Privacy Policy
Last updated: March 2026
Who we are
Winkl is a platform that helps independent retailers and community sellers run their own online shops. The responsible party under the Protection of Personal Information Act (POPIA) is the operator of the Winkl shop you are purchasing from.
What personal information we collect
- Account data: first name, last name, email address.
- Order data: shipping address, order history, and cart contents stored while using the platform.
- Communication data: emails sent to you are logged (sender, recipient, subject, status) for up to 2 years.
- Session data: login tokens and timestamps used at login.
Why we process your information
- To provide the platform services you have signed up for (lawful basis: contract performance).
- To send you order confirmations and delivery updates (lawful basis: contract performance).
- To maintain security and detect abuse (lawful basis: legitimate interest).
Who we share your data with
Your data is shared only with the operator of the Winkl shop you are purchasing from. We do not sell or share personal data with third parties for marketing.
Emails are sent via MailPace (MailPace Ltd, United Kingdom), who process email delivery on our behalf and are bound by a data processing agreement.
When a shop accepts card payments, checkout is processed via PayFast (PayFast (Pty) Ltd, South Africa). Your name, email address, and order amount are passed to PayFast's hosted payment portal to complete the transaction. Winkl never sees or stores your card details. PayFast is a PCI-DSS compliant payment processor — see their privacy policy at payfast.io.
winkl owner verification
Before a winkl store can go live, the owner must complete an identity verification step to reduce fraud and protect customers. This process involves two checks:
- SA ID number validation — the owner enters their 13-digit South African ID number. It is validated on our servers (format and Luhn checksum) to confirm it is a legitimate ID number. The ID number is never stored — it is discarded immediately after validation.
- Phone number verification — a one-time code (OTP) is sent via SMS to the owner's registered phone number. The owner enters the code to confirm they control that number. The phone number is stored as part of the winkl's contact details. The OTP itself is stored as a one-way hash (SHA-256) and is deleted once used or expired.
What is stored as a result of verification: the owner's phone number and the date/time verification was completed. What is not stored: the SA ID number, the plain-text OTP, or any biometric data.
SMS delivery is handled by Clickatell (Pty) Ltd, a South African messaging provider. The phone number is shared with Clickatell solely to deliver the verification code. See their privacy policy at clickatell.com.
How long we keep your data
- Account data: until you delete your account.
- Order history: retained for financial record purposes (7 years).
- Email logs: purged after 2 years.
- Login session tokens: expire automatically after 60 days.
Your rights under POPIA
You have the right to:
- Access the personal information we hold about you — email privacy@winkl.co.za.
- Correct inaccurate information — update your profile in Account Settings.
- Delete your account and personal data — available in Account Settings.
- Object to processing — email privacy@winkl.co.za.
- Lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za.
Security
All data is transmitted over HTTPS. Passwords are hashed using Argon2. Access to personal data is restricted to authenticated users and shop owners. Card payments are handled entirely by PayFast's hosted payment portal — card details never pass through or are stored on Winkl's servers. Payment requests are authenticated with a cryptographic signature to prevent tampering.
Contact
For privacy-related requests, email privacy@winkl.co.za.