Privacy Policy

Who is responsible for your information

GH Easy - Pocket (Pty) Ltd, trading as Crafta, is the responsible party for personal information collected through this website. Our Information Officer can be reached using the contact details at the bottom of this page.

What we collect

When you create an account

• Your first name, surname, email address, and whether you joined as a buyer or seller.
• Your password, which is stored only in securely hashed form. We cannot see your actual password.

When you place an order

• Your name, surname, email address, and mobile number.
• Your delivery address, including suburb, city, province, and postal code.
• The items you ordered, order totals, order status, and courier tracking details.

When you sell on Crafta

• Your seller name and the product names, descriptions, prices, and photos you submit.

When you contact us

• Messages you send us by WhatsApp, phone, or email, and any details you include.

Payment information

No payments are taken on Crafta yet. When online payments through Payfast go live, your card or bank details will be entered directly on Payfast's secure payment page. Crafta will never see or store your full card details. We will only receive confirmation of whether a payment succeeded, along with a payment reference.

Cookies and technical information

We only use essential cookies that the site needs to work:

• crafta_session keeps you signed in to your account (expires after 14 days).
• crafta_cart remembers the items in your cart (expires after 60 days).

We do not use advertising or tracking cookies. Our hosting providers may automatically record basic technical information, such as your IP address and browser type, to keep the site secure and running.

Why we use your information

• To process, deliver, and support your orders, including sharing updates about your order.
• To create and manage your account, order history, saved addresses, and wishlist.
• To review and publish seller product listings.
• To respond to your questions, returns, and complaints.
• To keep the site secure and prevent fraud and misuse.
• To meet our legal obligations, such as keeping transaction records for tax purposes.

We do not send marketing messages without your consent. If we introduce a newsletter, it will be opt-in and you can unsubscribe at any time. We do not sell your personal information.

Who we share it with

We only share personal information where it is needed to run Crafta, with service providers who are required to keep it confidential and secure:

• Couriers receive your name, mobile number, and delivery address to deliver your order.
• Hosting, database, and file storage providers store the website, account and order data, and product images on our behalf.
• Payfast (once online payments go live) processes your payment securely.
• Authorities, where we are required to by law.

Information stored outside South Africa

Some of our technology providers store data on servers outside South Africa, including in the United States. As required by section 72 of POPIA, we only use providers that are bound by law or by agreement to protect your information to a standard substantially similar to POPIA.

How we protect your information

• Passwords are hashed and never stored in plain text.
• Sign-in and cart cookies are HTTP-only and are sent over encrypted (HTTPS) connections in production.
• Admin areas are restricted to authorised Crafta staff.
• Payment details will be handled by Payfast, not by Crafta.

How long we keep it

We keep personal information only for as long as we need it for the purposes above, or as long as the law requires. Order and transaction records are generally kept for five years to meet tax record-keeping requirements. If you ask us to close your account, we delete or de-identify your account information, apart from records we must keep by law.

Your rights

Under POPIA you have the right to:

• ask whether we hold personal information about you, and request a copy of it;
• ask us to correct or update information that is inaccurate or incomplete;
• ask us to delete information we no longer have a lawful reason to keep;
• object to us processing your information, and withdraw any consent you have given;
• lodge a complaint with the Information Regulator (South Africa).

To use any of these rights, please contact us. We may need to confirm your identity before acting on your request.

Children

Crafta is not intended for children under 18. We do not knowingly collect personal information from children without the consent of a parent or guardian.

Changes to this policy

We may update this policy from time to time, for example when online payments go live. The "last updated" date at the top shows when it last changed.