Privacy Policy

Last updated: 9 August 2026

AJ Auctions processes personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA). This policy explains what we hold, why we hold it, who it goes to and what you can ask us to do about it.

Who is responsible

AJ Auctions is the responsible party. Our Information Officer can be reached at Admin@ajauctions.co.za or 063 026 8817, at 20 Dirk van den Berg Street, Modimolle, Limpopo.

What we collect

Bidders: name, WhatsApp number, email address, and your bidding history. Your number is verified with a one-time code before your first bid.
Sellers: name, contact details, address and — in order to pay you — identity number, VAT number where applicable, and banking details.
Sale records: what was sold, to whom, for how much, and the payment and payout history.
Technical: a session cookie to keep you signed in, a cookie recording that your number has been verified, and error logs needed to keep the site working. We run no advertising or third-party tracking.

Why we process it, and on what basis

To perform the auction contract: accepting bids, notifying you of outbids and results, invoicing, and paying sellers.
Our legitimate interest in preventing fraud: verifying that a WhatsApp number belongs to the bidder, and blocking numbers involved in abuse or non-payment.
Legal obligation: keeping accounting, tax and VAT records.
Consent: optional email updates, which you can withdraw at any time.

Who we share it with

The other party to a sale. When a lot sells, buyer and seller receive the contact and collection details needed to complete it.
Our service providers, who process information only on our instruction: website hosting and database (Vercel, Neon), WhatsApp messaging (Twilio), and file storage for lot photographs.
Authorities, where the law requires it.
We do not sell personal information, and we do not share bidders' contact details with other bidders.

Information sent outside South Africa

Our hosting, database and messaging providers operate servers outside South Africa, including in the United States and the European Union. Where personal information is processed outside the country we rely on those providers being bound by contractual terms that require a level of protection comparable to POPIA, as permitted by section 72 of the Act.

How long we keep it

Sale, invoice and payout records are kept for at least five years, as required by tax and company legislation.
Bidder records that have shown no activity for three months are removed from our active lists automatically. Records of numbers blocked for abuse are kept for as long as the block applies.
Photographs and documents no longer attached to a listing are deleted from storage.

How we protect it

Access is limited to authorised administrators, each with their own account and permissions, and every administrative action is recorded in an audit log. Passwords are stored hashed, connections to the site are encrypted, and bidders' contact details are never exposed publicly — the public bid history shows only a shortened name. If personal information in our care is compromised, we will notify the affected people and the Information Regulator as POPIA requires.

Your rights

You may ask what we hold about you, ask us to correct or delete it, object to processing, or withdraw consent to optional messages. Some records — those tied to a completed sale — must be kept for tax purposes even after such a request. Contact the Information Officer above and we will respond as soon as we reasonably can. You may also complain to the Information Regulator: complaints.IR@inforegulator.org.za, inforegulator.org.za.