Privacy Policy

1. Information We Collect

We collect the following categories of personal information depending on how you interact with the Platform:

1.1 Information you provide directly

• Sellers: Name, email address, phone number, vehicle registration (licence plate), vehicle details (make, model, year, mileage, condition), photographs of the vehicle, location (province/city), and any additional information you choose to include.
• Dealers / Partners: Business name, trading name, registration number, VAT number, contact person details, email address, phone number, physical address, dealer licence information, and banking details for transaction purposes.
• General users: Name and email address when you create an account, contact us, or subscribe to communications.

1.2 Information collected automatically

• Device and browser information (type, operating system, screen resolution).
• IP address, approximate geographic location, and referring URL.
• Pages visited, features used, clicks, time spent, and other usage analytics.
• Cookies and similar tracking technologies (see Section 7).

1.3 Information from third parties

• Vehicle data from third-party databases used to verify or supplement vehicle details you provide (e.g. vehicle history, specification lookups).
• Identity or business verification data from external providers when onboarding dealers.

2. How We Use Your Information

We process your personal information to:

• Operate the Platform and facilitate private vehicle auctions between sellers and verified dealers.
• Create and manage your account, authenticate access, and maintain security.
• Verify dealer credentials and manage the partner application process.
• Communicate with you about your listings, bids, offers, account status, and support requests.
• Send transactional notifications (e.g. offer received, auction status updates).
• Improve, personalise, and optimise the Platform and user experience.
• Comply with legal obligations, enforce our Terms of Service, and protect against fraud or misuse.
• Generate aggregated, anonymised statistics for internal analysis and reporting.

3. Legal Basis for Processing

Under POPIA, we rely on the following lawful grounds for processing:

• Consent: Where you have given explicit consent (e.g. opting into marketing communications).
• Contract: Where processing is necessary to perform a contract with you or to take pre-contractual steps at your request (e.g. processing your listing or dealer application).
• Legitimate interest: Where processing is necessary for our legitimate interests (e.g. fraud prevention, Platform security, and service improvement), provided these interests are not overridden by your rights.
• Legal obligation: Where we are required to process data to comply with applicable laws or regulations.

4. Who We Share Your Information With

We do not sell your personal information. We may share it with:

• Verified dealers: When you list a vehicle, certain vehicle details and your general location are shared with verified dealers participating in the auction. Your full contact details are only shared once you accept an offer.
• Sellers: Dealers participating in an auction may have limited business information visible to the seller.
• WeMakeSites (Pty) Ltd: As the parent company and operator of the Platform, WeMakeSites has access to all data processed through AutoYard for operational, administrative, and legal purposes.
• Service providers: Third-party providers who assist us with hosting, analytics, email delivery, communication tools, payment processing, and vehicle data services. These providers are contractually bound to protect your data.
• Legal and regulatory authorities: Where required by law, court order, or to protect the rights, safety, or property of AutoYard, WeMakeSites, our users, or the public.
• Business transfers: In the event of a merger, acquisition, reorganisation, or sale of assets involving AutoYard or WeMakeSites, your information may be transferred as part of that transaction.

5. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes described in this policy, or as required by law. Specifically:

• Active accounts: Data is retained for the duration of your account and for a reasonable period afterward to handle any post-termination queries.
• Completed transactions: Transaction records are retained for a minimum of seven (7) years in compliance with the Companies Act, Tax Administration Act, and other applicable South African legislation.
• Inactive accounts: Accounts with no activity for twenty-four (24) months may be deactivated and associated data anonymised or deleted, subject to legal retention requirements.
• Marketing data: If you unsubscribe, we will stop marketing communications promptly and retain only what is needed to honour your opt-out preference.

6. Data Security

We implement reasonable technical and organisational measures to protect your personal information, including:

• Encryption of data in transit (TLS/SSL) and at rest.
• Access controls limiting data access to authorised personnel.
• Regular security assessments and monitoring.
• Secure hosting infrastructure with reputable cloud providers.

While we take reasonable precautions, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security of your data.

7. Cookies and Tracking Technologies

We use cookies and similar technologies to operate the Platform, remember your preferences, understand usage patterns, and improve our Services. These include:

• Essential cookies: Required for authentication, security, and core functionality. These cannot be disabled.
• Analytics cookies: Help us understand how the Platform is used so we can improve it.
• Preference cookies: Remember your settings and choices.

You can manage cookie preferences through your browser settings. Disabling certain cookies may affect Platform functionality.

8. Your Rights Under POPIA

As a data subject under POPIA, you have the right to:

• Access: Request confirmation of whether we hold your personal information and obtain a copy.
• Correction: Request correction or updating of inaccurate, incomplete, or misleading personal information.
• Deletion: Request deletion or destruction of personal information that is no longer necessary for the purpose it was collected, subject to legal retention requirements.
• Objection: Object to the processing of your personal information on reasonable grounds.
• Withdraw consent: Where processing is based on consent, withdraw your consent at any time (this does not affect the lawfulness of processing before withdrawal).
• Complaint: Lodge a complaint with the Information Regulator (South Africa) if you believe your privacy rights have been infringed.

To exercise any of these rights, contact us using the details in Section 11.

9. Cross-Border Data Transfers

Our hosting and service providers may process data outside of South Africa. Where this occurs, we ensure that appropriate safeguards are in place, including contractual obligations that provide a level of protection substantially similar to that required under POPIA.

10. Children’s Privacy

The Platform is not directed at persons under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected such data, we will take steps to delete it promptly.

11. Contact Us

If you have questions about this Privacy Policy, wish to exercise your rights, or need to report a data concern, please contact us:

• Responsible party: WeMakeSites (Pty) Ltd, trading as AutoYard
• Email: info@wemakesites.co.za
• WhatsApp: +27 68 619 4575

You may also contact the Information Regulator (South Africa) at inforegulator.org.za.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the Platform or by email. Your continued use of the Services after changes are posted constitutes acceptance of the updated policy.