Privacy Policy

1. Who We Are (Responsible Party)

1.1. In this Privacy Policy, “we”, “us”, or “Innestato” means Innestato Holdings (Pty) Ltd trading as Innestato Auctions, the registered legal entity that operates this auction platform and is the responsible party for your personal information under POPIA.

1.2. This Privacy Policy explains what personal information we collect about you, how we use it, who we share it with, how long we keep it, how we protect it, and the rights you have under POPIA.

1.3. It applies to everyone who uses the Innestato Auctions website (the “Platform”), whether as a bidder, seller, buyer, or casual visitor.

2. What Personal Information We Collect

2.1. Information You Provide at Registration

When you register as a user, we collect the following information as required by Regulation 30 of the Consumer Protection Act (online auctions) and by FICA:

• full name and surname;
• email address and contact telephone number;
• date of birth (you must be 18 or older);
• South African ID number or passport number (verification document);
• physical residential address (street, city, province, postal code, country);
• account password (stored as a one-way hash — we never see your actual password).

2.2. Information We Collect Automatically

When you access the Platform, we automatically collect:

• your IP address at registration and each time you place a bid (as required by CPA Regulation 30);
• browser type, device type, and operating system;
• the date and time of your visits and actions (bids placed, lots viewed, logins);
• session cookies needed to keep you logged in.

2.3. Seller-Specific Information

If you register as a seller, we additionally collect:

• a legible copy of your ID or passport (for FICA customer due diligence);
• banking details for payouts (account holder name, bank, branch code, account number, account type);
• a declaration of ownership for each item consigned.

2.4. Transactional Information

As you use the Platform we record:

• bids placed, lots won or lost, orders created, payments made or received;
• communications and support requests you send us;
• WhatsApp opt-in status and consent timestamp, if you opt in to receive WhatsApp notifications.

2.5. Information We Do Not Collect

We do not collect payment card details. When you pay by card, you enter your card information directly into the Yoco payment gateway — we never see or store your card number, CVV, or PIN.

3. How We Use Your Personal Information

3.1. We process your personal information for the following specific, clearly defined purposes:

4. Legal Basis for Processing

4.1. POPIA requires us to have a lawful basis for processing your personal information. We rely on the following bases:

• Consent — given when you register an account and accept these terms, and separately for WhatsApp notifications (which you can withdraw at any time in your profile).
• Contractual necessity — we need your information to provide the services you’ve asked us for (bidding, payment, collection).
• Legal obligation — FICA, CPA Regulation 30, the Second-Hand Goods Act, and tax law require us to collect and retain certain information.
• Legitimate interest — for fraud prevention, security, and protecting our platform and users from misuse.

5. Who We Share Your Information With

5.1. We do not sell your personal information to anyone. We share it only with the following categories of recipients, and only to the extent necessary:

5.2. We do not share your information for third-party marketing.

6. Cross-Border Transfers

6.1. Some of the service providers we use (notably Yoco’s upstream card processors and WhatsApp / Meta) may process personal information on servers outside South Africa.

6.2. In terms of Section 72 of POPIA, we only transfer personal information across borders where:

• the recipient is subject to a law, binding contract, or binding corporate rules that provide an adequate level of protection;
• you have consented to the transfer; or
• the transfer is necessary for the performance of a contract with you.

6.3. By using WhatsApp notifications, you consent to your phone number and message content being transferred to Meta’s servers.

7. How Long We Keep Your Information

7.1. We keep your personal information only for as long as we need it for the purposes described in this policy, or as required by law.

7.2. Where a longer retention period is required by law (for example if you are party to pending litigation or a regulatory investigation), we will retain the relevant information for as long as the law requires.

8. How We Protect Your Information

8.1. We apply appropriate technical and organisational measures to protect your personal information from loss, misuse, unauthorised access, disclosure, alteration, or destruction:

• Encryption in transit — the Platform is served over HTTPS.
• Encryption at rest for sensitive identifiers — ID numbers and banking account numbers are encrypted using authenticated encryption (libsodium crypto_secretbox). A keyed HMAC-SHA256 hash of your ID number is stored to prevent duplicate registrations without ever needing to decrypt the original.
• Hashed passwords — we never store passwords in plain text; we only store a one-way hash.
• Rate limiting — on login, registration, password reset, bidding, and other sensitive endpoints, to slow down abuse.
• Access control — administrator access is limited to authorised staff; administrator actions on your account (e.g. impersonation for support) are logged for audit.
• Session security — sessions are stored server-side in Redis, not in the cookie.
• Backups — regular encrypted backups so we can recover your data if there is a failure.

9. Your Rights

9.1. Under POPIA you have the following rights regarding your personal information:

• Right to be notified that we are collecting or that there has been a security compromise.
• Right of access — to ask what personal information we hold about you, and for a copy.
• Right to correction or deletion of personal information that is inaccurate, irrelevant, excessive, out-of-date, incomplete, misleading, or unlawfully obtained. Deletion is subject to the legal retention periods set out in Section 7.
• Right to object to the processing of your personal information on reasonable grounds.
• Right to withdraw consent — at any time, for processing that is based on consent (e.g. WhatsApp notifications). Withdrawal does not affect the lawfulness of processing before the withdrawal.
• Right to lodge a complaint with the Information Regulator (see Section 13).

9.2. To exercise any of these rights, email us at info@innestato.co.za from the address linked to your account. We will respond within a reasonable time — typically within 30 days — and may need to verify your identity before acting.

9.3. Where required by the Promotion of Access to Information Act (PAIA), formal access requests may be made using Form 2 of PAIA and sent to the Information Officer at the address above.

10. Cookies and Analytics

10.1. We use a small number of cookies that are strictly necessary to make the Platform work:

• Session cookie — keeps you logged in while you use the site.
• CSRF token — protects you from cross-site request forgery attacks.
• Remember-me cookie (if you tick “remember me”) — so you don’t have to sign in every visit.

10.2. These cookies do not track you across other websites. We do not currently use third-party advertising or cross-site tracking cookies. If we introduce analytics or marketing cookies in the future, we will update this policy and request your consent where required.

11. Children’s Information

11.1. The Platform is not intended for anyone under the age of 18. You may only register if you are 18 or older. If you believe that a child has registered on the Platform, please contact us and we will delete the account and associated information.

12. Changes to this Policy

12.1. We may update this Privacy Policy from time to time — for example when we add a new feature, change a supplier, or where the law changes. The “Last updated” date at the top of this page shows when the policy was last revised.

12.2. Material changes will be communicated by email to registered users. Continued use of the Platform after the effective date of the change constitutes acceptance of the updated Policy.

13. Contact & Complaints

13.1. Information Officer

Privacy queries, access requests, corrections, and complaints are handled by our Information Officer:

13.2. Information Regulator

If we are unable to resolve your complaint, you may refer it to the Information Regulator of South Africa: