Privacy policy

Noques is operated by IDK Solutions, which is the responsible party for the personal information described here under the Protection of Personal Information Act. This covers the marketplace website and app.

It does not cover a vendor’s own handling of your information once an order reaches them. A vendor is a separate responsible party for what they do with it.

What you give us

• An account: your email address and a display name. A phone number and a profile picture, if you add them.
• Orders: what you bought, from which vendors, the amounts, and the status of each part of the order.
• Messages: anything you send through the contact form, a support ticket or a product review.
• Vendors additionally: your business name and trading address, the contact details you publish, and banking details for payouts. The account number is stored masked — the full number is not retained after the payout instruction is set up. Charity vendors also provide registration documents.

What is collected as you use it

• A device token, if you allow push notifications, so a notification can reach the right device. Removing the app or revoking the permission ends it.
• Usage measurement through Google Analytics — which pages are visited, how people move through checkout, and where they give up. It is read in aggregate.
• Ordinary server and security logs, which include IP addresses.

What is never collected

Card details. Payment happens at Yoco. No card number, expiry or CVV passes through Noques or is stored by it, so there is none here to lose.

• To create and run your account.
• To process orders, take payment, split an order between vendors, pay vendors out, and handle refunds.
• To tell you what is happening with an order you placed, and to answer you when you get in touch.
• To review a vendor application and to investigate a report about a vendor or a customer.
• To detect and prevent fraud and abuse.
• To understand how the marketplace is used, in aggregate, so it can be improved.
• To meet legal and tax obligations, which is why order records outlive an account.

Vendors

A vendor you order from receives what they need to fulfil that order: your name, what you ordered, and the contact details attached to the order. They do not receive your payment details, and they do not see your orders with anybody else.

Service providers

These operate parts of the service on Noques’ instructions and may not use your information for their own purposes:

• Google (Firebase): sign-in, the database, file storage and the server functions — effectively the whole backend.
• Yoco: card payments and refunds.
• Algolia: product search.
• Resend: transactional email.
• Google Analytics: usage measurement.

Nobody else

Your information is not sold, and it is not shared for anybody else’s marketing. It is disclosed otherwise only where the law requires it or to establish or defend a legal claim.

Outside South Africa. The backend runs in Google’s europe-west1 region, in Belgium, and several of the providers above operate internationally. That means your personal information is transferred across a border.

POPIA permits this where the recipient is subject to a law or binding agreement giving comparable protection. Belgium is covered by the GDPR, and the provider agreements include the standard data protection terms. Saying so plainly is better than the more usual silence: it is the kind of thing you are entitled to know before you hand anything over.

• Your account: while it exists, and for a short period afterwards so a deletion can be reversed if it was a mistake.
• Orders, payments and ledger entries: for as long as tax and financial record-keeping law requires, which is longer than your account. A deleted account does not erase the record that a payment was made — it cannot, and a policy claiming otherwise would be untrue.
• Support messages: while they are useful for answering you and for a reasonable period after.
• Analytics: in aggregate, on Google’s own retention schedule.

Access to data is enforced at the database itself rather than only in the app: the security rules decide what each account may read and write, and a request from a browser that is not entitled to a document is refused by the database, not by the interface. Vendor documents cannot be created by a client at all.

Connections are encrypted in transit and data is encrypted at rest by the hosting provider. Administrative functions require an administrator claim, checked on the server.

No system is immune. If a breach affects your personal information, POPIA requires notification to you and to the Information Regulator, and we will do that.

Under POPIA you may:

• Ask what personal information is held about you, and get a copy.
• Have inaccurate information corrected.
• Have information deleted where it is no longer needed for a purpose above or required by law.
• Object to processing, on reasonable grounds.
• Withdraw consent for marketing, at any time and at no cost.
• Complain to the Information Regulator of South Africa, which you may do without going through us first.

Ask through the contact form. You will be asked to confirm who you are before information is handed over, which is a protection for you rather than an obstacle.

POPIA requires a named information officer, registered with the Information Regulator, and a physical address at which a request can be served.

Those details are not yet published here, and this page will not print a placeholder in their place. Until they appear, requests through the contact form reach the people responsible and are handled on the same terms.

Noques is not intended for anybody under 18, and accounts are not knowingly created for children. If you believe a child has an account, tell us and it will be removed.