PRIVACY POLICY

Secure Auto Market

Last updated: 1 May 2026

Elixcer (Pty) Ltd, registration number 2023/842017/07, registered address Kingfisher Drive, Johannesburg, South Africa, contactable at support@secureautomarket.co.za, operates the online car-parts marketplace available at https://secureautomarket.co.za (referred to in this policy as the "Platform" or "Secure Auto Market"). Through the Platform, registered Vendors list new and pre-owned automotive parts and accessories for sale, and registered Buyers can browse and purchase those parts. This Privacy Policy describes how Elixcer collects, processes, retains and protects the personal information of individuals who register on, browse or otherwise interact with the Platform (referred to as "Users" or "you").

GENERAL PROVISIONS

Elixcer is committed to handling personal information in line with all applicable data protection laws, including the South African Protection of Personal Information Act 4 of 2013 ("POPIA"), the European Union General Data Protection Regulation ("GDPR") where it applies to non-resident data subjects, and any other privacy legislation that governs the activities carried out through the Platform. We treat the privacy of Users as a core priority and apply appropriate technical and organisational safeguards to protect the data we hold.

You should read this Privacy Policy together with any additional notices or consent requests we may issue at the point information is gathered (for example, in pop-up notices, registration screens or e-mail communications). Those supplementary notices add to and do not replace what is set out in this document.

DEFINITIONS

User — any natural person who registers an account, lists a part for sale, places an order, makes or receives a payment, or otherwise interacts with the services available on the Platform. References to "Vendor" describe a User listing parts for sale; references to "Buyer" describe a User purchasing parts.

Personal Information — has the meaning given to it in POPIA, and broadly refers to any information relating to an identifiable individual, including names, contact details, identification numbers, financial information and online identifiers.

Processing — any operation performed on Personal Information, including collecting, viewing, recording, storing, modifying, transferring, disclosing or deleting that information.

Platform — the website at https://secureautomarket.co.za and any associated mobile applications or sub-domains operated by Elixcer.

Services — the listing, search, messaging, secure-payment facilitation, fulfilment-coordination and related functionality made available by Elixcer through the Platform, as further described in our Terms and Conditions.

Terms — the Terms and Conditions of User Agreement that govern access to and use of the Platform, accepted by every registered User.

1. How we collect Personal Information

We obtain Personal Information through several routes, namely:

Direct interactions. You give us information about yourself when you register an account, list a part for sale, place an order, communicate with another User or with our support team, request information from us, supply services to us, or send us feedback.

Automated technologies. When you use the Platform we may automatically collect technical information about the device, browser and network you are using, together with usage data describing how you interact with the Platform. This information is gathered through cookies, server logs, similar tracking technologies and analytics scripts. We may also receive technical data when you visit other websites that incorporate our cookies or pixels.

Our Cookie Policy lists every cookie we set, what it is for and how long it lasts. Optional analytics and marketing cookies are set only if you accept them, and you can change or withdraw that choice at any time using the Cookie settings link in the footer of any page.

Third-party sources. We may receive information about you from third parties, including: identity verification providers, payment service providers and banks, parts catalogue and fitment data providers, courier and logistics partners, marketing and analytics platforms, search and social media providers, and partners that help us prevent fraud and detect counterfeit listings.

2. Lawful basis for processing

Elixcer processes Personal Information that is necessary to operate the Platform, to register and administer User accounts, and to facilitate the listing, sale and delivery of car parts between Vendors and Buyers.

We rely on one or more of the legal grounds permitted by POPIA and, where applicable, the GDPR. In most cases, processing is necessary for the performance of a contract concluded with you (or to take steps at your request before entering into such a contract). In other cases, we rely on our legitimate interests in operating, securing and improving the Platform, on your consent (where required), or on a legal obligation imposed on us by law.

3. Categories of Personal Information and reason for processing

We collect and use your Personal Information so that you can access the Platform, list and view parts, communicate with other Users, and complete secure transactions through the Services. To use the Platform you must hold a Secure Auto Market account, which can be created by direct registration or, where supported, by linking an existing third-party identity provider account (such as a Google or Apple ID).

When linking a third-party identity provider, the information shared with us is used to set up and identify your account. You may also choose to add further details to your profile (for example a profile picture, a city or area, store branding if you are a Vendor, or contact preferences).

A portion of the data we collect is necessary to perform our contract with you. Without it we will not be able to register you or provide the Services. Other data is required to comply with our legal obligations (for example, financial-record retention or anti-money-laundering checks). If you do not provide that information, we may be unable to allow you to transact through the Platform.

To safeguard the Platform, prevent fraudulent activity and combat the listing of stolen, counterfeit or otherwise unlawful parts, we automatically collect behavioural and technical data about Users’ activity. This information is also used to monitor performance and to refine the Platform over time.

The table below sets out, for each category of processing, the data involved, the purpose and the legal basis we rely on. Where more than one ground is shown, we may rely on whichever applies in the circumstances. We may also process your information for any further purpose that is compatible with the original purpose of collection, or where you have consented.

If you would like further detail on any specific legal basis, please contact us at support@secureautomarket.co.za.

Processing activity	Categories of data	Purpose	Legal basis
Account creation and profile management	Identity provider details, full name, e-mail address, telephone number, profile photo, area/city, Vendor store name (where applicable)	Registering and operating a User account on the Platform	Performance of the contract
Communication with the User	Name, telephone number, e-mail address	Sending service messages, transactional updates, billing, dispute correspondence and other communications relating to the Services	Performance of the contract
Parts listings	Information published in a listing such as the part description, condition, fitment / compatibility data, part numbers, photographs, asking price and stock-keeping location	Publishing listings on the Platform and enabling enquiries, offers and purchases between Users	Performance of the contract; Legitimate interests
Identity and FICA verification	Full name, ID or passport number, date of birth, residential address, proof of address, source-of-funds information	Verifying Users where required, complying with anti-money-laundering and anti-fraud obligations, and managing higher-risk transactions	Compliance with legal obligations; Legitimate interests
Payment and payout processing	Account holder name, bank account or card details, payment instrument identifier, transaction history	Processing payment from the Buyer, holding funds in the secure facility and remitting funds to the Vendor after a successful transaction	Performance of the contract; Compliance with legal obligations
Tax-related reporting	Full name, ID number, date of birth, residential address, VAT number (where applicable)	Sharing required information with our accountants and the South African Revenue Service in line with applicable tax legislation	Compliance with legal obligations
Order fulfilment and delivery	Name, contact number, collection or delivery address, courier waybill, tracking and delivery history	Coordinating shipping of orders, whether through an integrated courier partner or directly between Users	Performance of the contract; Legitimate interests
Working with service providers	Business contact information, courier and logistics details, payment-gateway records, hosting and security logs	Integrating logistics, payment and other infrastructure providers necessary to run the Platform	Performance of the contract; Legitimate interests
Transactional notifications	E-mail address, telephone number, push notification token	Sending updates relating to listings, offers, orders, payouts and changes to our Terms or this Privacy Policy	Performance of the contract
In-platform messaging	Sender and recipient identifiers, message content, attachments, time stamps, device information, read/seen status	Allowing Users to communicate about a listing, complete a transaction or follow up after a sale	Performance of the contract; Legitimate interests
User support	Name, e-mail address, profile and account information, transaction history, support ticket content, attachments	Receiving, investigating and responding to queries, complaints and other support requests	Performance of the contract; Legitimate interests
Dispute handling	Information related to the disputed listing or transaction, the Users involved and any supporting evidence supplied	Investigating and resolving complaints, protecting the integrity and safety of the Platform	Legitimate interests; Compliance with legal obligations
Activity and usage information	Pages visited, listings viewed, searches performed, click-stream data, in-app interactions, feedback	Maintaining and improving the Platform and the Services we provide	Legitimate interests
Cookies and similar technologies	Information collected automatically through cookies and similar tools (subject to your cookie preferences)	Operating site features, remembering your settings and supporting analytics or marketing where consented to	Consent (where applicable); Legitimate interests
Hosting, analytics and security	Technical logs, IP address, device identifiers, account and usage information collected automatically	Hosting our Platform, monitoring performance, securing the service and protecting Elixcer against unlawful activity	Legitimate interests; Compliance with legal obligations

We may aggregate or de-identify your information so that it can no longer be linked to you, and use that anonymised information to build statistics, study trends and improve the Services. Anonymised data falls outside the scope of POPIA and the GDPR; if we ever combine such data with other information so that an individual can again be identified, the combined data is again treated as Personal Information under this Privacy Policy. Where the law allows, you can object to processing carried out on the basis of legitimate interests.

Change of purpose

We will only use your Personal Information for the purposes for which it was collected, unless we reasonably consider that we need to use it for a related and compatible purpose. If we need to use your Personal Information for an unrelated purpose, we will let you know and explain the legal basis on which we rely. Please note that we may process your information without your knowledge or consent where this is permitted or required by law.

4. Information used to keep the Platform safe

In order to keep transactions on the Platform lawful and aligned with our Terms, we use technical solutions to detect fraud, suspicious patterns, listings of stolen parts, counterfeit goods and other prohibited activity. To do this we may analyse the contents of listings (including descriptions, photographs and part identifiers) and behavioural information generated by your activity on the Platform.

The legal basis for this processing is our legitimate interest in protecting Users, our partners and ourselves against fraud and other unlawful conduct. Where useful, we may share photographs from a listing or other proof-of-authenticity material with manufacturers, brand owners, parts databases or relevant authorities, without including your contact information, in order to verify the legitimacy of an item.

5. Marketing

You can choose to subscribe to our newsletter and other marketing communications (collectively, "direct marketing"). With your consent we will use your e-mail address (and, where you opt in, push notifications or SMS) to share news, special offers and information about the Platform. You can withdraw consent at any time by adjusting your account settings or following the unsubscribe instructions included in any marketing message.

All direct marketing carried out by Elixcer is based on your consent.

6. Compliance with legal obligations

In some cases we have to process Personal Information to meet legal obligations imposed on us. Examples include:

keeping accounting and financial records;
responding to lawful requests from public authorities, regulators, courts or tribunals;
reporting actual or suspected breaches of applicable law to the Information Regulator, the Financial Intelligence Centre or other supervisory bodies;
responding to enquiries from the South African Police Service or other investigators in connection with stolen, counterfeit or otherwise unlawful goods.

In situations of this kind the legal basis for the processing is the legal obligation imposed on Elixcer.

7. Who can access my Personal Information?

Inside Elixcer, access to Personal Information is given strictly on a need-to-know basis to staff whose duties require it. Limited access may also be granted to selected partners and service providers who carry out functions on our behalf, such as accountants, IT and infrastructure providers, payment service providers, parts and fitment data partners, and courier companies.

8. Recipients of your Personal Information

Elixcer only shares Personal Information where this is necessary and permitted by applicable law. We may disclose Personal Information to the categories of recipient set out below, for the purposes already described:

group entities and affiliates of Elixcer, together with their respective directors, officers and employees, acting either as joint responsible parties or as operators;
external service providers and contractors who act as operators on our instruction, including payment processors, courier and logistics partners, hosting and cloud providers, IT-security and maintenance providers, e-mail and communication services and identity-verification partners;
the South African Revenue Service, the Information Regulator, the Financial Intelligence Centre, the South African Police Service and other government bodies, as required by law;
professional advisers including legal practitioners, bankers, auditors and insurers acting in the course of providing professional services to us;
a prospective buyer, seller, merger partner, financier or other counterparty, in the context of a corporate transaction involving the whole or part of Elixcer’s business or assets. If such a transaction occurs, your Personal Information will continue to be used in line with this Privacy Policy.

Every external service provider must agree to safeguard your Personal Information and may only use it on our written instructions. They are not permitted to use your information for their own purposes.

9. Cross-border transfers

In some cases, your Personal Information may be processed outside the Republic of South Africa, for example where we rely on cloud hosting, software providers or technical contractors based abroad.

Whenever we transfer Personal Information out of South Africa, we use one or more of the following safeguards to give it a level of protection comparable to POPIA:

we transfer the information only to jurisdictions that have data-protection laws substantially similar to POPIA; or
we put written contracts in place with the recipient that incorporate appropriate technical, organisational and contractual protections.

10. How we keep your Personal Information secure

Elixcer implements technical, organisational and physical safeguards designed to protect Personal Information against unauthorised access, loss, damage or destruction. Access to Personal Information is restricted to authorised personnel and granted strictly according to role-based permissions. Information held electronically is stored in protected systems that require secure authentication, and physical records (where any are kept) are stored in controlled premises.

The Platform may include links or references to third-party websites and services, such as social media platforms, payment partners or parts catalogue services. If you follow such a link, you leave the Platform and any data processing on the third-party service is outside our control. We recommend that you review the relevant third party’s privacy notice and cookie information.

11. How long is my information kept?

We keep your Personal Information secure for as long as you have an active account with us, and only retain it for as long as necessary to fulfil the purposes for which it was collected, including any legal, accounting, regulatory or dispute-resolution requirements.

Information required for accounting and tax purposes is retained in line with the relevant legislation and good business practice — generally for at least 5 to 7 years from the end of our business relationship with you, and in any event no longer than 10 years.

Information about your account and transactions on the Platform is kept for the lifetime of the account and for up to 7 years after the account is deleted, in order to allow us to defend or enforce legitimate legal interests.

Information collected through cookies, analytics tags and similar tools is kept for up to 3 years from the date the cookie expires.

You can ask for further detail on our retention practices by writing to support@secureautomarket.co.za.

12. Your rights

In relation to your Personal Information, you have the following rights:

Right	What it means and when you can rely on it
Right to be informed and to access your data	You can ask whether and what Personal Information we hold about you, on what legal basis we are processing it and how. You can also request a copy of the Personal Information we are processing.
Right to correction	You can ask us to correct any Personal Information that is incomplete, out of date or inaccurate.
Right to erasure	You can ask us to delete your Personal Information where it is no longer needed for the purposes for which it was collected, where you have withdrawn the consent on which the processing was based, or where, in the case of processing on the basis of legitimate interest, your rights and interests outweigh ours.
Right to restrict processing	You can ask us to limit our processing where you challenge the accuracy of the data, where you object to processing carried out on the basis of legitimate interest, where it appears that there is no legal basis for our processing but you do not want us to delete the data, or where you need the data to bring or defend a legal claim.
Right to object	Where we rely on legitimate interests, you can object to that processing. You can also object to automated decision-making and to processing carried out for direct-marketing purposes.
Right to data portability	Where we process your Personal Information on the basis of consent or a contract, you can ask us to provide that Personal Information in a structured, commonly used and machine-readable format and, where technically feasible, to transmit it to another controller you nominate.
Right to withdraw consent	Where the processing is based on consent, you can withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of any processing already carried out under the previous valid consent.

Note: these rights are not absolute. Each request will be assessed against applicable law and against the rights of other data subjects, and we may need to verify your identity before responding.

13. Questions and complaints

If you have a question or complaint about how we process Personal Information, please contact us first at support@secureautomarket.co.za. We aim to respond to enquiries within one month of receipt. If we cannot deal with your enquiry within that period, we may extend the response time by a further two months and will explain the reason for the extension within one month of receiving your enquiry.

You also have the right at any time to lodge a complaint with the Information Regulator (South Africa). We would, however, appreciate the opportunity to address your concerns first, so please reach out to us before approaching the Regulator.

14. Will this Privacy Policy change?

We continually work to keep our processing activities and supporting documentation simple, transparent and aligned with current legal requirements and good practice. As a result, this Privacy Policy is reviewed and updated from time to time, and Users are notified of material changes by means of a Platform notification or by e-mail.

You can always find the most recent version of this Privacy Policy on the Platform. It is important that the information we hold about you remains accurate, so please let us know if your details change while you have a relationship with us.

This Privacy Policy may be updated without prior notice and will take effect once an updated version is published on the Platform. By continuing to access or use the Services after that point, you are deemed to have accepted the updated Privacy Policy. We encourage you to review this document from time to time so that you remain familiar with any changes.

— END OF PRIVACY POLICY —