Privacy Policy

This Privacy Policy explains how VapeDash collects, uses, shares and protects personal information, in line with the Protection of Personal Information Act 4 of 2013 (POPIA).

1. Responsible party and Information Officer

The responsible party is VapeDash, Nelspruit (Mbombela), Mpumalanga. Our Information Officer is Tim Obidov (tim.obidov@gmail.com or 073 460 4026).

2. What we collect

Customers: email address and password (stored hashed); name, cell number and delivery address when you place an order; order history; your VapeDash Plus subscription status, loyalty points and what you usually reorder (to show reorder reminders); confirmation that you are 18 or older (and when you gave it); technical data needed to run the app.
What we do not collect: we do not ask for your date of birth or ID number at sign-up, and we do not store payment card numbers.
Drivers: name, email, cell number, vehicle details, GPS location while online or on a delivery, trip distances, and bank details for payouts.
Partner shops: business contact details, products, prices, stock and bank details for payouts.
Payments: card payments are processed by Paystack. We receive the payment status and reference, not your full card details.
This website: we do not use analytics or advertising cookies. Your browser stores a single preference (that you confirmed you are 18+) so the age pop-up does not repeat.

3. Why we use it

To create your account, take and deliver your order, and let you track it (performance of our contract with you).
To process payments and refunds, and to pay partner shops and drivers.
To enforce our age policy, prevent fraud and abuse, and keep records required by law (legal obligation and our legitimate interests).
To contact you about your order or account. We do not send marketing, and we never direct marketing at under-18s.

4. Who we share it with

Your driver sees your name, cell number and delivery address only after accepting your order.
Partner shops see the items ordered, not your contact details.
Paystack (payments and payouts) and our hosting and technology providers process data on our behalf under agreements that require them to protect it.
Authorities, where the law requires it.

We do not sell personal information.

5. Where it is stored

Our providers may store data on servers outside South Africa. Where that happens we only use providers that give an adequate level of protection as required by POPIA section 72.

6. How long we keep it

Order, payment and payout records: for the period required by tax and consumer laws (generally five years).
Driver GPS location trail: deleted after 90 days (trip distance totals are kept for payroll records).
Account details: until you delete your account, after which personal details are erased or anonymised, except records we must keep by law.

7. Security

We use encryption in transit, hashed passwords, encrypted storage of bank account numbers and role-based access. No system is perfectly secure; if there is a breach that affects you we will notify you and the Information Regulator as POPIA requires.

8. Your rights

You may ask us to confirm what personal information we hold, give you a copy, correct it, or delete it; and you may object to processing. In the app you can download your data and delete your account from Profile. You can also contact us at tim.obidov@gmail.com or 073 460 4026.

If you are unhappy with how we handle your information, you may complain to the Information Regulator (South Africa): inforegulator.org.za, complaints.IR@justice.gov.za.

9. Children

The Service is only for people aged 18 or older. We do not knowingly collect information from anyone under 18; if you believe we have, contact us and we will delete it.

10. Changes

We will update this policy when our practices change and show the date of the latest version at the top of this page.