EU & UK Data Protection Addendum

1. Controller information

The VOHARI marketplace operator identified in Legal Information is the controller for platform-level processing it determines. Independent marketplace sellers can be separate controllers for fulfilment, invoicing, warranty and other seller-level obligations.

2. Lawful bases

• Contract: accounts, carts, checkout, orders, delivery, returns and requested support.
• Legal obligation: tax/accounting, regulatory requests, consumer-law records and legally required compliance.
• Legitimate interests: platform security, fraud prevention, service improvement, marketplace analytics, abuse prevention and certain first-party personalisation, balanced against individual rights.
• Consent: where required for specific marketing, non-essential tracking or other optional processing.

3. Individual rights

Subject to legal conditions and exceptions, rights can include access, rectification, erasure, restriction, portability, objection, withdrawal of consent and rights concerning certain automated decision-making. You may also complain to a competent supervisory authority.

4. International transfers

Personal data may be processed in South Africa or by suppliers in other countries. Where a restricted transfer requires safeguards, VOHARI will use an applicable adequacy mechanism, approved contractual clauses, the UK International Data Transfer Agreement/Addendum, or another permitted transfer mechanism, and will perform required transfer assessments where applicable.

5. Representatives and establishments

If VOHARI actively targets users in the EEA or UK at a scale that triggers local representative or establishment obligations, the required representative details will be published before that market is activated. This addendum does not imply that every GDPR jurisdictional threshold currently applies.

6. Retention and minimisation

VOHARI seeks to collect only information reasonably necessary for the identified purposes and applies retention based on transaction, legal, security and dispute requirements. Where feasible, analytics are aggregated or de-identified.

7. Requests

Exercise applicable rights through Privacy Requests & Choices. We may need to verify identity and may refuse or limit a request where the law permits, for example to protect another person’s rights or preserve records required by law.