1. Who we are and the scope of this Policy

1.1 “AutomotiveHub”, “we”, “us” and “our” refer to [LEGAL ENTITY NAME], registration number [REGISTRATION NUMBER], trading as AutomotiveHub, with its principal place of business at [PHYSICAL ADDRESS].

1.2 This Privacy Policy applies when you visit or use https://automotivehub.co.za, any related mobile site or application, dealer portal, messaging channel, call centre, physical dealership, social-media lead form or other service that links to this Policy (collectively, the “Platform”).

1.3 For personal information that AutomotiveHub determines the purpose and means of processing, AutomotiveHub is the “responsible party” under POPIA. Our Information Officer can be contacted using the details in clause 21.

1.4 This Policy should be read with our Terms of Use, Cookie Policy, PAIA Manual, any dealer or seller terms, and any transaction-specific notice presented when you request finance, insurance, a valuation, a test drive or another service.

1.5 A dealer, private seller, credit provider, insurer, inspection provider, delivery provider or other third party may be a separate responsible party for information it receives and uses for its own purposes. Its privacy notice will apply to that processing.

2. Key terms

“Buyer” means a person browsing for, enquiring about or purchasing a vehicle or related service. “Seller” means an independent dealer, group, private seller or AutomotiveHub when it is expressly identified as the seller. “Dealer” includes the dealer entity and its authorised personnel. “Lead” means an enquiry or request that a user asks us to transmit to an identified seller or service provider. “Personal information”, “processing”, “data subject”, “operator” and “responsible party” have the meanings given to them in POPIA.

3. Personal information we collect

Depending on how you use the Platform, we may process the following categories of personal information:

• Identity and contact details, such as name, identity or passport number where verification is required, date of birth, company name, job title, email address, telephone number, delivery or residential address and preferred contact method.
• Account and authentication information, such as usernames, encrypted passwords, one-time passwords, security questions, account permissions and login history.
• Dealer, vendor and seller onboarding information, such as company registration details, tax or VAT details, beneficial ownership information, dealership or industry registration details, authorised-user information, proof of address, banking confirmation and other due-diligence documents.
• Vehicle and listing information, such as make, model, derivative, year, colour, mileage, vehicle identification number, registration number, photographs, videos, condition, service history, ownership documents, warranty information, asking price, trade-in details and listing performance.
• Enquiry and communications information, such as saved vehicles, alerts, messages, forms, call recordings where notice has been given, emails, chat transcripts, appointment or test-drive requests, feedback, reviews, complaints and support records.
• Transaction and payment information, such as listing packages, invoices, payment status, refunds, transaction references and limited payment metadata. Full card details should be collected and stored by an authorised payment processor rather than by AutomotiveHub unless expressly stated.
• Finance, insurance and affordability information that you choose to submit for a requested service, which may include identification, employment, income, expense, banking, credit-related and supporting-document information. A separate notice or consent may be presented before this information is shared with an authorised provider.
• Device, usage and technical information, such as IP address, browser, device identifiers, operating system, pages viewed, search filters, referring URLs, session times, crash data and security logs.
• Approximate or precise location information where you enable location services or request location-based results.
• Cookie, analytics and advertising information described in clause 12.
• Fraud, safety and compliance information, such as suspected scam indicators, blocked accounts, verification outcomes, sanctions or public-record checks where lawful, incident reports and evidence needed to protect users or enforce our terms.
• Marketing choices and consent records, including the date, channel, wording and source of a consent, objection, unsubscribe request or preference update.

We do not intentionally process special personal information or personal information of children unless it is necessary, lawful and subject to the safeguards required by POPIA. Where biometric, criminal-behaviour or other special information is genuinely required for verification or fraud prevention, we will provide an appropriate notice and rely on a lawful authorisation.

4. How we obtain personal information

• Directly from you when you browse, register, publish or manage a listing, submit an enquiry, communicate with us, make a payment, request a valuation or apply for a related service.
• From dealers, private sellers, vehicle owners, employer or company representatives that create or administer accounts and listings.
• From service providers that support hosting, authentication, communications, payments, analytics, advertising, fraud prevention, identity verification, call handling or customer support.
• From authorised finance, insurance, inspection, delivery or other partners when needed to administer a request you initiated or to receive a status update.
• From public or lawful third-party sources, such as company registers, vehicle-data providers, public websites, sanctions lists, social-media platforms or advertising networks, where the collection and use are lawful.
• Automatically through cookies, logs and similar technologies when you use the Platform.

5. When providing information is mandatory or optional

Some information is mandatory because we cannot create an account, publish a listing, verify a seller, process a payment, answer a request, meet a legal obligation or complete a transaction without it. Other information is optional. We will indicate material mandatory fields where reasonably practicable. If you do not provide required information, we may be unable to provide the relevant feature or service.

6. Why we process personal information

We process personal information only where a justification recognised by POPIA applies, including consent, performance of a contract, compliance with law, protection of your legitimate interests, protection of our or a third party’s legitimate interests, or another lawful ground. We use personal information to:

• provide, personalise, maintain and improve the Platform and user accounts;
• publish, index, promote, measure and manage vehicle listings and dealer profiles;
• connect buyers with the seller identified on a listing and transmit requested enquiries, messages, appointments and test-drive requests;
• identify and verify users, dealers, sellers, vehicles and ownership or authority to list;
• process listing fees, subscriptions, invoices, refunds and other authorised payments;
• provide search, recommendation, valuation, comparison, alert and market-insight features;
• route a requested finance, insurance, inspection, warranty, delivery or other value-added-service enquiry to an appropriate authorised provider;
• communicate service messages, account notices, security alerts, transaction updates and responses to support requests;
• detect, prevent, investigate and respond to fraud, scams, misuse, cyber incidents, prohibited content and violations of our terms;
• moderate or remove content and enforce legal rights, contracts, platform rules and listing standards;
• comply with legal, tax, accounting, regulatory, court, law-enforcement and recordkeeping requirements;
• analyse usage, dealer performance, listing performance, demand and market trends, using aggregated or de-identified information where appropriate;
• send direct marketing where permitted by law and consistent with clause 11;
• establish, exercise or defend legal claims and resolve complaints or disputes;
• support a corporate transaction, investment, reorganisation or sale of all or part of the business, subject to appropriate confidentiality and legal safeguards.

7. Buyer enquiries and lead sharing

7.1 When you submit an enquiry, request a call, book an appointment, request a test drive or ask for more information about a listing, you instruct us to send the details reasonably necessary to answer that request to the dealer or seller identified on the listing. Those details may include your name, telephone number, email address, location, message, preferred vehicle, trade-in information and enquiry metadata.

7.2 We will identify the intended recipient at or before the point of submission where reasonably practicable. A dealer or seller receiving a Lead will generally process it as a separate responsible party for responding to the enquiry and managing any resulting relationship. You should review that recipient’s privacy notice.

7.3 Submission of an enquiry is not, by itself, consent for AutomotiveHub or the recipient to send unrelated direct marketing. Marketing choices must be handled separately in accordance with clause 11.

7.4 We may retain and analyse lead-routing, response, call, conversion and quality information to provide the service, prevent abuse, bill dealers, measure performance, improve the Platform and resolve disputes.

8. Finance, insurance and other partner services

8.1 Where you ask for vehicle finance, insurance, a warranty, an inspection, delivery, roadside assistance or another partner service, we may collect and send the information needed for that request to the selected or participating authorised provider. We will provide any additional notice and consent required for sensitive, credit-related or special processing.

8.2 The provider will generally make its own eligibility, pricing, underwriting, credit and service decisions and will process your information under its own privacy notice. AutomotiveHub does not control a provider’s decision unless AutomotiveHub is expressly identified as that provider and is legally authorised to perform the relevant service.

8.3 A finance or affordability calculator may use information you enter to produce an estimate. Unless expressly stated otherwise, the calculation is not a credit application, quotation, approval or financial advice.

9. Public listings and user-provided content

9.1 Listing content intended for publication may be visible to any internet user, search engine, data aggregator or social-media viewer and may be shared by other users. Public listing information may include seller or dealership contact details selected for display.

9.2 Do not include identity documents, bank details, residential addresses or other unnecessary personal information in public listing text, photographs or videos. Sellers should remove or obscure personal information that is not needed for the listing.

9.3 When content is removed, copies may remain temporarily in backups, browser caches, search-engine indexes or third-party services outside our control. We will take reasonable steps within our control to give effect to valid removal requests.

10. Who we share personal information with

We may disclose personal information to the following recipients, only to the extent reasonably necessary for the relevant purpose:

• the dealer, private seller or AutomotiveHub sales team identified in a listing or transaction;
• authorised credit providers, financial service providers, insurers, warranty providers, inspection providers, vehicle-history providers, logistics providers and other partners you ask us to involve;
• operators and service providers for cloud hosting, databases, cybersecurity, identity verification, communications, call tracking, customer support, analytics, advertising, payment processing, document signing and professional services;
• our employees, contractors, affiliates and advisers who need the information and are subject to appropriate confidentiality duties;
• courts, regulators, law-enforcement bodies, tax authorities, ombuds, industry bodies or other persons where disclosure is required or permitted by law;
• a prospective buyer, investor, lender or transaction adviser in connection with a business sale, merger, financing or reorganisation, subject to appropriate safeguards;
• another person where you direct us or give valid consent.

We do not sell personal information as a standalone commodity. AutomotiveHub may charge sellers and partners for advertising, listing, subscription or lead services; any disclosure of personal information must still be connected to a disclosed and lawful purpose.

11. Direct marketing and vehicle alerts

11.1 We may send marketing by email, SMS, telephone, WhatsApp or another electronic channel where you have given valid consent, or where POPIA permits communication to an existing customer about our own similar products or services and the applicable conditions are met.

11.2 Where legally permitted, we may contact a person once to request consent if that person has not previously refused. We will record consent and objections and will not make consent a condition of an unrelated service unless the marketing is genuinely necessary for that service.

11.3 Every electronic marketing message will identify the sender and provide a reasonably accessible, free method to opt out. You may object or withdraw consent at any time by using the unsubscribe mechanism, updating preferences or contacting [INFORMATION OFFICER EMAIL].

11.4 Opting out of marketing does not prevent us from sending necessary service, security, transaction or legal messages.

11.5 A dealer or partner must obtain its own lawful basis for marketing beyond responding to the enquiry you submitted. AutomotiveHub marketing consent does not automatically authorise dealer marketing, and dealer marketing consent does not automatically authorise AutomotiveHub marketing.

12. Cookies and similar technologies

12.1 We and approved service providers may use cookies, pixels, software development kits, local storage and similar technologies. Depending on the Platform configuration, these may include:

• strictly necessary technologies for security, login, load balancing, consent records, fraud prevention and core site functions;
• preference technologies that remember language, location, saved searches and display choices;
• analytics technologies that help us understand traffic, searches, errors, performance and feature usage;
• advertising and measurement technologies used to limit, deliver and measure relevant campaigns, create audiences or understand referrals;
• embedded third-party technologies used for maps, videos, live chat, social-media features, CAPTCHA, call tracking or messaging.

12.2 Where consent is required or appropriate, non-essential technologies will be controlled through our cookie banner or preference centre at Cookie management. You can also use browser settings, but disabling some technologies may reduce functionality.

12.3 Third parties may receive device or usage information through their technologies and may act as separate responsible parties. Their privacy notices govern their independent use of that information.

13. Automated tools, ranking and profiling

We may use automated tools to rank search results, recommend vehicles, detect suspicious activity, route leads, personalise content, estimate values and measure performance. We will not make a decision based solely on automated processing that produces legal consequences or similarly substantial effects for you unless POPIA permits it and suitable safeguards are in place. Credit providers and insurers may use their own automated assessment systems under their own notices and legal obligations.

14. International transfers

Some service providers may store or access personal information outside South Africa. We will transfer personal information across borders only where the requirements of section 72 of POPIA are met, for example where the recipient is subject to adequate law, binding corporate rules or a binding agreement providing substantially similar protection; where you consent after being informed of possible risks; where the transfer is necessary for a contract or your benefit; or where another lawful exception applies.

15. Security

15.1 We must take appropriate and reasonable technical and organisational measures to protect the integrity and confidentiality of personal information and reduce reasonably foreseeable risks of loss, damage, unauthorised destruction, access or processing. Measures may include access controls, authentication, encryption in transit, backups, monitoring, secure development, employee confidentiality, vendor due diligence, written operator terms, incident response and periodic risk review, as appropriate to the information and systems involved.

15.2 No internet or information system can be guaranteed completely secure. You are responsible for protecting account credentials, using secure devices and notifying us promptly of suspected unauthorised account use.

15.3 If we have reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will investigate and notify the Information Regulator and affected data subjects as soon as reasonably possible, subject to lawful delay and the requirements of POPIA.

16. Retention and deletion

16.1 We retain personal information only for as long as reasonably necessary for the purpose for which it was collected or subsequently lawfully processed, and for any period required or authorised by law, contract, tax, accounting, complaints, fraud prevention, legal claims or regulatory obligations.

16.2 Retention periods differ by category. Account and relationship records are generally kept for the active relationship and a reasonable period afterwards; listing, enquiry, communication and transaction records are retained for operational, dispute and limitation periods; statutory financial, compliance and vehicle-sale records are kept for the applicable legal period; security logs are kept for shorter risk-based periods; and suppression records may be retained to honour marketing objections.

16.3 When retention is no longer justified, we will delete, destroy, de-identify or restrict the information in a manner reasonably appropriate to the medium and risk. De-identified or aggregated information that can no longer reasonably identify a person may be retained and used for lawful analytics and research.

17. Your rights

Subject to POPIA, PAIA and other applicable law, you may have the right to:

• ask whether we hold personal information about you and request access to it;
• request correction, updating, deletion or destruction of information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, unlawfully obtained or no longer authorised to be retained;
• object, on reasonable grounds relating to your situation, to processing based on the protection of a legitimate interest;
• object at any time to direct marketing and stop receiving such marketing;
• withdraw consent where processing is based on consent, without affecting processing already lawfully completed;
• request information about a qualifying automated decision and make representations where POPIA provides that right;
• lodge a complaint with the Information Regulator or pursue another remedy available by law.

To exercise a right, contact [INFORMATION OFFICER EMAIL]. We may request information reasonably necessary to verify identity, authority and the scope of the request. A request may be subject to lawful grounds for refusal, the rights of others, prescribed forms, a legally permitted fee or retention obligations. Our PAIA Manual is available at [PAIA MANUAL URL].

18. Children

The Platform’s account, listing, finance and vehicle-transaction services are intended for persons aged 18 or older and persons with legal capacity. We do not knowingly solicit personal information from children for these services. If we learn that a child’s personal information has been processed without a lawful authorisation, we will take reasonable steps to delete or otherwise lawfully handle it. A parent or competent person may contact the Information Officer about suspected child data.

19. Third-party websites and services

The Platform may link to or embed third-party websites, social platforms, payment gateways, maps, videos, messaging tools and service providers. We do not control their independent privacy practices. Review their terms and privacy notices before providing personal information to them. This clause does not limit any responsibility that the law places on AutomotiveHub for its own selection, instructions or processing involving an operator.

20. Changes to this Policy

We may update this Policy to reflect changes in law, technology, services, vendors or business practices. The revised version will be posted with a new “last updated” date. Where a change materially affects how existing personal information is used, we will provide additional notice or obtain consent where required by law. Continued use of the Platform after an update does not replace consent where consent is legally required.

21. Contact details and complaints

Responsible party: [LEGAL ENTITY NAME] t/a AutomotiveHub

Registration number: [REGISTRATION NUMBER]

Physical and legal-service address: [PHYSICAL ADDRESS]

Information Officer: [INFORMATION OFFICER NAME]

Privacy / PAIA email: [INFORMATION OFFICER EMAIL]

Customer support: [SUPPORT EMAIL] | [TELEPHONE]

PAIA Manual: [PAIA MANUAL URL]

You may also lodge a POPIA complaint with the Information Regulator (South Africa): Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191; telephone 010 023 5200; toll-free 0800 017 160; complaints email POPIAComplaints@inforegulator.org.za; website https://inforegulator.org.za.