Privacy Policy

1. Scope and privacy roles

VOHARI is the responsible party or controller for personal information it determines how and why to process. Independent sellers can also become responsible parties or controllers for customer information they receive to fulfil orders, returns and legal obligations. Payment processors, couriers, hosting providers, security providers and other suppliers may act as operators, processors or separate controllers depending on the service.

2. Personal information we may collect

• Identity and account data such as name, email, telephone number, account type and authentication records.
• Addresses and fulfilment data, including customer delivery addresses and seller collection/return addresses.
• Transaction data, including carts, orders, returns, refunds, fees, invoices and payment-status records. VOHARI does not need sellers to receive a customer’s full card credentials.
• Marketplace activity such as searches, product views, wishlist activity, reviews and support interactions.
• Seller and business information such as trading details, fulfilment contacts, product listings, advertising campaigns and compliance records.
• Technical and security data such as source IP addresses, IP-derived security signals, browser/device and user-agent information, session identifiers, security events, fraud indicators and Turnstile verification results. Access to detailed login-network records is restricted to authorised security/IT administrators.
• Communications and content you submit to support, review, advertising or seller-management features.

3. Why we process personal information

We process information to create and secure accounts; provide catalogue, search and recommendation features; process orders and payments; arrange seller-origin delivery; administer returns and support; calculate fees; prevent fraud; moderate listings and reviews; communicate service messages; measure and improve marketplace performance; comply with law; protect users; and, where permitted, provide marketing or personalised content.

4. Legal grounds where GDPR or UK GDPR applies

Depending on the activity, VOHARI may rely on performance of a contract, steps requested before entering a contract, compliance with legal obligations, legitimate interests that do not override individual rights, consent where consent is legally required, and protection of vital interests in exceptional circumstances. We do not treat acceptance of this Privacy Policy as consent for processing that requires a separate legal basis.

5. Automated ranking, recommendations and risk controls

VOHARI may use algorithms to rank search results, recommend products, detect suspicious activity, prioritise moderation and estimate marketplace risk. The current architecture is intended to support human oversight for consequential operational decisions. VOHARI does not currently enable solely automated decisions that produce legal or similarly significant effects on consumers. If that changes, the policy and controls will be updated before activation.

6. When information is shared

Information may be shared with the seller responsible for your order, payment providers, couriers, hosting and infrastructure providers, security providers, communications providers, professional advisers, authorities when legally required, and other parties involved in a transaction or corporate event. Sellers receive only the customer information reasonably necessary for fulfilment, returns, support and legal obligations.

7. Seller-origin delivery and privacy

After payment is verified, the seller responsible for a fulfilment order may receive the delivery details necessary to prepare and hand over the parcel to the courier. Couriers receive collection and destination information necessary to quote, collect, transport, track and deliver the parcel. Historical order snapshots are retained to preserve an accurate transaction record even if a user later edits an address book entry.

8. International transfers

VOHARI is built in South Africa and may use suppliers or serve users in other countries. Where personal information is transferred across borders, VOHARI will use mechanisms required by applicable law, which may include adequacy decisions, contractual safeguards, binding arrangements, specific statutory permissions or another lawful transfer basis. See the EU & UK Data Protection Addendum for additional information where those laws apply.

9. Security

Controls include encrypted storage for selected platform secrets, password hashing, server-side payment verification, Cloudflare Turnstile support, authentication rate limiting, progressive threat response, network blocking, staff-login review, server-side session revocation, CSRF protections, audit records, access restrictions, security headers and minimisation of seller access to customer data. No system can guarantee absolute security. Security events are investigated and notifications are made when required by applicable law.

10. Retention

We keep personal information only for as long as needed for the purposes for which it was collected, legitimate business records, fraud prevention, dispute handling, tax/accounting duties, statutory retention and legal claims. Account deletion requests do not automatically erase information that must lawfully be retained, such as completed transaction records, fraud evidence or records needed to establish, exercise or defend legal claims.

11. Marketing

Marketing communications are sent only where a lawful basis exists. You can unsubscribe from marketing without stopping essential account, security, payment, order, delivery, return or legal communications. Direct marketing will be managed in accordance with POPIA and other applicable marketing/privacy rules.

12. Your rights

Depending on your location and the law that applies, you may have rights to request access, correction, deletion, restriction, objection, portability, information about recipients, withdrawal of consent, or review of certain automated processing. California and certain other US residents may also have rights concerning sale/sharing, targeted advertising and sensitive information. Submit requests through Privacy Requests & Choices.

13. Children

VOHARI customer accounts are intended for adults. The platform is not designed to collect personal information from children under 13 in the United States. If we learn that such information was collected without legally required parental authorisation, we will take appropriate steps. Additional age restrictions may apply to particular products.

14. Cookies and tracking

VOHARI currently uses essential session and security technologies required to sign users in, protect forms and maintain carts. Non-essential analytics or advertising tracking is not enabled by default in this release. If non-essential tracking is activated, consent and opt-out controls will be introduced where legally required. See the Cookie & Tracking Policy.

15. Complaints and regulators

Contact VOHARI through the privacy request channel first so we can investigate. South African individuals may complain to the Information Regulator. EU/EEA and UK individuals may have the right to complain to a competent supervisory authority where the GDPR or UK GDPR applies. US residents may have complaint rights with state regulators or attorneys general under applicable law.

16. Changes

We may update this policy as the marketplace, law or service providers change. The version and effective date will be updated when a new policy is published.