Privacy Policy

1. Who we are

Fylo Group (Pty) Ltd t/a Fylo Marketplace is the responsible party. Our Information Officer is Refiloe Vuyolwethu Motingoa, vee.motingoa@fylo.co.za.

2. What we collect

From sellers: name, email, and (where relevant to the category) mobile number, city/suburb, and other contact preferences; item details, condition, defects, and other listing information; photographs and any supporting evidence (e.g. receipts, serial numbers) you choose to submit.

From buyers: name, email, mobile number, and collection-area/city information supplied when making a reservation.

Communications: messages you send us, and records of transactional emails sent to you (e.g. reservation confirmations, handover-confirmation links).

Reports and disputes: anything submitted as part of a complaint or report.

Technical/analytics information: only if you actively choose "Allow analytics" — see §10.

3. What we don't do

We do not currently require or operate buyer/seller accounts, so we don't hold login credentials for marketplace users (only Fylo's own administrators authenticate into the private admin system, using separate, unrelated credentials).

4. Why we collect it and our legal basis

To review and publish listings, facilitate reservations and handovers (performance of the arrangement you've asked us to facilitate, and our legitimate interest in running the marketplace); to maintain marketplace integrity, including logging identifying information such as serial numbers for internal anti-theft review (legitimate interest, balanced against your privacy — this information is not automatically made public); to send you transactional emails about your own submission or reservation; to investigate complaints and suspected breaches; and to comply with legal obligations.

5. How buyer and seller contact information is actually shared

Fylo does not operate an open buyer/seller messaging system or public contact-sharing between accounts. Contact is coordinated by Fylo through the reservation process and email — a seller is notified when their item is reserved, and reasonable contact/handover details are shared between the buyer and seller as needed to arrange that specific handover, not published or shared more broadly.

6. Private submission evidence vs public listing content

Raw seller-submitted material (original photos, damage/serial-number photos, receipts, and similar evidence) is stored privately and is not automatically public. Only the specific images and information Fylo selects for a published listing become public marketplace content. Submitting material to Fylo does not mean all of it will be published.

7. Where your information is stored and who processes it

We use third-party service providers to run the platform:

A database and backend platform (Supabase) for storing submissions, listings, reservations, and transaction records, and for our own administrator authentication and file storage.

A transactional email provider (Resend) to send you service emails relevant to your submission, reservation, or handover.

An analytics provider (PostHog), only if you opt in — see §10.

Development/hosting tooling (Lovable) used to build and may be used to host the website, and source-code version control (GitHub) for our codebase — GitHub does not receive ordinary marketplace personal information merely because our source code is stored there.

Some of these providers may process or store information outside South Africa. Where this happens, we take reasonable steps consistent with POPIA section 72 — including relying on providers' data processing agreements and standard contractual safeguards where available — to ensure an appropriate level of protection; see our Operator & Vendor Register for the current list.

8. Retention

We don't keep personal information longer than necessary for the purposes above. Fylo maintains an internal retention schedule covering each category of data it holds this is available on request from privacy@fylo.co.za.

9. Security

We take reasonable technical and organisational steps to protect personal information, including restricting private submission evidence and seller/buyer contact details from public access, and restricting the secure handover-confirmation links to the specific item they relate to.

10. Analytics — opt-in only

Fylo may use PostHog for basic product analytics (for example, page views and how people move through the reservation process), but analytics does not run until you actively choose "Allow analytics." If you choose "Not now," you can still use every part of the site normally, and you can change your choice later through our privacy settings link. Analytics is separate from the transactional emails and core records described above, which are needed to operate the service regardless of your analytics choice.

Session replay. Where enabled after consent, session replay is deliberately restricted: it is disabled, or names/emails/numbers/addresses and similar fields are excluded, on sensitive pages such as seller submission forms, buyer reservation/contact forms, handover-confirmation links, and Fylo's admin system. Where we can't be confident sensitive information would be reliably excluded, replay is switched off for that page rather than risk capturing it.

11. Your rights

You may ask us to confirm, access, correct, or delete personal information we hold about you (subject to legitimate retention needs), object to certain processing, and lodge a complaint with the Information Regulator. Contact vee.motingoa@fylo.co.za.

12. Marketing

Fylo does not currently send marketing or promotional email — only transactional messages tied to your own submission, reservation, or handover. If we introduce newsletters or promotions in future, we will ask for your separate, specific consent before doing so, in line with POPIA section 69.

13. Anonymised and aggregated data

We may produce anonymised or aggregated marketplace insights (e.g. average time-tosale by category) that do not identify you, for research, service improvement, and analytics purposes.

14. Complaints to the Information Regulator

Website: inforegulator.org.za | Complaints: POPIAComplaints@inforegulator.org.za | General enquiries: enquiries@inforegulator.org.za | Tel: +27 10 023 5200 | Address: 27 Stiemens Street, Braamfontein, Johannesburg.

15. Children

Fylo isn't intended for under-18s and we don't knowingly collect their information.

16. Changes to this policy

Material changes will be flagged on the website with an updated effective date.

17. Contact us

Refiloe Vuyolwethu Motingoa | vee.motingoa@fylo.co.za | 67 Van Riebeeck Road, Protea Ridge, Krugersdorp, Gauteng, 1739 | PAIA Manual: www.fylo.co.za/paia-manual