Privacy Policy

1.1 Madeinafrica.io ("Platform", "we", "us", "our") is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use our Platform.

1.2 This Policy is drafted in compliance with:

• The Protection of Personal Information Act, 2013 (POPIA) — South Africa;
• The General Data Protection Regulation (GDPR) — European Union (for EU-based Users);
• Applicable data protection laws in SADC member states.

1.3 By using the Platform, you consent to the processing of your personal information as described in this Policy.

2.1 Information You Provide Directly:

• Registration data: Full name, email address, phone number, password, company name, country, industry, business registration number;
• Verification documents: Company registration certificates, director identification, proof of address, VAT certificates, tax clearance certificates, bank confirmation letters, export licenses, financial statements;
• Product listings: Product descriptions, images, pricing, MOQs, certifications;
• Communication data: Chat messages, inquiry content, RFQ descriptions, email correspondence;
• Transaction data: Order details, payment information, shipping addresses, invoicing details;
• Review data: Ratings, review text, photos uploaded with reviews;
• Profile data: Company logo, website URL, company description, social media links.

2.2 Information Collected Automatically:

• Device information: IP address, browser type, operating system, device identifiers;
• Usage data: Pages visited, search queries, products viewed, time spent on pages, click patterns;
• Location data: Approximate geographic location derived from IP address;
• Cookie data: As described in our Cookie Policy.

2.3 Information From Third Parties:

• Payment gateway data: Transaction confirmations from Paystack, Flutterwave, Stripe, M-Pesa;
• Verification data: Information from national business registries (CIPC, BRELA, PACRA, etc.) when verifying Supplier documents;
• Analytics providers: Aggregated usage statistics from Google Analytics or similar tools;
• AI and translation services: Message content processed for auto-translation.

3.1 We process your personal information for the following purposes:

• To provide and operate the Platform and its features;
• To register and manage your account;
• To verify the identity and legitimacy of Suppliers;
• To facilitate communication between Buyers and Suppliers;
• To match Buyers with relevant Suppliers and Products;
• To process payments, Escrow transactions, and Trade Orders;
• To display advertising and calculate Credit usage;
• To provide shipping estimates and duty calculations;
• To resolve disputes and enforce our Terms of Service;
• To send transactional notifications (order confirmations, verification updates, payment receipts);
• To send marketing communications (with your consent);
• To improve the Platform, develop new features, and conduct analytics;
• To comply with legal and regulatory obligations;
• To detect and prevent fraud, abuse, and security threats;
• To provide data to AI agents and MCP servers in accordance with our MCP guidelines (public data only).

4.1 For Users in the European Union, we process personal data on the following legal bases:

• Consent: For marketing communications, optional data collection, and AI translation;
• Contract: For account management, order processing, and Escrow services;
• Legitimate Interest: For fraud detection, platform improvement, and B2B matching;
• Legal Obligation: For tax reporting, AML/KYC compliance, and regulatory requirements.

5.1 We may share your personal information with:

• Other Users: Suppliers can see Buyer inquiry details; Buyers can see Supplier profile information. Contact details are only revealed based on membership tier and Credit usage;
• Service Providers: Payment gateways (Paystack, Flutterwave, Stripe, M-Pesa), cloud hosting providers, email service providers, AI translation services, analytics providers;
• Escrow Partners: Licensed escrow providers for Trade Assurance transactions;
• Verification Partners: Third-party services that verify business registrations, tax numbers, and identity documents;
• Legal and Regulatory Authorities: When required by law, court order, or government request;
• AI Agents and MCP Servers: Publicly available product and supplier data may be accessed by AI agents in accordance with our robots.txt and llms.txt files. Private data (messages, documents, payment details) is never shared with AI agents;
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity.

5.2 We do NOT sell your personal information to third parties for marketing purposes.

6.1 Your personal information may be transferred to and stored in countries outside your country of residence, including South Africa (our primary data centre location), the United States (cloud hosting), and other jurisdictions where our service providers operate.

6.2 Where we transfer data outside the SADC region or the EU, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs), adequacy decisions, or binding corporate rules.

7.1 We retain your personal information for as long as your account is active and for the following periods after account closure:

• Account data: 2 years after closure;
• Transaction and payment records: 7 years (for tax and legal compliance);
• Verification documents: 5 years after Verification expiry;
• Chat messages: 1 year after the last message;
• Marketing preferences: Until you withdraw consent.

7.2 You may request deletion of your data earlier by contacting our Information Officer at privacy@madeinafrica.io, subject to legal retention requirements.

8.1 We implement industry-standard security measures to protect your personal information, including:

• Encryption of data in transit (TLS/SSL) and at rest (AES-256);
• Secure storage of Verification documents in private, access-controlled buckets;
• Multi-factor authentication for admin accounts;
• Regular security audits and penetration testing;
• Role-based access control for employee access to personal data;
• Incident response procedures for data breaches.

8.2 While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

9.1 Under POPIA and GDPR, you have the following rights:

• Right of Access: Request a copy of all personal data we hold about you;
• Right to Rectification: Correct inaccurate or incomplete data;
• Right to Erasure: Request deletion of your data ("right to be forgotten"), subject to legal retention obligations;
• Right to Restrict Processing: Limit how we use your data in certain circumstances;
• Right to Data Portability: Receive your data in a structured, machine-readable format;
• Right to Object: Object to processing based on legitimate interest or direct marketing;
• Right to Withdraw Consent: Withdraw consent at any time for processing based on consent;
• Right to Lodge a Complaint: File a complaint with the Information Regulator (South Africa) or your local data protection authority.

9.2 To exercise any of these rights, contact our Information Officer at privacy@madeinafrica.io. We will respond within 30 days.

10.1 Our use of cookies is described in detail in our Cookie Policy. By using the Platform, you consent to our use of cookies as described therein.

11.1 The Platform is a B2B marketplace and is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children.

12.1 We may update this Privacy Policy from time to time. Material changes will be communicated via email and/or a banner on the Platform. The "Last Updated" date at the top of this page indicates when the Policy was last revised.

13.1 For privacy-related questions, requests, or complaints, contact our Information Officer:

• Name: [Name of Information Officer]
• Email: privacy@madeinafrica.io
• Address: [Your registered address]

13.2 If you are not satisfied with our response, you may lodge a complaint with:

• South Africa: Information Regulator — inforeg@justice.gov.za
• EU: Your national Data Protection Authority
• Other SADC countries: The relevant data protection authority in your jurisdiction