Privacy Policy

Galactica Marketplace (Pty) Ltd is the responsible party (data controller) for personal information collected through the Galactica platform. Our Information Officer can be reached at privacy@galactica.co.za.

We only collect information that is necessary for the operation of the marketplace and our legal obligations. We do not sell your data to third parties.

Your South African ID number is classified as sensitive personal information under POPIA. We treat it accordingly:

• It is encrypted using AES-128 symmetric encryption before being stored in our database. The plaintext ID number is never stored at rest.
• A one-way cryptographic hash is used for uniqueness checks — this cannot be reversed to reconstruct your ID number.
• Decryption keys are stored separately from the database and are never accessible to store owners or drivers.
• Only authorised Galactica administrators can access the encrypted value, and only for compliance purposes (FICA, law enforcement requests).

We share your information only as necessary:

• Store owners receive your name, phone number, and delivery address for orders placed at their store. They do not receive your ID number.
• Drivers receive your name, phone number, and delivery address to complete deliveries. They do not receive your ID number or payment details.
• Supabase (our authentication and database provider) processes your email and authentication credentials. They operate under GDPR/POPIA-compliant data processing agreements.
• Law enforcement — we may disclose information when required by a valid court order, warrant, or legal process under South African law, or when required to prevent imminent harm.
• We do not sell, rent, or share your personal information with advertisers or marketing companies.

Retention periods are set by legal obligation where applicable:

• Transaction records and payment references — 5 years, as required by FICA.
• ID verification records — 5 years from the date of submission, as required by FICA due diligence obligations.
• Account data — retained while your account is active, and for 1 year after deletion to allow for dispute resolution.
• Push notification tokens — deleted when you deregister the device or delete your account.
• Security logs (IP addresses, audit logs) — 12 months.

You have the following rights regarding your personal information:

• Access — request a copy of the personal information we hold about you.
• Correction — request correction of inaccurate or incomplete information.
• Deletion — request deletion of your data. Note: data subject to FICA retention obligations cannot be deleted before the mandatory retention period expires.
• Withdraw consent — withdraw consent for processing based on consent (e.g., push notifications). Withdrawal does not affect processing that occurred before withdrawal.
• Object — object to processing based on legitimate interest.
• Complain — lodge a complaint with the Information Regulator of South Africa at www.justice.gov.za/inforeg.

To exercise any of these rights, email privacy@galactica.co.za. We will respond within 30 days.

We implement technical and organisational measures to protect your personal information, including:

• Encryption of sensitive fields at rest (SA ID numbers) and in transit (HTTPS/TLS).
• Role-based access controls — staff only access data necessary for their function.
• Audit logging of all administrative actions involving personal data.
• Regular security assessments and dependency vulnerability scanning.
• Rate limiting and brute-force protection on all authentication endpoints.

Despite these measures, no system is completely secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the Information Regulator within 72 hours of becoming aware, as required by POPIA.

The Galactica web platform uses session cookies for authentication only. We do not use advertising cookies, tracking pixels, or third-party analytics. The mobile app does not use cookies.

The Galactica platform is strictly for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, contact us immediately at privacy@galactica.co.za and we will investigate and delete the account within 48 hours.

We may update this Privacy Policy from time to time. Material changes will be communicated by email and in-app notification at least 7 days before taking effect. The current effective date is always shown at the top of this page.

For privacy concerns, data requests, or to report a concern about how your data is being handled:

Email: privacy@galactica.co.za

Information Officer: Galactica Marketplace (Pty) Ltd, South Africa