Privacy Policy

1. Introduction

Mila Auto Spares ("we", "us", or "our") is committed to protecting the personal information of every person who interacts with our platform. This Privacy Policy explains how we collect, use, store, and share your personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and all applicable South African data protection legislation.

By using our website at milaautospares.co.za, placing orders, registering as a buyer or seller, or otherwise interacting with our services, you consent to the processing of your personal information as described in this policy.

2. Responsible Party

The responsible party for the purposes of POPIA is:

3. Information We Collect

We collect and process the following categories of personal information:

Account Information: When you register, we collect your name, surname, email address, phone number, and password (stored in hashed form). Sellers additionally provide business name, trading name, registration number, VAT number, and bank details for payouts.

Transaction Information: When you place orders, we collect delivery addresses, order history, payment references, and communication between buyers and sellers.

Vehicle Information: VIN numbers, vehicle make, model, year, and engine codes you provide when searching for parts.

Technical Information: IP address, browser type, device information, pages visited, and cookies as described in Section 9.

Communication Data: Messages sent through our platform, quote requests, support enquiries, and WhatsApp interactions if you opt into that channel.

4. Purpose of Processing

We process your personal information for the following lawful purposes:

Fulfilling our contract with you: Creating and managing your account, processing orders, facilitating communication between buyers and sellers, processing payments, arranging deliveries, and providing customer support.

Legitimate interest: Improving our platform and services, preventing fraud and abuse, enforcing our terms of service, and generating anonymised analytics to improve the marketplace experience.

Legal obligation: Complying with tax legislation, the Consumer Protection Act, the Electronic Communications and Transactions Act, and any lawful requests from authorities.

Consent: Sending marketing communications, newsletters, and promotional offers. You may withdraw consent at any time by clicking "unsubscribe" or contacting us directly.

5. Sharing of Personal Information

We share personal information only when necessary to operate the marketplace:

Between buyers and sellers: When you request a quote or place an order, the relevant seller receives your name, contact details, delivery address, and vehicle information necessary to fulfil the order.

Courier and delivery partners: Your name, phone number, and delivery address are shared with courier services to complete deliveries.

Payment processors: Payment information is processed by PCI-DSS compliant third-party payment gateways. We do not store your full card details on our servers.

Service providers: We use hosting providers, email services, and analytics tools that may process data on our behalf under strict data processing agreements.

We do not sell your personal information to third parties. We may transfer anonymised, aggregated data for research or analytics purposes.

6. Cross-Border Transfers

Some of our service providers (such as cloud hosting and email delivery) operate outside South Africa. Where personal information is transferred to a country that does not provide an adequate level of protection as contemplated in POPIA, we ensure appropriate safeguards are in place, including contractual obligations that require the recipient to protect the information to at least the same standard required under POPIA.

7. Retention

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Account information is retained for the duration of your active account and for 5 years thereafter. Transaction records are retained for 5 years as required by SARS. You may request deletion of your account at any time, subject to legal retention obligations.

8. Security

We implement reasonable technical and organisational measures to protect your personal information, including encryption of data in transit (TLS/SSL), secure password hashing, access controls, regular security assessments, and secure hosting infrastructure. While we take all reasonable steps, no method of electronic transmission or storage is 100% secure. We encourage you to use strong, unique passwords and to notify us immediately if you suspect unauthorised access to your account.

9. Cookies

Our website uses cookies and similar technologies to remember your preferences, keep you signed in, and understand how you use our platform. Essential cookies are required for the site to function. Analytics cookies (Google Analytics) help us improve the platform and are only enabled with your explicit consent via the cookie banner shown on your first visit. You can change your preference at any time by clearing your browser cookies, which will prompt the consent banner again. Disabling essential cookies may affect site functionality.

10. Your Rights Under POPIA

As a data subject, you have the right to:

Access: Request confirmation of whether we hold personal information about you, and request a copy of that information.

Correction: Request that we correct or update inaccurate or incomplete personal information.

Deletion: Request that we delete your personal information, subject to legal retention requirements.

Objection: Object to the processing of your personal information on reasonable grounds, or object to receiving direct marketing communications.

Complaint: Lodge a complaint with the Information Regulator if you believe your rights have been infringed. The Information Regulator can be contacted atinforegulator.org.za.

To exercise any of these rights, contact us at info@milaautospares.co.za. We will respond within 30 days.

11. Children

Our platform is not directed at children under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will take steps to delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a notice on our website. Your continued use of the platform after changes are posted constitutes acceptance of the updated policy.

13. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal information, please contact us: