Privacy Policy — iNEED.PARTS

1. Who this policy is for

This policy applies to everyone who uses iNEED.PARTS — buyers who post part requests, and suppliers (scrapyards, dealers and their staff) who respond to them. It explains how we handle your personal information under South Africa’s Protection of Personal Information Act, 2013 (POPIA).

We are the responsible party for the personal information described here. Our contact details are at the bottom of this page.

2. What we collect

Information you give us

Account details — your name, email address, password (stored hashed, never in readable form), and optionally your mobile number.
Your country and region — set once when you sign up, from the country we detect at that moment. It stays fixed after that; it is not re-derived from your location every time you visit.
Request content — everything you type into a part request chat: the part you need, vehicle details, photos you attach, and any other message content.
Supplier details — for supplier accounts: business name, trading area, contact details, team members you invite, and verification information you submit.
Quotes, reviews and vouches — the content of quotes suppliers send, buyer reviews of suppliers, and community vouches.

Information we generate

Lead data — a structured summary of your request produced automatically from your chat: part name, vehicle make, model and year, condition preference, and a quality score.
Credit and transaction records — supplier credit balances, purchases, and what each credit was spent on.
Usage records — which leads a supplier unlocked, notification counts, and similar activity needed to run the service.

Information we collect automatically

Technical data — IP address, browser and device type, and the pages you request, contained in ordinary web server logs.
Approximate country — supplied by our network provider from your IP address, used to show you the right market and to block markets we have not launched in yet.
Cookies — see our Cookie and Tracking Policy.

We do not collect your identity number, your bank card numbers, or precise GPS location.

3. Why we use it, and on what basis

What we do	Why	POPIA justification
Create and secure your account	To let you sign in and to keep others out	Performance of our agreement with you
Turn your chat into a structured lead	It is the core of the service	Performance of our agreement with you
Show leads to matching suppliers	So you receive quotes	Performance of our agreement with you
Hide your contact details until a supplier unlocks a lead	To protect you from unsolicited contact	Our legitimate interest, and yours
Send you notifications about your requests and quotes	To tell you what you asked to be told	Performance of our agreement with you
Detect abuse, fraud and manipulation of our systems	To keep the marketplace usable and safe	Our legitimate interest
Keep records of credit purchases and spend	Tax and accounting law	Legal obligation
Send you product or marketing email	Only if you opt in	Your consent, withdrawable at any time

4. Automated processing by AI

Your chat messages are processed by an artificial intelligence model so that we can extract the part and vehicle details, ask you a sensible next question, and score how complete your request is. Depending on our configuration, this model may be operated by a third-party provider, which means the text of your request chat is transmitted to that provider for processing.

Because of this, please do not type anything into the chat that you would not want processed by a third party — in particular, do not include identity numbers, banking details, passwords, or medical information. None of those are ever needed to find a vehicle part.

The AI also scores lead quality. That score affects how your request appears to suppliers. It has no legal consequence for you and does not decide anything about your access to the service, but you may ask us to review it — see section 9.

5. Who we share it with

Suppliers — when you post a request, suppliers in your country see the part, vehicle and area details. They do not see your name, email address or mobile number until they spend credits to unlock your lead. After an unlock, the unlocking supplier can see your contact details and chat with you.
Other users — your reviews and vouches are shown to other users without your name attached.
Service providers who process data on our behalf, under contract and only on our instructions:
- our hosting and database provider, which stores the data;
- our network and security provider, which routes traffic and tells us the country an IP address is in;
- our email provider, which delivers verification and notification email;
- our AI provider, as described in section 4.
Authorities, where the law requires it, or where it is necessary to establish, exercise or defend a legal claim.

We do not sell your personal information, and we do not share it with advertising networks.

6. Transfers outside South Africa

Some of the providers above operate outside South Africa. Where personal information is transferred, we rely on section 72 of POPIA: the recipient is bound by an agreement that upholds principles of lawful processing comparable to POPIA, or the transfer is necessary to perform our agreement with you.

7. How long we keep it

Account information — while your account is open, then 12 months after closure so that we can deal with any dispute.
Requests, leads, quotes and chat content — up to 24 months after the request is closed or expires, so that buyers and suppliers can refer back to what was agreed.
Credit and payment records — five years, as required by South African tax law.
Server logs — 90 days.

Deletion requests are handled as described in our Data Deletion Policy.

8. How we protect it

Passwords are hashed. Traffic is encrypted in transit. Access to production data is limited to the people who need it to operate the service. Buyer contact details are withheld from suppliers at the database query level, not merely hidden in the interface. We monitor for attempts to manipulate our AI systems into revealing information they should not.

No system is perfectly secure. If a breach affects your personal information, we will notify you and the Information Regulator as POPIA requires.

9. Your rights

You may:

ask what personal information we hold about you and get a copy of it;
correct or update anything inaccurate — most of it you can edit yourself under Account;
ask us to delete your information (see the Data Deletion Policy);
object to processing based on legitimate interest;
withdraw consent to marketing at any time;
ask a human to review an automated decision, including the lead quality score;
complain to us, and — if you are not satisfied — to the Information Regulator.

Information Regulator (South Africa) JD House, 27 Stiemens Street, Braamfontein, Johannesburg 2001 Email: [email protected]

We answer requests within 30 days. We may ask you to confirm your identity first, because we will not hand your information to someone claiming to be you.

10. Children

The service is not intended for people under 18, and we do not knowingly create accounts for them. If you believe a child has given us personal information, contact us and we will remove it.

11. Changes

If we change this policy we will publish the new version on this page with a new effective date. Material changes will also be announced in the app. Continuing to use the service after a change means you accept the updated policy.