Privacy Notice

1. Who we are

LAWLiS operates an online marketplace that connects Riders (buyers) with independent approved Partners (sellers). We process personal information as a responsible party under POPIA in relation to the operation of the Marketplace platform, accounts, orders, support and related services.

Where a Partner processes personal information that we share with them solely to fulfil an order, arrange delivery or handle a return, that Partner may also act as a responsible party for their own processing activities.

2. Launch territory and future expansion

The Marketplace is initially made available for users and deliveries within the Republic of South Africa. This Notice is written primarily for that South African launch.

If LAWLiS expands the Marketplace to additional countries or regions, we may publish additional or country-specific privacy wording, data- transfer notices, or local contact details before those markets are opened. Until then, the South African version of this Notice applies.

3. Personal information we process

Depending on how you use the Marketplace, the categories of personal information we may process include:

• Account and identity information — name, email address, phone number, password (hashed), account role (Rider, Partner or Admin), and verification status.
• Contact and delivery information — delivery and billing addresses, contact preferences.
• Motorcycle and fitment information — garage or vehicle details you choose to save, and any fitment preferences linked to your account.
• Order and transaction information — products ordered, order history, payment status (we do not store full card numbers), shipping and tracking details, returns and refunds.
• Partner business information — business name, registration or tax identifiers, banking-verification records, contact persons, product catalogue data, and performance metrics needed to operate the Partner portal.
• Communications and support — messages you send to support, dispute or return correspondence, and related records.
• Reviews and content — ratings, reviews or other content you submit.
• Technical and security information — device and browser type, IP address, session data, authentication logs, and records needed for security, fraud prevention and audit.

We do not intentionally collect special personal information (as defined in POPIA) unless it is strictly necessary and lawful to do so.

4. Why we process personal information

We process personal information for the following purposes:

• to create, secure and administer accounts and to authenticate users;
• to operate the Marketplace, including catalogue browsing, checkout, order placement, payment facilitation, delivery coordination, returns and refunds;
• to verify and administer Partners, including onboarding, catalogue moderation and performance oversight;
• to provide customer support and handle disputes;
• to maintain marketplace records, prevent fraud and abuse, and protect the security and integrity of the platform;
• to comply with legal, regulatory, tax and accounting obligations;
• to improve Marketplace operation, features and user experience;
• to send service-related communications (for example order updates); and
• to send optional marketing or promotional communications only where permitted by law and, where required, with your consent or after providing an easy opt-out.

The lawful bases for processing under POPIA include consent (where required), performance of a contract, compliance with a legal obligation, and our legitimate interests in operating a secure and effective marketplace, balanced against your rights and interests.

5. Sharing of personal information

We may share personal information only where necessary for the purposes described in this Notice, including with:

• Partners — limited Rider information reasonably required to fulfil an order, arrange delivery, process a return or provide related support;
• Service providers — trusted providers that support hosting, authentication, monitoring, email/SMS communications, payment processing, analytics (if activated) or similar operational functions, under appropriate agreements;
• Professional advisers — such as lawyers, auditors or insurers, where reasonably required;
• Authorities and regulators — where we are legally required or permitted to disclose information; and
• Business transfers — in connection with a merger, acquisition, restructuring or sale of assets, subject to appropriate safeguards.

We do not sell personal information. Partners should receive only the information reasonably necessary for their marketplace responsibilities.

6. Cross-border transfers

Some of our technology and service providers may process or store information using infrastructure located outside South Africa. Where personal information is transferred across borders, we will take reasonable steps required by POPIA and other applicable law to ensure an adequate level of protection, including contractual safeguards where appropriate.

7. Security

LAWLiS implements technical and organisational measures appropriate to the nature of the information processed and the risks involved. These measures include access controls, encryption in transit where appropriate, monitoring, and staff awareness practices.

No system can be guaranteed completely secure. You are responsible for keeping your login credentials confidential and for notifying us promptly if you suspect unauthorised access to your account.

8. Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, or for longer periods where required by law, for the establishment or defence of legal claims, for fraud prevention, or for legitimate record-keeping.

When information is no longer required, we will delete or de-identify it in accordance with our retention practices, subject to any legal hold or technical constraints.

9. Your rights under POPIA

Subject to the limitations and procedures in POPIA and other applicable law, you may have the right to:

• request confirmation of whether we hold personal information about you;
• request access to that information;
• request correction of inaccurate or incomplete information;
• object to certain processing;
• request deletion or destruction of information where we no longer have a lawful reason to retain it;
• withdraw consent where processing is based on consent; and
• complain to the Information Regulator.

Some transactional, financial, fraud-prevention, security or legal records may need to be retained even after a deletion request, where the law or our legitimate interests require it.

To exercise your rights, contact us using the details in the Contact section below. We may need to verify your identity before responding.

10. Cookies and similar technologies

LAWLiS uses cookies and similar technologies that are necessary for authentication, security, session continuity and core Marketplace functionality.

If we introduce optional analytics, advertising or similar technologies that require consent, we will disclose them and provide appropriate controls. Further detail is set out in our Cookies notice (where published).

11. Children

The Marketplace is directed at users who are 18 years of age or older (or the age of legal majority if higher). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can take appropriate steps.

12. Changes to this Notice

We may update this Privacy Notice as the Marketplace develops or as legal requirements change. The effective date and version will be shown at the top of this page. Where a change is material, we will take reasonable steps to notify users (for example by posting a notice on the Marketplace or by email where appropriate).

13. Contact and complaints

For privacy or data-rights requests, or questions about this Notice, contact:
Email: support@lawlispowersport.com

LAWLiS will publish the formal Information Officer details and any additional regulatory contact information before public launch.

You also have the right to lodge a complaint with the Information Regulator (South Africa):
Website: https://inforegulator.org.za
Email: complaints.IR@justice.gov.za (or the address published by the Regulator from time to time)