Legal › Privacy Policy

Privacy Policy

Toothless Holdings (Pty) Ltd · Reg. 2026/191148/07 · Effective 25 April 2026 · Version 1.0

1. Introduction

Toothless Holdings (Pty) Ltd ("Toothless Holdings", "we", "us", or "our") is the registered owner and operator of Markplain — the online marketplace and merchant platform accessible at www.markplain.co.za and related mobile applications. References to "Markplain" in this policy refer to the Markplain platform operated by Toothless Holdings. We are committed to protecting the privacy and personal information of all users of our platform.

This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use the Markplain platform. Please read this policy carefully. By using Markplain, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Information You Provide Directly

• Full name and surname
• Email address
• Mobile phone number (if you choose to verify)
• South African ID number (for Gold-tier identity verification only — optional)
• Physical address (for delivery purposes when using the merchant platform)
• Profile photograph (optional)
• Business name, VAT number, and company registration number (for merchant accounts)
• Payment gateway credentials (for merchants — encrypted and never shared)
• Communications you send through the in-platform messaging system
• Listings, product descriptions, images, and pricing you upload

2.2 Information Collected Automatically

• IP address and approximate geographic location
• Device type, operating system, and browser type
• Pages visited, search queries, and time spent on the platform
• Clickstream data and user interaction patterns
• Cookie identifiers and session tokens
• FCM (Firebase Cloud Messaging) device tokens for push notifications

2.3 Information From Third Parties

• If you register or log in using Google, Facebook, or X (Twitter), we receive your name, email address, and profile photo from those providers — subject to your privacy settings on those platforms
• We do not receive your social media passwords
• Identity verification data from approved third-party identity verification services (for Gold-tier users only, with your consent)

3. How We Use Your Information

We use your personal information for the following purposes:

3.1 Platform Operations

• Creating and managing your Markplain account
• Enabling buying, selling, and bidding functionality
• Processing orders and coordinating between buyers and sellers
• Operating the in-platform encrypted messaging system
• Provisioning merchant storefronts and subdomains

3.2 Communications

• Sending transaction confirmations, receipts, and order updates
• Sending push notifications, email alerts, and (if opted in) WhatsApp notifications
• Responding to your support enquiries
• Sending security alerts (e.g. new login from unrecognised device)

3.3 Safety and Trust

• Verifying your identity through our tiered verification system
• Detecting and preventing fraud, scams, and abuse
• Enforcing our Terms of Service
• Operating our anti-scam rules engine

3.4 Improvement and Analytics

• Analysing platform usage to improve features and performance
• Generating anonymised and aggregated statistics
• Conducting A/B testing on platform features

4. Legal Basis for Processing (POPIA)

We process your personal information on the following legal grounds under the Protection of Personal Information Act 4 of 2013 (POPIA):

• Contract: Processing is necessary to provide the Markplain service you have requested
• Legitimate interest: Processing is necessary for our legitimate business interests, such as fraud prevention and platform security
• Consent: Where we rely on your consent (e.g. marketing emails, WhatsApp notifications), you may withdraw consent at any time
• Legal obligation: Where we are required to process information to comply with South African law

5. How We Share Your Information

5.1 With Other Users

• Your display name, verification badge, and star rating are visible to other users
• Listings you post are publicly visible
• Your phone number and email address are NEVER shared with other users — all communication goes through the in-platform messaging system

5.2 With Service Providers

We share information with trusted third-party service providers who assist us in operating the platform, subject to confidentiality agreements:

• PayFast and Ozow — for payment processing (your card data goes directly to these providers and is never stored by Markplain)
• Firebase (Google) — for push notification delivery
• Africa's Talking — for SMS OTP verification and WhatsApp Business notifications
• Meilisearch — for search functionality
• Toothless Domains (Toothless Holdings group company) — for domain and email hosting services

5.3 We Do Not Sell Your Data

5.4 Legal Disclosure

We may disclose your information if required to do so by law, court order, or government authority, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

6. Data Storage and Security

• All personal data is stored on servers located in South Africa
• We use industry-standard encryption (TLS 1.2+) for all data in transit
• Sensitive data (payment credentials, phone numbers) is encrypted at rest using AES-256
• In-platform messages are encrypted in the database
• We conduct regular security reviews and vulnerability assessments
• In the event of a data breach that affects your rights, we will notify you within 72 hours as required by POPIA
• We retain your data for as long as your account is active, plus a further 5 years as required for financial record-keeping under South African law

7. Your Rights Under POPIA

As a data subject under the Protection of Personal Information Act, you have the following rights:

• Right of access: You may request a copy of the personal information we hold about you
• Right to correction: You may request correction of inaccurate or incomplete information
• Right to deletion: You may request deletion of your personal information, subject to legal retention requirements
• Right to object: You may object to the processing of your information for direct marketing purposes
• Right to withdraw consent: Where we rely on consent, you may withdraw it at any time
• Right to lodge a complaint: You may lodge a complaint with the Information Regulator of South Africa

To exercise any of your rights, contact our Information Officer at:

8. Cookies

Markplain uses cookies and similar tracking technologies to operate and improve the platform. You can control cookie settings through your browser settings. Disabling cookies may affect the functionality of the platform.

• Session cookies: Required for login and platform functionality
• Analytics cookies: Help us understand how users interact with the platform
• Preference cookies: Remember your settings and preferences

9. Children's Privacy

Markplain is not intended for use by persons under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with their personal information, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email and by posting a prominent notice on the platform at least 30 days before the changes take effect. Continued use of the platform after the effective date constitutes acceptance of the updated policy.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: