Privacy Policy — DRAFT (Current Source)

Status: first-pass draft prepared by Claude (AI), not a lawyer. Needs attorney review before publication. See [popia-compliance-notes.md](popia-compliance-notes.md) for the reasoning behind each section's structure.

Table of Contents

• Introduction
• Information We Collect
• How We Use Information
• Legal Basis for Processing
• Who We Share Information With
• Direct Marketing
• Data Retention
• Cross-Border Transfer
• Security Measures
• Your Rights
• Information Officer & Complaints
• Changes to This Policy
• Contact Us

1. Introduction

This Privacy Policy explains how Current Source Trading (Pty) Ltd ("Current Source", "we", "us") collects, uses, and protects personal information through the Current Source platform, in accordance with South Africa's Protection of Personal Information Act 4 of 2013 ("POPIA"). This Policy covers both individuals and the companies they represent, since POPIA protects the personal information of juristic persons (companies) as well as natural persons.

2. Information We Collect

• Account information: company name, contact email, phone number, account type (client or

supplier), password (stored securely, never in plain text).

• RFQ information: titles, descriptions, line items, delivery addresses, dates, and any files

a Client chooses to attach.

• Quote information: pricing and notes submitted by a Supplier in response to an RFQ.
• Usage information: basic activity needed to operate the Platform (e.g. when an account last

viewed a section, used to show relevant notifications).

We do not collect payment card details, ID numbers, or other special categories of personal information, and do not intend to.

3. How We Use Information

To operate the Platform: creating and managing accounts, matching RFQs to relevant Suppliers, displaying quote comparisons to Clients, sending transactional notifications (e.g. "you've been invited to quote," "a quote has been submitted"), and administering the Platform (including suspending accounts that misuse it).

4. Legal Basis for Processing

Processing is necessary to perform the service a User has requested by creating an account (POPIA condition: processing necessary for a contract/pursuant to the data subject's request), and in some cases on the basis of Current Source's legitimate interest in operating and securing the Platform. [TODO: attorney to confirm this is correctly characterised once the Terms of Service are finalised, since the legal basis should match how account creation is actually framed there.]

5. Who We Share Information With

• Other Users, as needed for the Platform's purpose: when a Client sends an RFQ out for

quotation, the RFQ's details become visible to the specific Suppliers invited to quote on it — never to Suppliers who haven't been invited. A Supplier's pricing is visible to the Client who owns that RFQ and to Current Source's administrators; a Supplier's company identity is not shown to the Client until the pricing has been reviewed and the evaluation stage is reached.

• Service providers who help run the Platform: our database/authentication provider

(Supabase), hosting provider (Vercel), and transactional email provider (Resend). These providers process data on our instructions and don't use it for their own purposes.

• **We do not sell personal information, and do not share it with anyone else for marketing

purposes.**

6. Direct Marketing

We will only send marketing communications (as opposed to transactional notifications about your own RFQs/quotes) with your consent, or where POPIA's existing-customer exception applies. You can opt out of marketing communications at any time. [TODO: build an actual opt-out mechanism before this policy goes live, and before any marketing email campaign is sent — see the POPIA notes file, this is flagged as a near-term action item tied to the tender-register outreach plan.]

7. Data Retention

We keep account and RFQ information for as long as the account is active, and for a reasonable period afterward for legitimate business and record-keeping purposes. [TODO: decide and state an actual retention period once the business has a clearer sense of what's reasonable — e.g. "2 years after account closure" — rather than leaving this open-ended, which POPIA's purpose-specification condition doesn't love.]

8. Cross-Border Transfer

Some of the infrastructure that powers the Platform (database, hosting, email delivery) may process information on servers located outside South Africa. [TODO: confirm actual server regions for Supabase/Vercel/Resend and state this accurately, and confirm with the attorney whether anything beyond disclosure is required under POPIA s72 for this specific setup.]

9. Security Measures

We apply technical and organisational measures appropriate to the risk, including database-level access controls that restrict every User to only the data they're entitled to see (enforced at the database itself, not only in the website's interface), encrypted password storage, and encrypted connections between your device and our servers.

10. Your Rights

Under POPIA, you have the right to: know what personal information we hold about you; request a copy of it; request correction of inaccurate information; request deletion of your information (subject to any legitimate reason we may need to retain some of it, e.g. legal record-keeping); and object to processing in certain circumstances. To exercise any of these rights, contact us using the details in Section 13.

11. Information Officer & Complaints

Current Source's Information Officer is [TODO: name, once appointed and registered with the Information Regulator — see the POPIA notes file, this registration is an outstanding action item]. If you believe we have mishandled your personal information, you can also lodge a complaint with South Africa's Information Regulator (details at justice.gov.za/inforeg — [TODO: confirm current contact details before publishing, these can change]).

12. Changes to This Policy

We may update this Policy from time to time. [TODO: decide on notice method, consistent with the Terms of Service.]

13. Contact Us

For any question about this Policy or your personal information, contact [TODO: support/privacy contact email].