Fazo Privacy Policy
Version 1.1 — pending final operator sign-off
This policy explains how CAMEL PROPERTIES (PTY) LTD (registration number 2026/228653/07), operator of the Fazo marketplace ("Fazo", "we", "us"), processes personal information under the Protection of Personal Information Act 4 of 2013 (POPIA).
1. Responsible party and Information Officer
Responsible party: CAMEL PROPERTIES (PTY) LTD, 17 New Church Street, Cape Town, Western Cape, 8001, South Africa.
Information Officer (POPIA s55): Director, CAMEL PROPERTIES (PTY) LTD — support@fazo.co.za.
General support: support@fazo.co.za.
2. Personal information we collect
| Category | Examples | Stored by Fazo? |
|---|---|---|
| Account | Name, email, password (hash), optional phone, suburb/city, profile photo | Yes |
| Bank Verification | SA ID or passport, mobile, bank and account number | No — sent directly to TradeSafe with your consent; we store only a TradeSafe token reference |
| Marketplace activity | Listings, photos, offers, chat messages, orders, reviews | Yes |
| Payments | Amounts, escrow status, TradeSafe references | Yes (metadata only — not card numbers) |
| Technical | Session cookies, IP address at sign-up/consent, server logs | Yes (limited) |
3. Why we process it (purpose and lawful basis)
- Provide the Platform — account management, listings, chat, offers (contract / legitimate interest).
- Safe Pay — escrow orders, notifications, fraud prevention (contract / consent for KYC sharing).
- Trust and safety — automated chat filtering for phone numbers and off-platform apps; admin review of reports (legitimate interest / legal obligation).
- Transactional email — payment, handover, and account notices only. We do not send marketing without separate consent.
- Legal retention — tax, audit, and dispute records (legal obligation).
4. Who we share it with
We do not sell personal information. We share data only with:
4.1 South African operators
- TradeSafe Escrow (Pty) Ltd — Bank verification, escrow, card/bank payments, seller payouts. See https://tradesafe.co.za.
4.2 Service providers (may process data outside South Africa)
- Railway Corp. (United States) — Application hosting and PostgreSQL database. Safeguard: Contractual data-processing terms and encryption in transit/at rest.
- Cloudflare, Inc. (United States) — Object storage (R2) for listing photos. Safeguard: Contractual terms; data stored in Cloudflare network regions as configured.
- Resend, Inc. (United States) — Transactional email delivery. Safeguard: Contractual terms; email content limited to transactional notifications.
Cross-border transfers comply with POPIA section 72 using contractual safeguards and encryption in transit.
We may also disclose information where required by law or to protect rights and safety.
5. Security measures
- HTTPS/TLS for all traffic; HSTS in production
- Passwords hashed with bcrypt (cost factor 12); sessions stored server-side with hashed tokens
- httpOnly, Secure, SameSite session cookies
- Login rate limiting and account lockout
- ID and bank numbers masked in application logs
- Role-based admin access; suspended accounts cannot use the Platform
- Upload validation (size and file-type checks) for listing photos
No system is perfectly secure. Report suspected breaches immediately to support@fazo.co.za.
6. Retention
- Completed transactions and escrow audit trails: up to 5 years (tax, consumer, and dispute requirements).
- Consent records: 5 years.
- Server logs: up to 12 months.
- Deleted accounts: profile fields are anonymised; transaction rows may remain linked to an anonymised user ID for the retention period above.
7. Your rights under POPIA
You may:
- Request access to your personal information
- Request correction of inaccurate information
- Request deletion (subject to legal retention limits)
- Object to processing where applicable
- Withdraw consent for optional processing (e.g. KYC sharing — may limit Safe Pay use)
- Lodge a complaint with the Information Regulator at inforeg.org.za
In the app: go to Profile → Edit profile → "Download my data" or "Delete account".
By email: contact support@fazo.co.za. We verify your identity before responding and aim to reply within 30 days.
8. Cookies
We use strictly necessary session cookies only (fazo_session) to keep you signed in. We do not use third-party advertising cookies.
9. Children
The Platform is for users aged 18 and over. We do not knowingly collect data from minors.
10. Automated decision-making
Chat messages are automatically scanned for phone numbers and off-platform contact apps to enforce Safe Pay rules. Flagged messages are blocked; reports may be reviewed by staff.
11. Changes to this policy
Material changes will be posted here with an updated version number. We may require renewed acceptance before continued use.
See also our Terms and Conditions.
CAMEL PROPERTIES (PTY) LTD · Reg. 2026/228653/07 · 17 New Church Street, Cape Town, Western Cape, 8001, South Africa