office Block B, Ground Floor, Capital Park, Central Lane, Riverglen, Johannesburg, 2191.

Information Officer: the head of Tech for African Problems (Pty) Ltd, who holds the role by default under POPIA. Contact: privacy@vinstore.co.za · +27 68 143 9957

Suppliers are separate. A supplier you deal with is its own responsible party for the records it keeps about you, for example its sales records and any register the Second-Hand Goods Act requires it to keep. Where a supplier uses VINSTORE to keep those records, we process them on the supplier's behalf as its operator.

• Account details: name, email address, mobile number, password (stored only as a one-way hash), and the type of buyer you are (private, workshop, panel beater and so on).
• Your vehicles: VINs, registration numbers and vehicle details you search for or save to your garage. A VIN or registration number can identify a person, so we treat it as personal information.
• Location: the area you give us, or your approximate position if you allow it, to show suppliers near you. We do not track your movements.
• Reservations and collections: what you reserved, from whom, when, the price, and whether it was collected. We never see or store payment card details: you pay the supplier in their store.
• Part requests, reviews and messages you send through VINSTORE.
• Supplier staff: name, work email, role title, access rights, and a record of actions taken in the business workspace (who captured, changed, sold or redeemed what, and when).
• Counter sales recorded by a supplier: if you buy over the counter, the supplier may record your name and phone number on the sale. That is the supplier's record; we hold it for them.
• Technical information: IP address, browser and device type, pages used, and security logs.

• The licence disc and barcode scanner reads the image on your phone. The camera picture is never sent to us. Only the details you then choose to save (for example the VIN) are sent.
• Offline capture for supplier staff keeps captured parts and photos on the phone until they upload. Signing out removes the saved screen; captures still waiting stay on the phone until uploaded or deleted.
• Cookies: we use one essential cookie to keep you signed in. We do not use advertising or cross-site tracking cookies.

• To provide VINSTORE to you (your account, search, reservations, collection PINs, notifications about your orders): necessary to perform our agreement with you.
• To pass your reservation to the supplier so they can hold and hand over the part: necessary to carry out what you asked for.
• To keep VINSTORE safe and lawful (fraud and stolen-goods prevention, audit trails, enforcing our terms, responding to lawful requests): our legitimate interest and our legal obligations.
• To improve the service using usage statistics, in aggregated form wherever possible: our legitimate interest.
• To send you marketing, only if you have opted in, and you can opt out at any time. Messages about your own reservations are not marketing and are always sent.

Suppliers: when you reserve a part, that supplier sees your name, your order and its reference so that they can serve you. They do not see your password, your other orders or your garage.

Service providers who process information for us (operators), under contracts that require them to keep it secure and use it only on our instructions:

• Vercel Inc.: hosting of the website and application (servers in Frankfurt, Germany; company in the United States).
• Neon Inc.: the database (data stored in Frankfurt, Germany; company in the United States).
• Cloudflare Inc.: storage and delivery of part and vehicle photos (global network; company in the United States).
• Resend Inc.: sending transactional email such as reservation vouchers (sending region in the European Union; company in the United States).

Authorities: the South African Police Service, a court or a regulator, where the law requires or permits it, for example in a stolen-goods investigation.

A buyer of the business: if VINSTORE is sold or merged, on the same protections as this notice.

We do not sell personal information.

The providers above store and process information outside South Africa, mainly in the European Union and the United States. We transfer it only where the recipient is bound by law or by contract to protect it to a standard substantially similar to POPIA, as section 72 of POPIA requires.

• Account information: while your account is open, and up to 12 months after you close it, unless you ask us to delete it sooner and no law requires us to keep it.
• Reservations, collections and sales records: 5 years, to meet tax, consumer-protection and second-hand goods record-keeping periods.
• Audit and security logs: up to 5 years.
• Part requests that were never matched: 12 months.
• After these periods we delete the information or make it anonymous.

Traffic to VINSTORE is encrypted. Passwords are stored only as one-way hashes. Access inside a supplier's business is limited by role and by individual access rights, administrators use two-step sign-in, and actions are logged. If a security compromise affects your personal information we will tell you and the Information Regulator as POPIA requires.

• Ask whether we hold personal information about you, and ask for a copy.
• Ask us to correct or delete information that is inaccurate, out of date, excessive or unlawfully held.
• Object to processing based on our legitimate interests, and object at any time to direct marketing.
• Withdraw a consent you have given.
• Close your account.

Use Privacy and consent in your account settings, or write to privacy@vinstore.co.za. We answer within 30 days. We may need to confirm who you are first. There is no charge for a reasonable request.

You may complain to the Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 · POPIAComplaints@inforegulator.org.za · inforegulator.org.za. We would appreciate the chance to put things right first.

VINSTORE is not meant for children under 18. We do not knowingly collect a child's personal information without the consent of a parent or guardian.

We will post any change here with a new effective date, and tell account holders about a material change before it takes effect.