Privacy Policy

1.1 Madeinafrica.io ("Platform", "we", "us", "our") is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use our Platform.

1.2 This Policy is intended to describe the Platform's approach with reference to applicable data-protection requirements, including:

• The Protection of Personal Information Act, 2013 (POPIA) — South Africa;
• The General Data Protection Regulation (GDPR) — European Union (for EU-based Users);
• Applicable data protection laws in SADC member states.

1.3 We process personal information only on an applicable legal basis and provide choices where required by law. Use of the Platform does not by itself replace any consent or notice that applicable law requires.

2.1 Information You Provide Directly:

• Registration data: Full name, email address, phone number, password, company name, country, industry, business registration number;
• Verification documents: Company registration certificates, director identification, proof of address, VAT certificates, tax clearance certificates, bank confirmation letters, export licenses, financial statements;
• Product listings: Product descriptions, images, pricing, MOQs, certifications;
• Communication data: Chat messages, inquiry content, RFQ descriptions, email correspondence;
• Transaction data: Order details, payment information, shipping addresses, invoicing details;
• Review data: Ratings, review text, photos uploaded with reviews;
• Profile data: Company logo, website URL, company description, social media links.

2.2 Information Collected Automatically:

• Device information: IP address, browser type, operating system, device identifiers;
• Usage data: Pages visited, search queries, products viewed, time spent on pages, click patterns;
• Location data: Approximate geographic location derived from IP address;
• Cookie data: As described in our Cookie Policy.

2.3 Information From Third Parties:

• Payment-related information: If a payment provider is connected and used, we may receive transaction status or reference information from that provider;
• Verification data: Information from national business registries (CIPC, BRELA, PACRA, etc.) when verifying Supplier documents;
• Analytics providers: Aggregated usage statistics from Google Analytics or similar tools;
• AI and translation services: Message content processed for auto-translation.

3.1 We process your personal information for the following purposes:

• To provide and operate the Platform and its features;
• To register and manage your account;
• To verify the identity and legitimacy of Suppliers;
• To facilitate communication between Buyers and Suppliers;
• To match Buyers with relevant Suppliers and Products;
• To support trade records and related workflows. Live platform escrow and payment collection are not currently available;
• To display advertising and calculate Credit usage;
• To provide shipping estimates and duty calculations;
• To resolve disputes and enforce our Terms of Service;
• To send transactional notifications (order confirmations, verification updates, payment receipts);
• To send marketing communications (with your consent);
• To improve the Platform, develop new features, and conduct analytics;
• To comply with legal and regulatory obligations;
• To detect and prevent fraud, abuse, and security threats;
• To provide data to AI agents and MCP servers in accordance with our MCP guidelines (public data only).

4.1 For Users in the European Union, we process personal data on the following legal bases:

• Consent: For marketing communications, optional data collection, and AI translation;
• Contract: For account management and platform features that are actually available. Live escrow services are not currently provided;
• Legitimate Interest: For fraud detection, platform improvement, and B2B matching;
• Legal Obligation: For tax reporting, AML/KYC compliance, and regulatory requirements.

5.1 We may share your personal information with:

• Other Users: Suppliers can see Buyer inquiry details; Buyers can see Supplier profile information. Contact details are only revealed based on membership tier and Credit usage;
• Service Providers: Cloud hosting, email, analytics, AI translation, and any payment or verification provider that is actually connected and used;
• Escrow: Live escrow is unavailable. No current escrow-provider appointment or licensing status is represented by this policy;
• Verification Partners: Third-party services that verify business registrations, tax numbers, and identity documents;
• Legal and Regulatory Authorities: When required by law, court order, or government request;
• AI Agents and MCP Servers: Publicly available product and supplier data may be accessed by AI agents in accordance with our robots.txt and llms.txt files. Private data (messages, documents, payment details) is never shared with AI agents;
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity.

5.2 We do NOT sell your personal information to third parties for marketing purposes.

6.1 Your personal information may be transferred to and stored in countries outside your country of residence, including South Africa (our primary data centre location), the United States (cloud hosting), and other jurisdictions where our service providers operate.

6.2 Where cross-border transfers occur, the applicable legal requirements and safeguards must be assessed for the actual providers, locations, and data flows before launch. Do not assume that a particular transfer mechanism applies without verification.

7.1 We retain personal information only for as long as needed for the stated purposes and applicable legal obligations. The exact retention schedule must be aligned with the live systems and approved internal policy before launch:

• Account and profile data: while needed to operate the account and handle lawful follow-up;
• Transaction, verification, and communication records: for the period required by applicable law and the approved retention schedule;
• Marketing preferences: as needed to honour your choices and applicable legal requirements.

7.2 You may request deletion of your data earlier by contacting MADEINAFRICADOTIO (Pty) Ltd at its registered postal address, marking the correspondence “Privacy request”, subject to legal retention requirements.

7.3 Deleting your account inside the app. You can delete your account yourself, without contacting us, from your account dashboard in both the website and the mobile app: open Dashboard, choose Delete my account, review the list of data that will be removed, and confirm by typing DELETE. Deletion then runs immediately and permanently; it is not a deactivation or a request.

7.4 What is deleted. Your account and sign-in details (name, email, phone, password); your company profile, microsite and verification documents; product listings, images, videos and broadcasts; inquiries, RFQs, quotations and chat messages; saved suppliers, tenders and searches; construction projects, tasks and time entries; academy enrolments, certificates and onboarding progress. Your public profile and listings stop appearing in the marketplace at the same time.

7.5 What is kept. Records we are legally required to retain, such as completed orders, invoices, payment and credit ledger records, customs documents, and records needed to resolve an open dispute, are retained for the period required by applicable law and are not used for marketing. Retained records are limited to what the legal obligation covers.

8.1 The Platform uses technical and organisational safeguards appropriate to its current implementation. The following controls must not be assumed to be present unless they have been independently confirmed for the live environment:

• Encryption and access controls must be verified against the deployed hosting and storage configuration.
• Verification documents should be stored privately and accessible only to authorised users.
• Administrator access, monitoring, audit procedures, and incident response arrangements must be confirmed before launch.
• Do not upload sensitive identity, banking, or tax documents until the applicable access controls have been verified.

8.2 While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

9.1 Under POPIA and GDPR, you have the following rights:

• Right of Access: Request a copy of all personal data we hold about you;
• Right to Rectification: Correct inaccurate or incomplete data;
• Right to Erasure: Delete your account and content yourself from your dashboard (section 7.3), or request deletion of your data ("right to be forgotten"), subject to legal retention obligations;
• Right to Restrict Processing: Limit how we use your data in certain circumstances;
• Right to Data Portability: Receive your data in a structured, machine-readable format;
• Right to Object: Object to processing based on legitimate interest or direct marketing;
• Right to Withdraw Consent: Withdraw consent at any time for processing based on consent;
• Right to Lodge a Complaint: File a complaint with the Information Regulator (South Africa) or your local data protection authority.

9.2 To exercise any of these rights, contact MADEINAFRICADOTIO (Pty) Ltd at its registered postal address, marking the correspondence “Privacy request”. We will respond within 30 days.

10.1 Our use of cookies is described in our Cookie Policy. Non-essential cookies should not be enabled before obtaining any consent required by applicable law.

11.1 The Platform is a B2B marketplace and is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children.

12.1 We may update this Privacy Policy from time to time. Material changes will be communicated via email and/or a banner on the Platform. The "Last Updated" date at the top of this page indicates when the Policy was last revised.

13.1 For privacy-related questions, requests, or complaints, address postal correspondence to the Company:

• MADEINAFRICADOTIO (Pty) Ltd · Registration number 2026/855463/07
• 88 Edward Avenue, Johannesburg, Gauteng, 2192, South Africa

13.2 If you are not satisfied with our response, you may lodge a complaint with:

• South Africa: Information Regulator — inforeg@justice.gov.za
• EU: Your national Data Protection Authority
• Other SADC countries: The relevant data protection authority in your jurisdiction