Inqubomgomo Yobumfihlo

This policy explains what personal information The Farmer collects through thefarmer.co.za and the The Farmer mobile app, why we collect it, who we share it with, and what you can ask us to do with it. It is written to meet the Protection of Personal Information Act 4 of 2013 (POPIA).

Who is responsible for your information

The Farmer is the responsible party for the personal information described here. You can reach us about anything in this policy, including a request to access or delete your information, at privacy@thefarmer.co.za.

What we collect

Account information

Your email address, and a password that is stored only as a cryptographic hash — we never hold your password itself. If you sign in with Google, we receive your Google account identifier and email address instead of a password, and we ask you once whether you are buying or farming.

Farm and listing information

If you sell on The Farmer, we collect your farm name, description, story, tags, and farm address (street, city, province, postal code, country), together with any cover photo and produce images you upload. This information is shown publicly on your farm page, because it is how buyers find you.

Verification information (sellers only)

Before a farm can be paid, South African financial law (FICA) requires us to verify who is behind it. For sellers we collect legal first and last name, date of birth, South African ID number or passport number, business name and registration number where applicable, tax number, and bank account details. We also store the verification documents you upload.

These fields are encrypted at rest in our database, separately from ordinary account data, and are visible only to the small number of staff who perform verification reviews. Buyers never see them.

Location

The mobile app asks for location permission so it can show farms and produce near you. You can decline, and the rest of the app keeps working — you will simply need to search by area instead. We use your device location to run the search; we do not build a movement history from it.

Camera and photos

The app asks for camera and photo-library access only when you choose to add a picture of your farm, your produce, or a verification document. We access nothing else in your photo library.

Messages, orders and reviews

Conversations between buyers and farmers, order records, and reviews you write are stored so both sides have a record of what was agreed. Order and payment records are kept even after a conversation ends, because they are accounting records.

Notifications

If you allow push notifications, we store a device token issued by Google Firebase Cloud Messaging, together with the platform (Android or iOS), so we can send you order and message alerts. Turning notifications off in the app removes the token.

Technical and diagnostic information

When something goes wrong we record the error, the screen it happened on, and basic device and app-version information, so we can fix it. Crash and error reports are processed by Sentry on our behalf.

Who we share it with

We do not sell your personal information. We share it only with:

• Other users, by design. A farm's public listing, its address and its produce are visible to buyers. A buyer's name and delivery details are shared with the farmer they order from, so the order can be fulfilled.
• Paystack — our payment provider. Paystack processes card payments and verifies seller bank accounts. Card details are entered on Paystack's systems and are never stored by The Farmer.
• Google — Firebase Cloud Messaging for push notifications, Google Maps for showing farm locations, and Google Sign-In if you choose it.
• Sentry — error and crash diagnostics.
• Law enforcement or regulators, where we are legally obliged to disclose information.

How long we keep it

Account, farm and order records are kept for as long as your account is open, and afterwards for as long as we need them for accounting and dispute purposes.

Seller verification information is subject to a five-year retention period under FICA, counted from the end of our business relationship with you. We cannot delete it earlier, even on request. Once that period expires, the personal fields and uploaded documents are erased automatically and only a non-personal audit record — that a check happened, when, and its outcome — is retained.

Your rights under POPIA

You may ask us to:

• tell you what personal information we hold about you;
• correct anything that is wrong or out of date;
• delete your information, subject to the FICA retention period above; and
• stop sending you marketing messages.

Write to privacy@thefarmer.co.za and we will respond within 30 days. If you are not satisfied, you may complain to the Information Regulator (South Africa) at inforegulator.org.za.

Security

Traffic to thefarmer.co.za is encrypted in transit with TLS. Verification and banking fields are additionally encrypted at rest. Access to production data is limited to staff who need it. No system is perfectly secure, and we will notify you and the Information Regulator of a breach affecting your personal information as POPIA requires.

Children

The Farmer is not intended for children under 18. We do not knowingly collect information from them, and will delete it if we discover we have.

Changes to this policy

If we change how we handle your information we will update this page and change the date above. Material changes will also be announced in the app.