Privacy Policy
§ 01 Responsible Party and Information Officer
In terms of POPIA, the Responsible Party — the entity that determines the purpose and means of processing your personal information — is:
| Entity | BeforeYouSign (Pty) Ltd |
| Jurisdiction | Republic of South Africa |
| Information Officer | Director / Privacy Officer of BeforeYouSign (Pty) Ltd |
| Information Officer Email | privacy@beforeyousign.co.za |
| Website | www.beforeyousign.co.za |
§ 02 Scope of This Policy
This Privacy Policy applies to all Visitors (unauthenticated users), Dealers (Owners and Staff), Members (subscribers), and any other person whose personal information is processed through the Platform. It does not apply to third-party websites or services linked to from the Platform.
§ 03 Our Commitment to Privacy and Constitutional Values
3.1 Constitutional Right to Privacy
Section 14 of the Constitution provides that everyone has the right to privacy. We embrace this right as a foundational value that informs all of our data practices — not merely as a compliance obligation.
3.2 POPIA Conditions of Lawful Processing
We process personal information only in accordance with the eight conditions prescribed in POPIA Chapter 3: Accountability, Processing Limitation, Purpose Specification, Further Processing Limitation, Information Quality, Openness, Security Safeguards, and Data Subject Participation.
§ 04 What Personal Information We Collect
4.1 All Registered Users (Dealers and Admins)
| Field | Description |
|---|---|
| Full name | As provided at registration |
| Email address | Login identifier and communications |
| Password (hashed) | Stored as a bcrypt hash — never in plain text |
| Phone number | Contact telephone number |
| IP address (login) | Logged for audit and security purposes |
| Session data | Login session stored server-side in PostgreSQL |
4.2 Dealers — Dealership Information
Business name, CIPC company registration number, VAT registration number (if applicable), physical address, business contact phone and email, approval status, and timestamps.
4.4 Members — Consumer Membership Data
| Field | Sensitivity |
|---|---|
| Full name | Personal |
| South African ID number | Special / Sensitive |
| Email address | Personal |
| Mobile number | Personal |
| Physical address (optional) | Personal |
| Province (optional) | Personal |
| Membership tier & amount | Personal |
| Consent records (type, timestamp, IP) | Legal Record |
| PayFast payment ID | Financial Reference |
| PayFast subscription token | Financial Reference |
4.5 Audit Log Data
Actor user ID, action type (e.g., login, vehicle_submitted, dealer_approved), entity type and ID, contextual metadata, and timestamp. Retained for compliance and security.
4.7 Technical and Usage Data
IP addresses (for consent audit trail and session activity), HTTP session cookies, and standard server access logs.
§ 05 How We Collect Personal Information
| Method | Examples |
|---|---|
| Directly from you | Registration forms, membership join forms, vehicle listing forms, profile updates |
| Automatically | Session cookies, server access logs, IP address capture |
| Via third parties | PayFast (payment confirmation, subscription token); Cloudinary (file metadata) |
| Via staff invitation | Email address provided by a Dealer Owner when inviting a team member |
§ 06 Why We Process Personal Information (Purpose & Legal Basis)
| Purpose | Legal Basis (POPIA) |
|---|---|
| Account registration and authentication | Contractual necessity |
| Dealership application review and approval | Contractual necessity |
| Vehicle listing, verification, and report generation | Contractual necessity; legitimate interest |
| Membership subscription processing | Contractual necessity; consent (ID number processing) |
| Payment processing via PayFast | Contractual necessity; statutory obligation |
| Transactional email communications | Contractual necessity |
| Email verification | Contractual necessity |
| Password reset and account security | Legitimate interest |
| Fraud prevention and platform integrity | Legitimate interest |
| Audit and compliance logging | Legitimate interest; statutory obligation |
| Legal and regulatory compliance | Statutory obligation |
§ 07 Special / Sensitive Personal Information
7.1 South African ID Numbers
Your SA identity number is classified as sensitive personal information under POPIA regulations. We collect it exclusively for identity verification to prevent duplicate memberships, compliance with payment regulations, and fraud prevention. Your ID number is:
- Accessible only to authorised BeforeYouSign personnel with a legitimate need
- Never shared with third parties for marketing or profiling
- Processed in accordance with POPIA Section 26 and applicable regulations
7.2 Financial Information
We do not store credit card numbers, bank account numbers, CVV codes, or other payment credentials. All payment processing is handled exclusively by PayFast. We receive only a payment reference ID and subscription token.
§ 08 How We Use Your Information
- To provide and maintain the Platform — create accounts, process dealership applications, generate Vehicle Reports, process membership subscriptions, send transactional emails
- To communicate with you — account notifications, listing status updates, security alerts, verification emails, policy change notifications
- For security and fraud prevention — audit logs, IP address analysis, blocking duplicate membership applications
- For legal and regulatory compliance — court orders, POPIA access requests, mandatory record retention, enforcing Terms of Use
§ 09 Who We Share Your Information With
9.1 Operators (Processors)
| Operator | Purpose | Location |
|---|---|---|
| Neon (Neon Inc.) | PostgreSQL database hosting | USA |
| Cloudinary | Vehicle image and document cloud storage | USA |
| PayFast (Peach Payments (Pty) Ltd) | Payment processing | South Africa |
| Google (Gmail) | Transactional email delivery | USA |
9.2 Law Enforcement
We may disclose personal information to law enforcement, regulators, or courts when legally required. We will notify affected data subjects where legally permitted to do so.
9.4 Aggregate Data
We may share aggregated, anonymised statistics (e.g., verified vehicles count, membership numbers) with third parties. Such data cannot reasonably be used to identify individuals.
§ 10 Cross-Border Transfers
In accordance with POPIA Section 72, we only transfer personal information to countries that provide an adequate level of protection, or are bound by standard contractual clauses meeting POPIA's requirements. Our USA-based operators (Neon, Cloudinary, Google) are subject to POPIA-compliant data processing agreements. PayFast is a South African entity.
§ 11 Security Measures
| Measure | Implementation |
|---|---|
| Password hashing | bcrypt with cost factor 12 — never stored in plain text |
| CSRF protection | Double-Submit Cookie pattern on all state-changing requests |
| Security headers | Helmet middleware: CSP, X-Frame-Options, HSTS, Referrer-Policy |
| Session security | httpOnly, sameSite: strict, secure cookie flags; server-side storage |
| Input validation | express-validator on all user-supplied inputs |
| Rate limiting | express-rate-limit to prevent brute-force attacks |
| HTTPS | All production traffic served over TLS/HTTPS |
| Parameterised queries | All database queries use parameterised statements (no SQL injection) |
| Payment security | MD5 signature validation on all PayFast ITN callbacks |
11.3 Breach Notification
In the event of a security breach likely to prejudice you, we will notify the Information Regulator as soon as reasonably possible, and notify affected data subjects where the breach poses a real risk of harm, in accordance with POPIA Section 22.
§ 12 Data Retention
| Data Category | Retention Period |
|---|---|
| Active user account data | Duration of account + 3 years |
| Dealership records | Duration of activity + 5 years |
| Vehicle listing data and verified reports | Indefinitely (public interest) |
| Member records (active) | Duration of membership + 5 years |
| Member records (cancelled) | 5 years from cancellation |
| Pending member records (unpaid) | Auto-purged after 30 minutes |
| Audit log records | 7 years (financial/compliance standard) |
| Password reset tokens | 1 hour (expires and invalidated on use) |
| Email verification tokens | 72 hours (expires and invalidated on use) |
| Staff invitation tokens | 48 hours (expires and invalidated on use) |
| Session data | 24 hours (session cookie maxAge) |
§ 13 Cookies and Session Data
13.1 Session Cookie
We use a single session cookie that is httpOnly, sameSite: strict, and secure in production. It expires after 24 hours and contains only a session identifier — no personal information.
13.3 No Tracking or Advertising Cookies
We do not use third-party advertising cookies, cross-site tracking cookies, analytics platform cookies (e.g. Google Analytics), or social media tracking pixels.
§ 14 Your Rights as a Data Subject
In terms of POPIA Chapter 2 (Part A) and Section 23, you have the following rights:
Request confirmation and a copy of personal information we hold about you.
Request correction or deletion of inaccurate, outdated, or unlawfully obtained information.
Request deletion, subject to our legal obligations to retain certain records.
Object to processing based on our legitimate interest, or to direct marketing (absolute right).
Request your information in a structured, machine-readable format where feasible.
Lodge a complaint with the Information Regulator if you believe we have violated POPIA.
To exercise any right, email privacy@beforeyousign.co.za with your full name, email address, the nature of the request, and a copy of your ID for verification. We will respond within 30 days.
JD House, 27 Stiemens Street, Braamfontein, Johannesburg
Email: complaints.IR@justice.gov.za | Tel: 010 023 5207 | www.inforeg.org.za
§ 15 Children's Privacy
The Platform is not intended for persons under 18 years of age. If we discover we have inadvertently collected information from a minor without verifiable parental consent, we will delete such information promptly. Contact privacy@beforeyousign.co.za if you are a parent or guardian with concerns.
§ 16 Direct Marketing
We may send direct marketing communications only where you have given explicit consent, or you are an existing customer and the communication relates to our own similar services and you have not opted out. Every marketing email includes a functional unsubscribe mechanism. Opt-outs are processed within 30 days. We do not share your personal information with third parties for their direct marketing purposes.
§ 17 Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes will be communicated via email and/or a notice on the Platform. Your continued use of the Platform after changes are communicated constitutes acceptance of the updated Policy.
§ 18 How to Contact Us
| Purpose | Contact |
|---|---|
| General Privacy Enquiries | privacy@beforeyousign.co.za |
| Access / Correction / Deletion Requests | privacy@beforeyousign.co.za |
| POPIA Complaints (Internal) | privacy@beforeyousign.co.za |
| General Support | support@beforeyousign.co.za |
www.inforeg.org.za | complaints.IR@justice.gov.za | 010 023 5207
© 2026 BeforeYouSign (Pty) Ltd — Republic of South Africa. All rights reserved. Last reviewed 28 August 2026.