MotoBay Privacy Policy
Effective date: 1 September 2026
Last updated: 25 August 2026
1. Who is responsible for your personal information
Motobay (Pty) Ltd (Registration No. 2026/260359/07) ("MotoBay", "we", "us", "our") is the responsible party for the personal information described in this policy, as that term is used in the Protection of Personal Information Act 4 of 2013 ("POPIA").
- Registered address: 14 Duet Crescent, Sonstraal Hoogte, Durbanville, 7550, Western Cape, South Africa
- Email: info@motobay.co.za
- Phone: 081 005 4928
- Website: https://motobay.co.za
Information Officer
- Name: Chris de Jager
- Email: info@motobay.co.za
- Phone: 081 005 4928
- Postal address: as above
Direct any question, request, or complaint about your personal information to the Information Officer.
This policy should be read together with our Terms of Use and Refund and Cancellation Policy.
2. What this policy covers
This policy explains what personal information we collect, why we collect it, who we share it with, how long we keep it, and what rights you have. It applies to everyone who uses https://motobay.co.za — buyers, sellers, dealers, and visitors.
3. Personal information we collect
3.1 Information you give us
| Category | Examples | When |
|---|---|---|
| Account details | Name, surname, email, mobile number, password (stored hashed) | Registration |
| Business details | Trading name, registration number, VAT number, dealer licence details, physical address, contact person | Dealer registration |
| Listing content | Vehicle make, model, VIN, registration number, mileage, condition, photographs, description, asking price, vehicle location | When you create a listing |
| Enquiry content | Your message to a seller, your contact details, questions asked | When you enquire on a listing |
| Payment details | Billing name, billing address, invoice history, last four digits and card type | When you buy a paid service |
| Support correspondence | Emails, messages, and call notes | When you contact us |
| Marketing preferences | Consents given and withdrawn | Ongoing |
3.2 Information we collect automatically
IP address, approximate location derived from it, browser and device type, operating system, referring page, pages viewed, listings viewed, searches run, session duration, and cookie and similar identifiers.
3.3 Information from third parties
- Payment provider — confirmation that a payment succeeded or failed, and fraud signals. We do not receive your full card number.
- Vehicle data provider — results returned against a VIN you submit, where you purchase a vehicle report.
- Advertising and analytics platforms — aggregated audience and campaign performance data.
3.4 What we do not collect
We do not deliberately collect special personal information as defined in section 26 of POPIA (such as health, biometric, religious, or political information), and we do not collect personal information about children. Do not include such information in listings, photographs, or messages.
Important: a vehicle photograph may inadvertently capture a licence plate, a person's face, or a street address. Please review images before uploading. You are responsible for the content you submit.
4. Why we process your information, and on what lawful basis
POPIA requires a lawful justification for each processing purpose. Ours are set out below.
| Purpose | Lawful basis (POPIA s11) |
|---|---|
| Creating and managing your account | Performance of our contract with you |
| Reviewing, publishing, and managing listings | Performance of our contract with you |
| Passing enquiries between buyers and sellers | Performance of our contract; legitimate interests of both parties |
| Processing payments, invoicing, and managing subscriptions | Performance of our contract; legal obligation |
| Retrieving a vehicle report you have purchased | Performance of our contract; your consent to the VIN query |
| Fraud prevention, moderation, and platform security | Our legitimate interests; legal obligation |
| Responding to support queries | Performance of our contract; our legitimate interests |
| Analytics and improving the platform | Our legitimate interests; your consent for non-essential cookies |
| Direct marketing to existing customers | Our legitimate interests, subject to opt-out |
| Direct marketing to non-customers | Your consent (POPIA s69) |
| Meeting tax, accounting, and regulatory obligations | Legal obligation |
| Establishing, exercising, or defending legal claims | Our legitimate interests; legal obligation |
Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing already carried out, and may mean we can no longer provide a service.
5. Who we share your information with
5.1 Between buyers and sellers
This is the core function of the platform. When you enquire about a listing, your name and contact details are provided to that seller. When you list a vehicle, the contact details you nominate are made available to buyers who enquire.
Both parties may use those details only to deal with that specific enquiry. Using them for unsolicited marketing, adding them to a mailing list, or passing them on is a breach of our Terms of Use and may breach POPIA. Once a buyer and seller are in contact, each becomes responsible for the other's information in their own hands, and MotoBay has no control over that.
5.2 Operators (service providers)
We use third parties to run the platform. Each processes personal information only on our documented instructions, under a written agreement as required by section 21 of POPIA:
| Type of operator | What they process | Provider |
|---|---|---|
| Hosting and infrastructure | All platform data | Red Hot Zone, South Africa |
| Payment processing | Payment and billing data | Paystack |
| Vehicle data provider | VIN and query metadata | Firstcheck |
| Email and communications | Contact details, message content | Domains.co.za |
| Analytics | Usage and device data | Red Hot Zone |
| Advertising platforms | Cookie identifiers, usage data | Meta Platforms |
| Customer support tooling | Correspondence | Red Hot Zone |
5.3 Other recipients
- Law enforcement and regulators, where required by law or where we reasonably suspect criminal conduct such as vehicle fraud or a stolen vehicle listing.
- Professional advisers — auditors, accountants, and attorneys, under duties of confidentiality.
- A purchaser of the business, if MotoBay is sold or restructured. You will be notified.
We do not sell your personal information.
6. Cross-border transfers
Some of our operators process information outside South Africa. Where that happens, section 72 of POPIA applies and we transfer only where the recipient is subject to laws or binding agreements providing an adequate level of protection, or where the transfer is necessary to perform our contract with you.
Countries currently involved: South Africa. Contact the Information Officer for details of the safeguards in place.
7. How long we keep your information
| Information | Retention period |
|---|---|
| Account data | Duration of the account, plus 12 months after closure |
| Published listings | Duration of the listing, plus 12 months after removal |
| Enquiry records | 24 months from the enquiry |
| Vehicle reports purchased | 12 months in your account, then archived for 5 years as a transaction record |
| Invoices, payments, and tax records | 5 years, as required by the Tax Administration Act and the Companies Act |
| Fraud, moderation, and suspension records | 5 years from the event |
| Marketing consents and opt-outs | Indefinitely, so that opt-outs are honoured |
| Server and security logs | 12 months |
| Support correspondence | 24 months |
After these periods information is deleted or de-identified, unless we are required to keep it longer for a legal claim or regulatory obligation.
8. Security
We apply reasonable technical and organisational measures under section 19 of POPIA, including encryption in transit (HTTPS), hashed password storage, role-based access limited to staff who need it, logged administrative access, regular backups, and contractual security obligations on our operators.
No system is completely secure. You are responsible for keeping your password confidential and for the activity under your account.
9. If there is a security compromise
If personal information is accessed or acquired by an unauthorised person, we will notify the Information Regulator and affected users as soon as reasonably possible after determining the extent of the compromise, as required by section 22 of POPIA. Notification will describe what happened, the likely consequences, and what you can do to protect yourself.
10. Your rights
Under POPIA you may:
- Access the personal information we hold about you, and be told who it has been shared with (section 23)
- Correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained (section 24)
- Object to processing based on legitimate interests, on reasonable grounds (section 11(3))
- Withdraw consent where processing relies on it
- Opt out of direct marketing at any time (section 69)
- Complain to the Information Regulator (section 74)
How to exercise these rights. Email info@motobay.co.za, marked for the attention of the Information Officer. Formal access and correction requests must be made on the prescribed forms under POPIA and the Promotion of Access to Information Act 2 of 2000; we will supply them on request. We may ask you to verify your identity, and will respond within 30 days.
Limits. The right to deletion is not absolute. We may decline where we are legally required to retain information — for example, invoices for tax purposes, or records needed to defend a legal claim or prevent fraud. If we decline, we will tell you why.
Access requests are handled free of charge for a first request; a prescribed fee may apply to duplicate or voluminous requests.
Our PAIA Manual is available at \[URL] or on request.
11. Direct marketing
We will send you service and transactional messages — payment confirmations, listing status, security notices — for as long as you hold an account. These are not marketing and you cannot opt out of them while your account is active.
For marketing:
- If you are an existing customer, we may market our own similar products and services to you, and you may opt out at any time using the unsubscribe link or by emailing us.
- If you are not an existing customer, we will only send electronic marketing with your consent. Under section 69 of POPIA we may ask for that consent once. If you decline or do not respond, we will not ask again.
We do not provide your details to third parties for their own marketing.
12. Cookies and similar technologies
We use:
- Strictly necessary cookies — login sessions, security, load balancing. These cannot be disabled.
- Preference cookies — remembering your search filters, region, and display settings.
- Analytics cookies — understanding how the platform is used so we can improve it.
- Advertising cookies and pixels — including the Meta (Facebook) pixel, which allows us to measure campaign performance and show you MotoBay adverts on Meta platforms. These involve sharing identifiers with Meta.
Non-essential cookies are set only after you consent through our cookie banner. You can change or withdraw your choices at any time via \[COOKIE SETTINGS LINK], and can block or delete cookies in your browser, though parts of the platform may then not work.
13. Vehicle reports and third-party data
When you purchase a vehicle report, we submit the VIN to a third-party data provider and return the result to you.
- The report reflects records held by that provider and the relevant registries at the time of the query. We do not create, verify, or amend that data.
- Your query is logged against your account for billing, support, and fraud-prevention purposes.
- If you believe a record in a report is inaccurate, contact us and we will refer it to the provider. Correction rights in respect of source data lie against the provider and the registry that holds it, not against MotoBay.
14. Third-party links
The platform links to third-party sites, including sellers' own websites and social media. We are not responsible for their privacy practices. Review their policies before providing information.
15. Children
MotoBay is not intended for anyone under 18. We do not knowingly process the personal information of children. If you believe we hold information about a child, contact the Information Officer and we will delete it.
16. Changes to this policy
We may update this policy. The version published here at the time of processing governs that processing. For material changes affecting registered users we will give notice by email at least 30 days before they take effect. Dated previous versions are retained and available on request.
17. Complaints
Please raise concerns with our Information Officer first — most issues are resolved quickly. If you are not satisfied, you may complain to:
Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
General enquiries: enquiries@inforegulator.org.za
POPIA complaints: POPIAComplaints@inforegulator.org.za
Website: https://inforegulator.org.za
Complaints must be made in writing in the prescribed manner; the Regulator's eServices portal is the current route.