Privacy & POPIA Policy

1. Who is responsible for your information

Campus Drop, operated by Mxolisi Khumalo, is the responsible party (data controller) for the personal information processed on campusdrops.co.za. We process personal information in line with the Protection of Personal Information Act, 2013 (POPIA).

Information Officer · Campus Drop (Mxolisi Khumalo) · admin@campusdrops.co.za

2. What we collect

• Account details — name, email address, phone number, campus and city, profile photo, and whether you buy, sell or both.
• Listing and order details — items, prices, photos, messages between buyers and sellers, delivery or collection addresses and order history.
• Payout details for sellers — bank name, account number and account holder name, used only to pay you.
• Payment information — handled by our payment partners. We receive only a payment reference, amount and status. We never see or store your full card number.
• Technical data — IP address, device and browser type, and pages visited, for security and to keep the site working.

3. Why we use it (lawful basis)

• To create and manage your account and let you list, buy and sell (contract).
• To process payments, hold funds and pay sellers out (contract).
• To send order, delivery, payout and support emails (contract).
• To send listing alerts and marketing, only where you have opted in (consent — you can opt out at any time).
• To prevent fraud, moderate reports, and keep the marketplace safe (legitimate interest).
• To meet legal, tax and financial record-keeping duties (legal obligation).

4. Who we share it with

We do not sell your personal information. We share only what is necessary with operators who act for us under written agreements:

• Our payment provider (Ozow), to process payments
• Our hosting and database provider, to run the site securely
• Our email provider, to send transactional and alert emails
• Couriers, where you choose courier delivery, to deliver the order
• Law enforcement or regulators, where the law requires it

Buyers and sellers see each other’s display name and the delivery details needed to complete an order. Some operators process data outside South Africa; we only use providers that offer protection comparable to POPIA.

5. How long we keep it

Account information is kept while your account is active. Order, payment and payout records are kept for at least five years as required by South African tax and financial legislation. After that, information is deleted or anonymised.

6. How we protect it

Data is encrypted in transit (HTTPS) and at rest. Access is restricted by row-level database security so users can only reach their own records, profile photos are stored privately, and administrative access is limited and logged. We run automated dependency and code security scanning. If a breach affects your information we will notify you and the Information Regulator as POPIA requires.

7. Your rights

Under POPIA you may:

• Ask what personal information we hold about you
• Ask us to correct or delete information that is wrong or no longer needed
• Object to processing, or withdraw consent for marketing at any time
• Ask us to stop processing and close your account
• Lodge a complaint with the Information Regulator (South Africa) at complaints.IR@justice.gov.za

To exercise any of these, email admin@campusdrops.co.za. We respond within 30 days.

8. Cookies

We use only the cookies and local storage needed to keep you signed in, remember your preferences and secure the site. We do not use advertising cookies. Blocking essential cookies will prevent you from signing in.

9. Children

Campus Drop is intended for students aged 18 and older. We do not knowingly collect information from children without the consent of a parent or guardian.

10. Changes and contact

We may update this policy; the current version always appears here with its update date. Questions? Email admin@campusdrops.co.za or read our Terms & Conditions.