Privacy Policy

1. Who we are

Reidar is operated by REIDAR (PTY) LTD, a private company incorporated in the Republic of South Africa (CIPC Reg. No. 2025/323871/07). We build and operate a digital platform for African agricultural commodity trade.

For the purposes of the Protection of Personal Information Act, 2013 (POPIA), Reidar is the Responsible Party — meaning we determine how and why your personal information is processed.

2. What we collect

All visitors to reidar.co.za

• Basic usage analytics: pages visited, time on page, browser and device type, referring URL.
• Your email address and any other information you voluntarily submit via the waitlist or contact forms.

Platform users only Registered account holders

• Account information: full name, email address, business name, phone number, and role.
• Trade data: quotations, contracts, invoices, stock allocations, transport bookings, deal sheets, and associated counterparty information.
• Usage data: feature usage logs, session activity, in-platform actions (e.g. quote events, price edits).
• Billing data: energy credit balance, billing history, and usage-based transaction records.
• Support data: tickets, messages, and feedback you submit through the platform.
• AI-generated content: where you use AI-assisted features (server-side only; your input is processed but not stored by the AI provider beyond the immediate request).

We do not collect payment card numbers or banking credentials. Billing is managed through usage-based invoicing administered by Reidar directly.

3. How we use your information

Waitlist & communications

If you submit your email address via our waitlist, we use it to send you platform updates and product announcements. You can unsubscribe at any time.

Platform operation

We use your account and trade data to provide the Reidar platform services, including generating deal sheets, contracts, invoices, transport records, and quotations. This processing is necessary to perform our contract with you.

Billing

Usage data drives our energy-based billing model. We calculate weekly invoices based on your activity within the platform.

Security & fraud prevention

We monitor usage logs to detect and prevent abuse, unauthorised access, and fraudulent activity. This is a legitimate interest we are required to balance against your privacy rights.

Product improvement

Aggregated and anonymised usage data helps us understand how the platform is used so we can improve it. We do not sell this data.

Anonymised statistics and published research

Under POPIA Section 6, the Act does not apply to information that has been de-identified to the extent that it cannot be re-identified. Once data meets this threshold — meaning no individual or business can be identified from it directly, by reasonably foreseeable method, or by linking it to other information — it is no longer "personal information" and falls outside POPIA's scope entirely.

Reidar may use de-identified, aggregated data derived from platform activity and waitlist submissions for the following purposes:

• Agricultural trade market research and industry insights;
• Platform performance benchmarks and operational analytics;
• Published reports, indices, or data products that may be made publicly available (for example: commodity price trends by region, route-tariff benchmarks, or trade volume patterns by crop type); and
• Internal product development and business planning.

What "properly de-identified" means at Reidar: before any data is used for these purposes, we remove all fields that could identify you — name, email address, business name, phone number, and location specifics — and aggregate outputs to group-level figures. We never publish individual-level records. Published outputs are aggregate statistics only (for example: "average cost per tonne on a regional corridor" or "total platform quotation volume by commodity type over a quarter"). We apply POPIA's standard: the output cannot identify any data subject directly, by any reasonably foreseeable method, or by linking to other available information.

This use is noted in section 8 of our Terms of Service. If you have questions about how your data contributes to aggregated statistics, contact system@reidar.co.za.

4. Who we share it with

We do not sell, rent, or trade your personal information. We share it only with the third-party service providers (data operators) listed below, each bound by data processing agreements:

• Supabase, Inc. (USA) — database, authentication, and file storage. Your data is stored on Supabase-managed infrastructure. Supabase Privacy Policy
• Vercel, Inc. (USA) — web hosting and global content delivery. Vercel Privacy Policy
• Resend, Inc. (USA) — transactional email delivery (account notifications, platform emails). Resend Privacy Policy
• Google LLC (USA) — Gemini AI model, used server-side only for AI-assisted platform features. Input data is not retained by Google beyond the immediate API request under our enterprise terms. Google Privacy Policy

All providers are located in the United States. Transfers outside South Africa are made on the basis of appropriate safeguards as contemplated by POPIA Section 72.

We may disclose your information to law enforcement or regulators when required by law, or to protect the rights and safety of Reidar, its users, or others.

5. How long we keep it

• Waitlist emails: until you unsubscribe or request deletion.
• Account data: for the duration of your account plus up to 5 years after closure, to satisfy legal and accounting obligations under South African law.
• Trade records (contracts, invoices, quotations): up to 7 years, consistent with South African tax and commercial record-keeping requirements.
• Usage and session logs: 12 months rolling.
• Support tickets: 24 months after resolution.

When retention periods expire, data is securely deleted or anonymised.

6. Security

We take reasonable and appropriate technical and organisational measures to protect your personal information against loss, misuse, unauthorised access, disclosure, alteration, or destruction. These include encrypted data storage, restricted access controls, and regular security reviews.

Under the 2025 POPIA Amendments, we are required to notify the Information Regulator and affected data subjects as soon as we are reasonably certain a security compromise has occurred — not only after a full investigation is complete. If you believe your data has been compromised, contact us immediately at system@reidar.co.za.

7. Your rights under POPIA

As a data subject under POPIA, you have the right to:

• Access — request confirmation of whether we hold your personal information and a copy of it.
• Correction — request that inaccurate or incomplete information be corrected.
• Deletion — request that we delete your personal information, subject to our lawful retention obligations.
• Object — object to the processing of your personal information on grounds relating to your particular situation.
• Withdraw consent — where processing is based on your consent (e.g. waitlist), you may withdraw it at any time without affecting the lawfulness of prior processing.
• Lodge a complaint — with the Information Regulator of South Africa if you believe we have violated POPIA.

8. Cookies

The reidar.co.za public site uses minimal cookies for basic analytics (page views and session data). We do not use advertising or tracking cookies. By using the site you consent to this limited use.

The Reidar platform (tradetech.reidar.co.za and related subdomains) uses session cookies necessary for authentication. These are essential to platform operation and cannot be disabled without preventing login.

9. Changes to this policy

We may update this policy from time to time. When we do, we will update the effective date at the top of this page. For material changes, registered users will receive a notice by email. Continued use of Reidar after changes take effect constitutes acceptance of the revised policy.

10. Contact & Information Officer

The Information Officer responsible for POPIA compliance at Reidar is: