Privacy policy
This covers how Handover itself collects, uses, and protects your personal information as the operator of the app — separate from how courier delivery data is shared, covered on its own page. Handover is a South African service and processes information in line with the Protection of Personal Information Act (POPIA).
What we collect
To create and fulfil a sale, Handover collects:
- Buyer and seller name, email address, and phone number
- Pickup and delivery addresses and contact numbers
- Item description, price, and parcel weight/size
- Transaction and payment status (the card/EFT details themselves are handled directly by TradeSafe, our escrow provider — Handover never sees or stores them)
- Basic technical data from hosting logs (IP address, browser) used only for security and abuse prevention
Why we collect it
Strictly to operate the marketplace: creating a sale, holding funds in escrow, arranging courier collection and delivery, verifying delivery with a one-time PIN, releasing payment, resolving disputes, and meeting our own legal and tax obligations. Handover doesn’t sell personal information, and doesn’t use it for advertising.
Who it's shared with
- TradeSafe — our escrow provider, to hold and release payment.
- The courier network handling a given order — only the pickup/dropoff names, addresses, and phone numbers needed to collect and deliver that parcel (see courier terms).
- Supabase, our database and infrastructure provider, which stores this information on Handover’s behalf.
- Regulators or law enforcement, only where Handover is legally required to disclose it.
How long we keep it
For as long as needed to complete the sale and resolve any dispute or claim, and afterwards for whatever period South African tax and consumer-protection law requires records to be kept. After that, it’s deleted.
How it's protected
Release PINs are never stored in plain text — only a salted, one-way hash, checked with a constant-time comparison and locked out after repeated wrong attempts. Payment credentials for accessing our database are server-only and never reach the browser. Traffic to the app is encrypted (HTTPS).
Your rights
Under POPIA, you can ask Handover to:
- Tell you what personal information we hold about you
- Correct information that’s inaccurate or incomplete
- Delete information where there’s no lawful reason to keep it
- Restrict or object to certain processing
- Withdraw any consent you’ve given, at any time
To exercise any of these, get in touch using the email address you gave when creating or receiving a Handover sale — it’ll be routed to the right person. You can also raise concerns with South Africa’s Information Regulator at inforegulator.org.za.