Privacy notice

Who is responsible?

origintime pty ltd operates FLASHFLOOR. Contact james@origintime.co.za for privacy requests. The supplied address is 7 Salisbury Road; the full postal address and Information Officer contact and registration details still need to be completed before launch.

Information we process and why

We process account email and sign-in information; business name, contact person, city and chosen categories; your business address, SHGA and CIPC registrations, phone and verification checks; failed-deal reports and reviewed strikes; listing descriptions and photos; offers and messages; accepted-deal records; ratings; and the terms version and acceptance time recorded at signup. Technical service logs may contain request and error information.

These records support account access, the marketplace, dealer access decisions, category filtering, offer handling, complaints, security and legal obligations. Processing must have an applicable POPIA justification, such as necessary contractual processing, compliance with law or legitimate interests assessed under POPIA. Agreement to terms is not blanket consent to unrelated marketing.

Business address is mandatory for account participation. Without it you cannot complete signup or continue through the signed-in account pages. Provide only the information requested; do not put identity documents or private seller records into listings.

What others can see

Profiles, including business name, contact name, city, categories and verification status, listings and ratings are publicly readable. Do not put confidential information in those public fields.

Full business addresses and SHGA/CIPC registration details are held separately and readable only by the account owner and platform admins. Once an offer is accepted, only the current deal participants can obtain each other's business phone and account email, together with the shop's verified collection address. This access ends when the failed deal is recovered. Details already received cannot be recalled; use them only for the transaction and lawful recordkeeping, not unsolicited marketing.

Offers are accessible to their dealer, the listing shop and platform admins. Failed-deal reports are private to the participants and admins; reviewed strikes are private to the affected member and admins. Authorised admins can download marketplace records and must safeguard those files. Listing photos are public only once attached to a listing; unattached uploads remain private.

Service providers and lawful sharing

The operator uses Lovable Cloud for hosting, accounts, records and image storage, with email services supporting confirmation and password reset. Payment collection is not yet connected; a payment provider’s identity and privacy terms must be disclosed before paid billing starts.

Information may be disclosed where necessary for service delivery or to comply with lawful authority requests, investigate credible fraud or protect legal rights. Cross-border hosting or processing, if applicable, must satisfy POPIA section 72. The operator must confirm provider locations and appropriate contractual safeguards before launch; this draft does not certify them.

Retention and security

Records must be kept only as long as needed for the stated purposes and applicable legal obligations, then deleted, de-identified or restricted as appropriate. The operator’s detailed retention schedule, backup deletion timetable and statutory-record responsibilities must be finalised before launch. Traders must maintain their own required second-hand-goods records; platform backups do not replace them.

Access controls protect addresses and offers, but no online service is risk-free. The operator must maintain appropriate organisational safeguards, secure downloaded backups and respond to security compromises, including notifications required by POPIA. Do not share passwords or place confidential data in public fields.

Your rights and complaints

Subject to lawful limitations, you may request access, correction, deletion or restriction of personal information and object to processing where POPIA permits. Email the privacy contact with the nature of your request. We may require proportionate identity verification and must explain any lawful reason to retain records.

You may lodge a complaint with the South African Information Regulator. This notice does not waive your rights.

Sign-in storage and trader responsibilities

The service uses browser storage and session mechanisms to maintain sign-in. Signing out ends app access on that device; clearing browser storage may require signing in again. A separate consent choice must be provided before any non-essential tracking that requires consent is introduced.

Shops and dealers are responsible for lawful processing of personal information they collect independently for identity checks, statutory registers, invoicing or collection. Do not reuse another participant’s information for unrelated marketing without a lawful basis.