Legal
Privacy Policy
Last updated: 29 July 2026. This policy explains how EStall processes personal information under the Protection of Personal Information Act 4 of 2013 (POPIA) when you use our marketplace platform.
1. Responsible party
EStall operates the platform and determines why and how personal information is processed for account, checkout, fulfilment, and support purposes described here. Creators who receive buyer information to fulfil orders act as separate responsible parties for their own use of that data.
2. Information we collect
We may process identity and contact details, account credentials managed through our authentication provider, order and payment references, shipping and collection details, digital fulfilment metadata, storefront content, communications, support messages, device and log information, and settings you choose such as notification preferences.
Payment card and banking details are handled by payment providers such as Payfast. EStall does not store full card numbers.
3. Why we use personal information
We process information to create and manage accounts, authenticate users, process orders and payments, display storefronts, share fulfilment details with creators, operate order status and payout workflows, prevent fraud, provide support, send service notifications, improve the platform, and comply with law.
Where required by POPIA, we rely on appropriate grounds such as contract performance, legitimate interests in operating a secure marketplace, legal obligation, or consent where consent is requested separately.
4. Sharing with creators and service providers
When you buy from a creator, we share the information reasonably needed for fulfilment, such as name, contact details, delivery or collection information, order contents, and any notes required for service delivery. Creators must use that information only for the relevant order and in line with POPIA and their own policies.
We use infrastructure, authentication, payment, messaging, storage, and analytics providers strictly to operate the service. Those providers process data under contractual controls appropriate to their role.
5. Cross-border processing
Some service providers may process information outside South Africa. Where that happens, we take reasonable steps required by POPIA for lawful cross-border transfers, such as using providers with appropriate safeguards or contractual protections.
6. Retention
We retain personal information only for as long as needed for the purposes described in this policy, including order records, tax and accounting needs, dispute handling, fraud prevention, and legal compliance. When information is no longer required, we delete or de-identify it where reasonable.
7. Security
We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration, or disclosure. While we strive to protect your information, no online platform can guarantee absolute security. Users are responsible for maintaining the confidentiality of their account credentials.
8. Your POPIA rights
Subject to POPIA, you may request access to, correction of, or deletion of your personal information, object to certain processing, withdraw consent where processing is consent-based, or lodge a complaint with the Information Regulator.
Contact EStall support through the channels published on the platform to submit a privacy request. We may need to verify your identity before responding.
9. Cookies and similar technologies
We use cookies and similar technologies needed for sign-in, session management, security, and core platform functionality. Additional analytics or marketing cookies, if introduced later, will be described in an updated version of this policy.
10. Disclosure Required by Law
We may disclose personal information where required by law, court order, regulatory authority, or to protect the rights, safety, or property of EStall, our users, or the public.
11. Children
EStall is not intended for children under 18. We do not knowingly collect personal information from children.
13. Payments
Payments are securely processed by third-party payment providers, including PayFast. EStall does not store or have access to your full payment card details.
13. Changes
We may update this policy from time to time. Material changes will be posted on this page with an updated date.
14. Account Deletion
Users may request deletion of their account by contacting support. Certain information may be retained where required for tax, fraud prevention, dispute resolution, or legal compliance.
15. Contact
For privacy-related questions or requests, contact us at:
Email: privacy@estall.co.za
Support: support@estall.co.za
Website: https://estall.co.za
We will respond to legitimate requests within a reasonable time and may verify your identity before processing your request.