Privacy policy (POPIA)

Yazi (yazi.africa) is a fresh-produce shop with delivery, and a host for independent vendor stores on yazi.africa subdomains. It is operated by ERRATHEN (Pty) Ltd, South Africa ("we", "us"), the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA). This policy explains what personal information we process, why, for how long, and your rights.

1. Customers of the Yazi shop

When you place an order on yazi.africa we process:

• Your delivery location.The website asks your browser for your GPS position each time you open it, or you can type an address. The position is converted to a readable place name through Mapbox so you can check it, and the pin is saved with your order as the delivery point. We never show the typed address to the driver as "the address"; the driver gets the pin and a nearby place name.
• Your order: items, quantities, total, order number, and the time it was placed. An order that is not followed by your WhatsApp message within 24 hours is deleted automatically.
• Your WhatsApp number and profile name, taken from the WhatsApp message you send to confirm the order. These create your customer record, together with your delivery pin.
• Your messages to and from our WhatsApp number (text, images, locations), which we keep for 90 days to run your order and answer support questions, then delete.
• Delivery and payment status: which driver delivered, when, and that payment was made at the door. We do not take or store card details or bank credentials; PayShap and EFT payments go directly to our bank.

To deliver, we share your name, WhatsApp number and delivery pin with the driver assigned to your order, and we send you the driver's name and number. Drivers may be our own staff or independent delivery partners and may only use your details to complete that delivery.

2. Drivers

Drivers are registered by phone number and name. While a driver is on shift or carrying a delivery, their tracking page sends their GPS position to us every few seconds so we can offer them nearby deliveries, give customers an arrival estimate and remind them if the connection drops. The most recent position is kept on their record; it is not kept as a history.

3. Vendors (store owners)

For an existing vendor store we hold:

• the username (public: it is the store name and web address) and display name;
• the WhatsApp phone number that identifies the account and receives login codes and customer orders;
• the business location (coordinates and a readable address), store text, hours and delivery fee (all public);
• the products or service sections listed, including uploaded photos and any logo;
• messages exchanged with our WhatsApp number, kept for 90 days.

Login codes are sent through WhatsApp; only a hashed form of each code is stored, for at most 24 hours. Orders on a vendor store go straight from your device to the vendor's WhatsApp: we do not receive or store them, and from that point the conversation is between you and the vendor under WhatsApp's own terms.

4. Visitors and statistics

We keep anonymous usage statistics (pages viewed, products opened, orders started and sent, search terms) to understand how Yazi is used. They contain no names or contact details; a short-lived code derived from your connection lets us count unique visitors per day without storing your IP address.

5. Cookies and local storage

Vendors get one strictly necessary session cookie after logging in, and our staff get one for the back office. Shoppers get none. We use no advertising or tracking cookies.

6. Who processes data for us

• Hetzner Online GmbH (Germany) hosts our servers and database.
• Meta Platforms Ireland Ltd provides the WhatsApp Business Platform our number runs on.
• Mapbox, Inc. (USA) converts addresses and coordinates into place names and calculates driving routes and distances.
• Cloudflare, Inc. provides DNS for yazi.africa.

Hosting is in the European Union and some providers are outside South Africa. Each is bound by contract terms that require a level of protection substantially similar to POPIA (section 72).

7. Why we may process your information

We process customer and vendor data to perform the contract with you (POPIA section 11(1)(b)); delivery, driver and support data to pursue our legitimate interest in running a delivery service safely (section 11(1)(f)); and your GPS position on the basis of the consent you give through your browser's location prompt (section 11(1)(a)), which you may refuse by typing an address instead.

8. How long we keep it

• Unsent (unconfirmed) orders: 24 hours.
• WhatsApp messages: 90 days.
• Confirmed orders: as long as tax and accounting law requires us to keep sales records, generally 5 years.
• Customer and driver records: until you ask us to delete them, or we no longer need them.
• Vendor stores: as long as the store exists; a vendor can delete the store and all its data by messaging us.

9. Your rights

You may ask us for access to, correction or deletion of your personal information, or object to our processing of it, by messaging us on WhatsApp at the number below. Where we must keep a record by law (for example a sales record) we will tell you. You may also complain to the Information Regulator (South Africa), complaints.IR@justice.gov.za, or, if you are in the EU, to your national data protection authority.

10. Children

Yazi is for adults. We do not knowingly process the personal information of anyone under 18.

11. Contact

ERRATHEN (Pty) Ltd, registration number 2026/745713/07. 34 Second Street, Linden, Johannesburg, South Africa. WhatsApp and phone: +27 72 989 8997. WhatsApp is our only support channel; we do not offer email support.