Legal

Privacy Policy

Last updated: June 2026

Survex (Pty) Ltd (“Survex”, “we”, “us”, “our”) is committed to protecting your personal information. This Privacy Policy explains what information we collect, why we collect it, how we use it, and what rights you have under the Protection of Personal Information Act, 2013 (POPIA) of South Africa.

By using the Survex platform — whether as a business owner (seller) or a customer (buyer) — you agree to the collection and use of information described in this policy. If you do not agree, please do not use the platform.

1Who we are

Survex is a South African online marketplace that connects small and medium-sized businesses with customers. Businesses can list products and services; customers can browse, buy, and communicate with sellers. All payments are processed and held in escrow by TradeSafe, a licensed independent third-party escrow provider — Survex does not hold or process funds directly.

Platform name:Survex

Country of operation:South Africa

Data queries:admin@survex.co.za

2What personal information we collect

The information we collect depends on how you use the platform. We collect the minimum necessary to provide the service.

Account information (all users)

·Full name and surname
·Email address
·Phone number
·Date of birth
·Gender
·Ethnicity (voluntary — used only for aggregate analytics, never sold or shared)
·Employment status
·Physical address (street, city/town, province, postal code)

Business profile (sellers only)

·Business name and description
·Business category
·Business logo and header image
·Business location (city, suburb, province)
·Website URL (if provided)
·Delivery preferences and pricing
·Product and service listings (titles, descriptions, prices, images)

Transaction data (buyers and sellers)

·Delivery address at time of order (street, city, town, province, postal code)
·Order amounts and item details
·Order status and timestamps
·Courier and tracking information (when provided by the seller)
·TradeSafe escrow transaction IDs (reference numbers, not financial credentials)

Service conversations and quotes

·Messages exchanged between buyers and sellers in service conversations
·Quote line items, amounts, and accepted/declined status
·Service milestone descriptions and dates
·Service intake form responses submitted by customers

Reviews

·Star rating (1–5)
·Review text submitted by customers after order completion

Usage and analytics data

·Listing view counts (how many times each listing was viewed)
·Business performance metrics derived from your own transactions (revenue, order counts)
·These analytics are visible only to the relevant business owner — they are not sold or shared

Technical data

·Encrypted session tokens (stored in cookies — see our Cookie Policy)
·IP address and browser information collected by our hosting provider (DigitalOcean / Supabase) for security and infrastructure purposes

3How we collect your information

We collect information in the following ways:

→Directly from you — when you register, complete onboarding, place an order, send a message, submit a review, or build a listing.
→Automatically — when you browse the platform (listing view counts, session cookies).
→From Supabase (our auth provider) — when you sign up or sign in — Supabase manages email verification and session tokens on our behalf.
→From TradeSafe (our escrow partner) — transaction reference numbers and allocation status updates when payments are processed.
→From Peach Payments (our payment gateway) — a payment success or failure notification — Peach Payments processes card details on their own secure platform; Survex never sees or stores your card number, CVV, or full banking details.

4Why we use your information (lawful basis)

Under POPIA, we must have a lawful basis for processing your personal information. We rely on the following:

Purpose	Lawful basis
Creating and managing your account	Contract — necessary to provide the service
Authenticating your identity on each visit	Contract — strictly necessary
Processing product and service transactions through escrow	Contract — core platform function
Enabling communication between buyers and sellers	Contract — core platform function
Sending transactional emails (order updates, dispute notices, welcome email)	Contract / Legitimate interest
Displaying business analytics to the business owner	Legitimate interest — business owners need visibility of their own data
Aggregating demographic data for platform insights	Legitimate interest — kept anonymous; never tied to individual profiles in external reporting
Fraud prevention and security	Legitimate interest
Legal compliance	Legal obligation

5Who we share your information with

We do not sell your personal information. We share it only with the following third-party service providers, and only to the extent necessary to deliver the platform:

Supabase

Authentication and database hosting

Data shared: User credentials, session tokens, all platform data stored in our PostgreSQL database

Location: EU / US (data region selectable per project)

TradeSafe

Escrow and payment holding

Data shared: User identity token (name, ID number or passport, bank account for payouts), transaction amounts and allocation IDs. TradeSafe is a registered Financial Service Provider in South Africa (FSP 44816).

Location: South Africa

Peach Payments

Payment gateway (card processing)

Data shared: Order amount and reference number. Card details are entered directly on Peach Payments' PCI-DSS certified pages — Survex never sees or stores card numbers.

Location: South Africa

Resend

Transactional email delivery

Data shared: Your email address and the content of transactional emails (welcome email, order status updates, dispute notifications). No marketing emails are sent.

Location: US

DigitalOcean

Platform hosting and infrastructure

Data shared: Request logs including IP addresses, processed transiently for routing and security. No personal data is stored by DigitalOcean beyond standard access logs.

Location: Global (data centre regions selectable)

We may also disclose information where required by South African law or a court order, or to protect the rights and safety of our users and the platform.

6Buyer and seller data visible to each other

Survex facilitates transactions between buyers and sellers. As part of normal platform operation, some personal information is intentionally visible to the other party in a transaction:

Sellers see: the buyer's delivery address (for product orders), messages sent in conversations, and intake form responses. Sellers do not see the buyer's email address, phone number, or demographic information.
Buyers see: the seller's business name, description, location, and listing details. Buyers do not see the seller's personal profile details beyond what is publicly shown on their business page.

By placing an order or initiating a service conversation, you consent to the minimum necessary information being shared with the other party to fulfil the transaction.

7How we protect your information

✓All data is transmitted over HTTPS (TLS encryption).
✓Authentication sessions are stored in HttpOnly, Secure, SameSite=Lax cookies — they cannot be accessed by JavaScript and are not transmitted to other domains.
✓Database access is restricted to the Survex application layer — no direct public access to the database.
✓Images are stored in private Supabase Storage buckets with access policies; they are not publicly listable.
✓Card payment details are never processed or stored by Survex — all card data is handled by Peach Payments on their PCI-DSS certified infrastructure.
✓TradeSafe identity tokens are encrypted and stored per user — they are used only to interact with TradeSafe's API on your behalf.
✓We do not store passwords — Supabase manages authentication using industry-standard hashing.

8How long we keep your information

Data type	Retention period
Account and profile data	For as long as your account is active. Deleted within 30 days of account deletion request.
Order and transaction records	7 years from the transaction date (required for financial record-keeping under South African law).
Service conversation messages	For as long as the associated service engagement is active, then 2 years after completion.
Reviews	Retained indefinitely as they are public-facing and part of the business record.
Session cookies	Up to 7 days, refreshed on activity. Cleared immediately on sign-out.
Analytics / listing view counts	Aggregated counts retained indefinitely; no individual-level view history is stored.
Dispute evidence	7 years from the dispute resolution date.

9Your rights under POPIA

The Protection of Personal Information Act gives you the following rights regarding your personal information. You may exercise any of these rights by contacting us at admin@survex.co.za.

Right of access

Request a copy of the personal information Survex holds about you.

Right to correction

Ask us to correct inaccurate or incomplete personal information.

Right to deletion

Request that your account and personal data be deleted, subject to legal retention obligations.

Right to object

Object to processing based on legitimate interest where your situation warrants it.

Right to restrict processing

Ask us to limit how we use your data in certain circumstances.

Right to data portability

Request a copy of your data in a structured, machine-readable format.

Right to lodge a complaint

If you believe we have violated POPIA, you may lodge a complaint with the Information Regulator of South Africa.

Right to withdraw consent

Where processing is based on consent, you may withdraw it at any time (this does not affect lawfulness of prior processing).

Information Regulator of South Africa
Website: www.inforegulator.org.za
Email: inforeg@justice.gov.za
Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

10Children's privacy

Survex is not directed at children under the age of 18. We do not knowingly collect personal information from anyone under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at admin@survex.co.za and we will delete the information promptly.

11Cookies

Survex uses only strictly necessary cookies. We do not use advertising or tracking cookies. For full details, please read our Cookie Policy.

12Cross-border data transfers

Survex primarily operates within South Africa, but some of our service providers (see Section 5) are based outside South Africa, including in the European Union and United States. Where data is transferred internationally, we ensure appropriate safeguards are in place, including reliance on providers who are compliant with internationally recognised privacy frameworks (GDPR, SOC 2, ISO 27001).

13Changes to this policy

We may update this Privacy Policy from time to time as the platform evolves. When we make material changes, we will update the “Last updated” date at the top of this page. For significant changes that affect how your data is processed, we will notify you by email. Continued use of Survex after a policy update constitutes acceptance of the revised terms.

14Contact us

For any privacy-related questions, data access requests, or complaints, please contact us:

Survex (Pty) Ltd

Email: admin@survex.co.za

Country: South Africa

We aim to respond to all privacy requests within 30 days, in line with POPIA's requirements.