Privacy Policy

This Policy applies to sellers, staff, customers, visitors, and support contacts. biocartly is the responsible party for account, subscription, security, marketing, and platform-administration data. For customer information a seller controls for its store, the seller is generally the responsible party and biocartly acts as its operator under written instructions. The actual role depends on the processing purpose.

• Identity, contact, business, account, staff-role, authentication, and subscription information.
• Store content, products, images, domains, orders, customer names, email addresses, phone numbers, delivery details, and support communications.
• Payment status, provider references, refunds, disputes, and chargebacks; we do not store full card numbers or CVV codes.
• Device, browser, cookie, consent, IP, log, usage, fraud, security, and diagnostic data.
• Information from sellers, staff, providers, public sources, and people who report abuse.

We process information to perform contracts; administer accounts, stores, orders, and subscriptions; authenticate users; send transactional communications; provide support; secure, analyse, and improve the service; prevent fraud and abuse; enforce terms; establish or defend claims; comply with law; and, where permitted, market our services. Depending on context, processing is based on consent, contract, legal obligation, protection of legitimate interests, or another ground permitted by POPIA. Refusing required information may prevent the relevant service.

We share information only as reasonably necessary with relevant sellers and authorised staff, buyers in a transaction, seller-selected couriers, professional advisers, lawful business successors, and carefully selected operators that provide authentication, cloud hosting, database infrastructure, payment processing, email delivery, file storage, analytics, fraud prevention, security monitoring, customer support, and platform operations. We may also disclose information to regulators, courts, rights holders, or law enforcement where lawfully required or necessary to protect rights and safety. Operators may process information only for authorised purposes and subject to appropriate contractual and security safeguards. We do not sell personal information.

Some operators may process or store information outside South Africa. We use contractual, organisational, and technical safeguards and transfer personal information only where section 72 of POPIA or another lawful basis permits the cross-border transfer. Locations and providers may change as the service evolves.

We keep information only as long as reasonably needed for its purpose and applicable legal, tax, accounting, payment, fraud, security, backup, dispute, and recordkeeping requirements. We delete, de-identify, or restrict data when no longer required, subject to lawful retention and technically limited backup cycles.

We use proportionate safeguards including HTTPS, access controls, monitoring, credential protection, and encryption of sensitive payment credentials. No system is completely secure. Where a security compromise creates a notification duty, we will notify the Information Regulator and affected data subjects as soon as reasonably possible under POPIA, subject to lawful delay.

Subject to POPIA and PAIA, you may ask whether we hold your information; request access, correction, deletion, or destruction; object to processing; withdraw consent without affecting earlier lawful processing; object to direct marketing; and complain. We may verify identity, request sufficient detail, and retain information that law requires. For seller-controlled data, we may refer the request to the seller.

We use necessary cookies for authentication, carts, security, and preferences, and may use consent-managed analytics or performance technologies. We send direct marketing only where POPIA and consumer law permit, identify the sender, and provide an opt-out. Transactional, security, order, and account messages are not marketing.

Seller accounts are for adults. The service is not directed to children. Sellers may not intentionally collect children's personal information through biocartly without a lawful basis, any required competent-person consent, appropriate notices, and all required safeguards.

Sellers must provide required privacy notices, collect only necessary data, use it only for lawful disclosed purposes, secure access and exports, bind their operators, honour rights requests, manage retention, report incidents promptly, and comply with direct marketing rules. Checkout data may not be used for unrelated marketing without a lawful basis.

Send requests or complaints to privacy@biocartly.com with enough detail to locate the account, store, or order. You may also complain to the South African Information Regulator. The business owner must add the verified legal entity, physical address, and registered Information Officer details before treating this notice as complete.

We may update this Policy when processing, providers, or law changes. We will publish the effective date and provide additional notice for material changes where appropriate.