POPIA
POPIA Notice
POPIA notice. Last updated: 25 June 2026. This notice explains how DealExchange processes personal information under POPIA for buyer enquiries, broker accounts, mandate review, billing records and marketplace security.
Responsible party
DealExchange is the responsible party for personal information processed through this website. Contact: Use the DealExchange contact workflow so your request is stored in the desk queue and routed to the right process.. POPIA requests are handled by the DealExchange privacy desk until a named officer is registered.
Purpose and lawful basis
- Buyer enquiries and alerts: to respond to your request, match criteria to mandates and manage confidentiality.
- Broker/seller intake: to review mandate authority, prevent duplicates and moderate public teasers.
- Broker/admin accounts: to authenticate users, enforce roles, manage listings/leads and keep audit history.
- Billing records: to process hosted checkout, invoices, refunds, chargebacks and accounting for paid broker products.
- Security records: to prevent abuse, rate limit forms, verify Turnstile and investigate incidents.
We rely on contract/steps at your request, consent where appropriate, legal obligations and legitimate interests in operating a secure, curated marketplace.
Operators
Cloudflare provides hosting, D1 database, R2 media storage, Turnstile, Pages and security services. Resend or Cloudflare Email may send notifications. Paystack may process hosted payments when enabled. Professional advisers may receive information only where instructed or necessary for a specific engagement.
Cross border processing
Operators may process information outside South Africa. DealExchange uses providers with contractual safeguards and comparable protection commitments.
Retention
Buyer profiles, enquiries, mandates, dispute records, audit logs and billing records are retained only as long as needed for marketplace operation, legal, audit and tax purposes, dispute handling and security. Removal and deletion requests can be made through the privacy desk and are logged for follow up.
Your rights
You may request access, correction, deletion, objection or restriction through the contact workflows. DealExchange aims to acknowledge requests within 10 business days and complete them within a reasonable POPIA aligned period, subject to identity verification and lawful retention exceptions.
Complaints
You may complain to the Information Regulator (South Africa): inforegulator.org.za, POPIAComplaints@inforegulator.org.za.
Security boundary
Public forms are for initial enquiries only. Do not submit confidential financial packs, staff records, ID documents, bank statements, seller customer lists or other sensitive documents until DealExchange provides an approved secure process.