This page is provided for information only and is not legal advice.
Last updated: 11 October 2026
This policy explains how we process your personal information under POPIA.
1. Scope
This policy applies to personal information we process as the responsible party when you use the Service. Where we process data on behalf of a business customer (for example shipment records inside Realview), our Data Processing Addendum also applies.
2. Who we are & our Information Officer
The responsible party is Trade Caravan. Our Information Officer can be reached at [email protected].
3. What personal information we collect
- Account information — name, email, password (hashed), company name.
- Billing information — plan, billing email and transaction references. Card/bank details are handled by Stitch Express, not stored by us.
- Usage information — pages and tools used, device/browser data, IP address, via server logs, our own first-party visit count, and Cloudflare Web Analytics (cookieless).
- Communications — emails, support messages, and (if you previously opted in) a WhatsApp number held only so we can honour that choice if we restart the service.
- Shipment data — container/bill-of-lading numbers and related tracking details you enter into Realview.
4. How we collect it & our lawful basis
We collect information directly from you (registration, forms, tool inputs), automatically (cookies, logs), and from third-party data sources for tracking. We process it on one or more lawful bases under POPIA: your consent (for example newsletters and, where you previously opted in, WhatsApp alerts), performance of a contract (providing paid features), our legitimate interests (securing and improving the Service), and compliance with the law.
5. Purpose for processing
We process personal information to create and manage your account; provide tracking and tools; take payment; send service messages and the communications you subscribed to; provide support; prevent fraud and abuse; and meet legal obligations. We collect only what we need for these purposes.
Register-interest requests (name, company, email, approximate line count): used to contact you about the product you asked about (for example the HS 2028 Impact Report); kept 12 months unless you order.
6. How we use your information
- To deliver and maintain the Service and your subscription.
- To send transactional emails (via Resend) and, if you opt in, newsletters and email alerts. We aren't sending WhatsApp alerts at the moment; if we restart that service we will tell you first.
- To monitor performance and errors and improve the product.
- To connect you with a service provider only where you ask us to (with your consent).
We never sell your personal information.
7. Sharing with operators & third parties
We share personal information with operators (processors) who help us run the Service — hosting, payments, email, messaging, error monitoring and tracking data providers. They may only use it on our instructions. The current list is in our Data Processing Addendum & sub-processor list.
Careers applications: when you apply for a job on Trade Caravan, we share a snapshot of your CV, the contact details you confirm on the form, and your screening answers with the employer named on that application (the company listed on the advert). That company is a separate responsible party for how they handle what you send them. You can withdraw an application at any time from My Applications.
8. Cross-border transfers (POPIA section 72)
Some operators process data outside South Africa. Our primary application hosting is currently provided outside South Africa, and a migration to in-country hosting in Rivonia, South Africa, is planned; Twilio/WhatsApp, Resend, Sentry and MarineTraffic may also process data offshore (for example in the United States or European Union). Where data leaves South Africa we rely on a section 72 basis — typically an operator contract that provides protection substantially similar to POPIA, and/or that the transfer is necessary to perform our contract with you, and/or your consent. See the sub-processor table for each provider's location.
9. Security safeguards (POPIA section 19)
We take reasonable technical and organisational measures to protect personal information — encryption in transit (HTTPS), hashed passwords, access controls and reputable infrastructure providers. No system is perfectly secure, but we work to prevent loss of, damage to, or unauthorised access to your data, and to notify you and the Regulator of a breach as required.
10. Retention
We keep personal information only as long as needed for the purposes above or as required by law. Account data is kept while your account is active and for a limited period afterwards; billing records are kept for the period required for tax and accounting (including SARS retention requirements); newsletter data is kept until you unsubscribe; register-interest leads are deleted 12 months after submission unless you place an order (or sooner if you opt out).
HS 2028 report files: deleted 90 days after delivery, or when an unpaid quote expires (7 days, or 14 for large orders).
Careers: application payloads (CV snapshot, cover note, phone, portfolio URL and screening answers) are retained until purge_after — normally the advert close date plus 12 months. If you withdraw, we hide the CV from the employer immediately and set purge to withdraw + 30 days. A nightly hygiene job blanks those fields after the date.
11. Your rights under POPIA
You have the right to access the personal information we hold about you, to ask us to correct or delete it, to object to certain processing, and to lodge a complaint. To exercise these rights, email [email protected]. We will respond within 30 days.
12. Direct marketing & opt-out
We send marketing only where permitted (your consent or an existing-customer relationship under POPIA section 69 and the CPA). Every marketing email has an unsubscribe link.
We aren't sending WhatsApp alerts at the moment. If you opted in before, we keep your number only so we can send them if we restart the service, and we'll tell you before we do. You can opt out and have your number deleted at any time. Numbers are deleted if WhatsApp alerts haven't restarted within 12 months.
13. Cookies
We use cookies and similar technologies for sign-in and necessary site functions. Traffic measurement is Cloudflare Web Analytics, which is cookieless — it uses no analytics or advertising cookies and does not track individuals across sites. We serve no advertising. See our Cookie Policy.
14. Children
The Service is for business users and is not directed at children. We do not knowingly collect personal information from children under 18 without parental/guardian consent.
15. Complaints to the Information Regulator
If you are unhappy with how we handle your personal information, you may complain to the Information Regulator (South Africa): inforegulator.org.za, email [email protected]. We'd appreciate the chance to resolve it first.
16. Changes
We may update this policy; the "last updated" date above shows the current version. Material changes will be notified by email or an on-site notice.