This Policy explains how ShelfRocket ("ShelfRocket", "we", "us") collects, uses, shares and protects your personal information when you use the ShelfRocket platform for Takealot sellers (the "Service").
We are the responsible party under the Protection of Personal Information Act 4 of 2013 ("POPIA") for the personal information described here.
You can contact us about this Policy, to exercise your rights, or to complain, at hello@shelfrocket.co.za or 087 265 3908. Our designated Information Officer can be reached at the same address.
"Personal information" means information relating to an identifiable living natural person and, where applicable, an identifiable existing juristic person, as defined in POPIA.
We do not knowingly process special personal information (such as race, health, religious or biometric data) or the personal information of children, and the Service is not directed at children. Please do not submit such information.
We do not collect the personal information of your customers (Takealot shoppers). Our systems record marketplace order references and financial amounts for your reporting, but not the names, addresses or contact details of the people who buy from you.
We only process personal information where we have a lawful basis:
| Category | Examples | Purpose | Basis (s11) |
|---|---|---|---|
| Account & identity | Name, email, avatar | Create and run your account | Contract (b); consent (a) |
| Contact details | Phone / WhatsApp number, opt-in flag | Service alerts and (if opted in) WhatsApp notifications | Contract (b); consent (a) |
| Business & tax details | Company name, address, VAT number, registration number, tax reference | Generate SARS-compliant invoices and stock-loss documents | Contract (b); legal obligation (c) |
| Marketplace account info | Takealot seller ID, shop name | Connect and sync your Takealot account | Contract (b) |
| Marketplace API credentials | Takealot Seller API key/secret (encrypted) | Read your data and, where enabled, submit permitted actions | Contract (b) |
| Commercial data | SKUs, cost prices, margins, sales, fees, P&L | Research, repricing, margin and reporting features | Contract (b) |
| Payment data | PayFast tokens, transaction records (no card numbers) | Billing and financial records | Contract (b); legal obligation (c) |
| Usage & analytics | Feature usage, events, credit usage, price-change logs | Operate, secure, bill and improve the Service | Legitimate interests (f) |
| Communications | Email/WhatsApp content and delivery metadata | Send and log transactional and (opted-in) marketing messages | Contract (b); consent (a) |
| Team members’ data | Invited staff name, email, avatar, role | Multi-seat access administration | Contract (b) |
| Referral / partner data | Partner name, contact, referral code, payout details | Operate the referral programme and pay partners | Contract (b); legal obligation (c) |
| Marketing / leads | Waitlist email, interview-participant name | Product updates, waitlist, research (with consent) | Consent (a) |
| Other sellers’ public identifiers | Buy Box holder names from public Takealot pages (hashed) | Competitive benchmarking and market analysis | Legitimate interests (f) |
| Technical & security | IP address, device/user-agent, error diagnostics | Security, fraud/abuse prevention, debugging | Legitimate interests (f); (c) |
| Consent records | Terms/Privacy acceptance, version, timestamp | Evidence of your consent and re-consent | Legal obligation / (f) |
Where we rely on legitimate interests (f), we have weighed those interests against your rights and will provide our assessment on request; you may object to that processing. Where we rely on consent (a), you may withdraw it at any time without affecting processing already carried out, and core account processing may continue on the "contract" basis.
We send transactional messages (billing, alerts, security) as part of the Service. We send marketing messages only where POPIA s69 permits — with your consent, or to existing customers about similar products where you have not opted out. Every marketing message includes an unsubscribe option, and you can manage preferences in your account settings.
Please be aware: although ShelfRocket is a South African service for South African sellers, our main database is hosted in the European Union (Ireland), and several of our service providers process personal information outside South Africa, including in the European Union and the United States. A South African hosting region is not currently available from our database provider.
We transfer personal information across borders only where POPIA s72 permits — relying on one or more of: (a) the recipient being bound by a law or a binding agreement providing an adequate, substantially-similar level of protection with onward-transfer restrictions; (b) your consent; and (c) the transfer being necessary to perform our contract with you. We put data-processing agreements in place with our sub-processors requiring POPIA-consistent protection.
By using the Service you consent to these international transfers. If you do not consent, please do not use the Service, as we cannot provide it without these providers.
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Primary database, authentication | EU (Ireland) |
| Vercel | Application hosting, serverless functions | US / global edge |
| Anthropic (Claude) | AI features | US |
| OpenAI | AI features (where used) | US |
| Resend | Transactional email | US |
| Twilio | SMS / WhatsApp alerts | US |
| PostHog | Product analytics | US |
| Sentry | Error monitoring | US |
| PayFast | Payment processing | South Africa |
| Scrapingbee | Market-data retrieval | EU / US |
We use technical and organisational safeguards including: encryption of sensitive credentials at rest (secure vault), row-level security so each account only accesses its own data, access controls and least-privilege service roles, encrypted connections, audit logging, and monitoring.
No system is perfectly secure. If a security compromise affecting your personal information occurs, we will notify the Information Regulator and affected data subjects as required by POPIA s22.
On request we delete or de-identify personal information we are not legally required to keep.
You have the right to: access the personal information we hold about you (s23); correct or delete inaccurate, irrelevant, excessive or unlawfully held information (s24); object to processing based on legitimate interests or for direct marketing (s11(3), s69); withdraw consent where we rely on it; not be subject to a decision based solely on automated processing that has legal or similarly significant effects, without safeguards (s71); and complain to the Information Regulator.
To exercise any right, contact us at hello@shelfrocket.co.za or 087 265 3908, or use the in-account data tools where available. We respond within a reasonable time and may verify your identity first.
Information Regulator (South Africa): enquiries@inforegulator.org.za · POPIAComplaints@inforegulator.org.za
The auto-repricer makes automated price changes based on rules you set. It does not make decisions that produce legal effects concerning you as a person; it acts on your commercial listings under your configuration. You can pause or disable it at any time, and can use shadow mode before activating a rule. The Terms of Service (clause 12) explain your responsibilities and the risks.
We use strictly-necessary cookies to run the Service, and analytics cookies (via PostHog) to understand usage. You can control non-essential cookies through your browser and through our Cookie Policy.
We may update this Policy. For material changes we will give reasonable notice and, where required, ask you to re-accept. We keep a versioned record of acceptances.
Email: hello@shelfrocket.co.za
Phone: 087 265 3908
You may also lodge a complaint with the Information Regulator if you believe your personal information has been misused.