Privacy Policy

SWIPSWXP (Pty) Ltd (registration number 2026 / 221606 / 07) (“SWIPSWXP”, “we”, “us” or “our”) operates a mobile-first peer-to-peer marketplace where people in South Africa can buy, sell, and swap goods. We are a private company incorporated in South Africa, with our registered office at 26 Higgo Road, Higgovale, Cape Town, Western Cape, 8001.

This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, who we share it with, and your rights under the Protection of Personal Information Act 4 of 2013 (“POPIA”). For the purposes of POPIA, SWIPSWXP is the responsible party that determines why and how your personal information is processed.

This policy applies to everyone who uses the SWIPSWXP platform: buyers, sellers, swappers, visitors to our website and app, and anyone who contacts us. It covers personal information we process through our app, our website, our customer service channels, and our dealings with our payment and logistics partners.

By creating a SWIPSWXP account or using the platform, you confirm that you have read and understood this policy. Where the law requires your consent for a specific type of processing (for example, direct marketing or WhatsApp notifications), we will ask for that consent separately and clearly.

These terms follow the meanings given in POPIA.

We are responsible for our compliance with POPIA and are your first point of contact for any privacy question, request or complaint.

We collect only what we need to run the marketplace, keep it safe, and meet our legal obligations. Depending on how you use SWIPSWXP, this may include your identity and contact details, account and profile information, transaction and payment-related data, delivery details, device and usage information, and content you upload such as listing photos and messages.

We collect personal information in three ways:

• Directly from you: when you register, complete your profile, list an item, make an offer, transact, arrange delivery, contact support, or take part in a dispute.
• Automatically: device, usage and location information through cookies and similar technologies (see section 18).
• From third parties: our payment partner (to confirm payment), our courier partners (to confirm delivery), and WhatsApp where you have opted in.
• From social login providers: if you register or sign in using Google, Facebook or Apple, we receive your profile name and photo from them to set up your account.

We process your personal information only for specific, lawful reasons:

Change of purpose. We use your personal information only for the purposes we collected it for, unless we reasonably consider we need to use it for another, compatible purpose. If we need to use it for an unrelated purpose, we will tell you and explain the legal basis. We may process your information without your knowledge or consent where the law requires or permits it.

SWIPSWXP shows you listings likely to be relevant to you from the moment you sign on. Understanding how this works matters.

8.1 What the system does

When you finish onboarding, we combine five signals (your location zone, lifestyle tile selections, marketplace interests, shopping category, and sizing) to assign you a style-led avatar, for example The Coastal or The Streetwear. The avatar seeds your home feed with relevant listings before you have browsed anything. As you use the platform, your browsing behaviour (dwell time, saves, offers, completed transactions) adjusts your feed. If your behaviour consistently aligns with a different avatar for 30 days, the system quietly moves you to the new avatar.

8.2 What we do not do

• We do not sell your personal information or your avatar assignment to advertisers.
• We do not use your avatar to make decisions that have legal or similarly significant effects on you.
• We do not use your avatar for anything other than feed personalisation, SWXP swap matching, notification personalisation, and search ranking within the platform.
• Style tags our AI assigns to listings are never shown to you; they work only as a backend signal.

8.3 Your control

You can retune your feed at any time in Profile, Settings, Feed preferences, Retune my feed. This is available once every 30 days.

Some information we process may be more sensitive, such as biometric information used to verify your identity, or information you choose to share in a message, listing or dispute (for example, mentioning a health issue when asking for a refund).

We do not deliberately collect special personal information beyond what we need for identity verification and platform safety. Where we do process it, we rely on the grounds POPIA allows, such as your consent, or because it is necessary to establish, exercise or defend a right or obligation in law. We apply extra care and stronger safeguards.

SWIPSWXP does not set a minimum age to use the platform. If you are under 18, you should use SWIPSWXP with the consent or assistance of a parent or guardian (a “competent person”), and that person is responsible for your use. POPIA treats a child’s personal information as needing extra protection, and we process it only where a competent person has consented or another legal ground applies.

We do not deliberately target children with marketing. If you are a parent or guardian and believe we hold your child’s personal information without the necessary consent, contact us at support@swipswxp.com and we will address it, including deleting the information where required.

SWIPSWXP uses AI and automated systems to help run the platform: creating and checking listings, detecting fraud, moderating content, assisting customer support, verifying identity, and personalising what you see (section 8).

Some decisions are made automatically. Where an automated decision has a significant effect on you (for example, a listing is rejected, a transaction is held for a fraud check, identity verification is declined, or your account is restricted), you have the right to:

• ask that a person on our team reviews the decision;
• make representations before any permanent action is taken; and
• be given the reasons in plain language.

We aim to respond to a request for human review within these timeframes: fraud holds within 48 hours, listing and content decisions within 73 hours, and identity verification within 5 business days. Before any permanent account restriction we give you a reasonable opportunity to respond (ordinarily 5 business days), unless there is an urgent safety or fraud risk. Our support uses AI to assist, but you can always ask to be helped or reviewed by a person.

We store your account data, transaction records and platform logs on Amazon Web Services (AWS) infrastructure in the Cape Town, South Africa region (af-south-1). Your information at rest, and our audit logs, remain in South Africa.

Some of our AI features run through AWS’s Bedrock service. When an AI feature processes information for a task, that information may be sent briefly to AWS facilities outside South Africa (for example in the European Union or the United States) for the moment it takes to complete the task, and the result is returned to our South African systems. AWS does not use your information to train AI models. Where information is processed in a country without privacy laws equivalent to South Africa’s, we rely on contractual protections (standard contractual clauses) with AWS.

Our payment and courier partners are based in South Africa. Where a delivery is international, the relevant courier may process delivery details in the destination country to complete the delivery.

We do not sell your personal information. We share it only with the partners we need to run the marketplace, and only as far as necessary. Each operator is bound by an agreement to protect your information and use it only for the service they provide to us.

We require our courier partners to use your address and contact details only to complete your delivery, not for their own marketing. If SWIPSWXP is involved in a merger, acquisition or sale of assets, your information may transfer as part of that transaction, and we will tell you before it becomes subject to a different privacy policy.

All payments are processed by our payment partner, Ozow. When you pay, your funds are held by Ozow in escrow and are not released to the seller until the transaction completes. SWIPSWXP does not hold, control or take possession of your funds, and does not store your card number, banking details or CVV.

Payouts to sellers are initiated by SWIPSWXP and made by Ozow to the seller’s South African bank account after identity verification. Ozow’s own privacy terms govern the processing of your payment data.

We take appropriate, reasonable technical and organisational measures to protect your personal information against loss, damage and unauthorised access. These include encryption of data in transit and at rest, scoped access controls, API authentication and rate limiting, audit logging of automated actions that affect your data, secure hosting in South Africa, staff confidentiality obligations, and regular security reviews. Access to personal data is strictly needs-based.

If a security breach affects your personal information, we will notify the Information Regulator and you as soon as reasonably possible after we become aware of it, as POPIA requires. No system is completely secure, so please keep your password confidential and contact us immediately if you suspect unauthorised use of your account.

Our platform may contain links to other websites and social media controlled by third parties. If you follow such a link or visit our pages on a social media platform, that processing is beyond our control, and we recommend you review the privacy and cookie policies of those third parties.

We keep your personal information only as long as we need it for the purposes in this policy, or as long as the law requires. When we no longer need it, we securely delete or de-identify it.

We only send you direct marketing (promotional emails, SMSes, push or WhatsApp messages about SWIPSWXP) if you have agreed to receive it. You can withdraw consent or opt out at any time, using the unsubscribe option in the message, your notification settings, or by contacting us. We never make marketing a condition of using the platform.

We use cookies and similar technologies on our website and app to keep you signed in, remember your preferences, keep the platform secure, and understand how it is used so we can improve it. You can control cookies through your browser or device settings, although some features may not work properly if you disable them.

POPIA gives you the following rights in relation to the personal information we hold about you:

• Right to be informed: to know that we are collecting your information, and whether it is transferred across borders.
• Right of access: to ask what personal information we hold and request a copy.
• Right to correction: to correct information that is inaccurate, out of date or incomplete.
• Right to deletion: to delete information we no longer have a lawful basis to keep.
• Right to object: to object to processing based on legitimate interests, and to direct marketing.
• Right to restriction: to ask us to limit how we use your information while we deal with a correction request or an objection, or where you need us to keep it for a legal claim.
• Right to withdraw consent: where processing relies on consent (such as WhatsApp or marketing).
• Rights around automated decisions: as set out in section 11.
• Right to complain: to the Information Regulator (see section 20).

To exercise any of these rights, contact us at support@swipswxp.com. Where a formal request is required, we may ask you to complete the prescribed POPIA request form (Form 2), and we may verify your identity before acting.

If you are unhappy with how we have handled your personal information, contact us at support@swipswxp.com first so we can try to resolve it.

We respond to privacy questions and complaints within 30 days. If we cannot respond fully within 30 days, we may extend the period by up to two further months, and we will tell you and explain the reason within the first 30 days.

You also have the right to lodge a complaint directly with the Information Regulator of South Africa.

We may update this policy as our platform, our partners or the law change. When we make a material change, we will tell you through the app or by email and update the effective date at the top. Please check back from time to time.

Please also keep us informed if your personal information changes during your relationship with us, so that the information we hold about you stays accurate and current.

By creating an account and using SWIPSWXP, you acknowledge that you have read and understood this Privacy Policy and how we process your personal information, and that where the law requires your consent for a specific purpose, we will ask for it separately.