Privacy Notice

Responsible Party

The Responsible Party (data controller) under POPIA is:

• Trading name: Used Nissan Parts South Africa (operating in association with Nissan Spares Scrap Yard)
• Website: https://www.usednissanparts.co.za
• Physical address: 666 Cromwell St, Lenasia South, Johannesburg, Gauteng, 1829, South Africa
• Phone: 078 574 3998
• Email: leads@usednissanparts.co.za

Information Officer

Our Information Officer ("IO") is responsible for POPIA and PAIA compliance and is the first point of contact for data-subject requests, complaints and access requests.

• Information Officer: To be confirmed (designation in progress)
• Email: leads@usednissanparts.co.za
• Phone / WhatsApp: 078 574 3998
• Postal: Nissan Spares Scrap Yard, 666 Cromwell St, Lenasia South, Johannesburg, 1829

Note: Our Information Officer is in the process of being registered with the South African Information Regulator at inforegulator.org.za in line with POPIA s.55 and s.56. The registration reference number will be published here once issued.

Information we collect

We collect personal information directly from you (the data subject) when you interact with us. Specifically:

• Full name and surname
• Phone number (and WhatsApp number if provided)
• Email address
• Province / city / suburb (for delivery quoting)
• Delivery address (only when an order is confirmed)
• Vehicle details — Nissan model, year, VIN/chassis (optional, helps part matching), registration number (optional)
• Description of the part(s) you require
• Any message or supporting photos you choose to send
• Server-side technical metadata: IP address, user agent, page URL and timestamp (used for fraud and abuse prevention only)

We do not knowingly collect special personal information (race, health, biometric data, religious beliefs, etc.) under POPIA s.26, nor information about children under 18 (POPIA s.34). If you submit such information unintentionally, please contact our Information Officer to have it deleted.

Purposes and lawful basis for processing

We process your personal information for the following defined purposes (POPIA s.13):

• Quote response and order fulfilment — sourcing the requested part, calling/emailing/WhatsApping you back, arranging payment and courier delivery. Lawful basis: POPIA s.11(1)(b) — necessary for the conclusion or performance of a contract.
• Customer support and after-sales service — responding to fitment questions, warranty claims and CPA returns. Lawful basis: POPIA s.11(1)(b).
• Direct marketing — only if you tick the optional marketing checkbox or are an existing customer with similar-product context. Lawful basis: POPIA s.69(3) — explicit prior consent or existing-customer exception with right to opt out at any time.
• Legal, tax and accounting compliance — invoicing, SARS records, audit trails. Lawful basis: POPIA s.11(1)(c) — compliance with an obligation imposed by law.
• Fraud prevention and site security — detecting abusive form submissions, scraping, etc. Lawful basis: POPIA s.11(1)(d) — protection of a legitimate interest.

Operators (POPIA s.21)

We share personal information only with carefully-selected operators (data processors) bound by written agreements requiring them to process your information solely for the purposes specified by us, with appropriate technical and organisational safeguards.

We do not sell your personal information to third parties, nor do we share it with advertising networks, data brokers, or affiliate marketers.

Cross-border transfer (POPIA s.72)

Some operators above (Cloudflare, Resend, Google) process information outside the Republic of South Africa, primarily in the United States and the European Union. We transfer your information across borders only where one of the safeguards in POPIA s.72(1) applies:

• The recipient is subject to a law or binding corporate rules providing an adequate level of protection substantially similar to POPIA (e.g. GDPR for EU operators);
• The transfer is governed by Standard Contractual Clauses (SCCs) included in each operator's published Data Processing Addendum (DPA);
• The transfer is necessary for the performance of our contract with you (s.72(1)(c)).

If you would prefer not to have your information processed outside South Africa, please contact us via phone or WhatsApp without using the website forms, and we will handle your enquiry through SA-based channels only.

Retention periods (POPIA s.14)

• Quote enquiries that did not convert: retained for up to 3 years from the last interaction, then deleted or anonymised. This allows reasonable follow-up and seasonal re-quoting.
• Customer order records and tax invoices: retained for 5 years in line with the Tax Administration Act 28 of 2011 and the Companies Act.
• Server access logs / IP records: retained for 90 days.
• Direct-marketing consent records: retained for as long as you remain opted in, plus 12 months after opt-out, to prove the opt-out was honoured.

After the retention period expires, we will delete or de-identify your information unless we are required by law to retain it for longer.

Your rights as a data subject

POPIA gives you the following rights, which you can exercise free of charge by contacting our Information Officer:

• Access (s.23) — confirm whether we hold your information and request a copy.
• Correction (s.24) — request correction of inaccurate, irrelevant or out-of-date information.
• Deletion / destruction (s.24) — request deletion of information that is no longer authorised to be retained.
• Object to processing (s.11(3)) — object on reasonable grounds to processing based on legitimate interest.
• Object to direct marketing (s.11(3)(b) and s.69(3)) — opt out of marketing at any time, free of charge.
• Withdraw consent — where consent was the basis of processing.
• Data portability — receive a copy in a structured, commonly used format.
• Complain to the Information Regulator — see section 12 below.

We respond to all data-subject requests within 30 days of receipt, in line with POPIA and PAIA. We may ask you to verify your identity before we release information.

Direct marketing — how to opt out

You can opt out of direct marketing at any time, free of charge, by:

• Replying STOP to any marketing SMS;
• Replying UNSUBSCRIBE to any marketing WhatsApp message;
• Clicking the unsubscribe link at the foot of any marketing email;
• Emailing leads@usednissanparts.co.za with the subject "Opt out".

Opt-out requests are honoured within 5 business days. We retain a record of your opt-out for 12 months to ensure it is not accidentally overridden.

Cookies and tracking technology

On your first visit a cookie consent banner appears at the bottom of the page. It offers three equally-prominent choices — “Accept all”, “Reject all” and “Customize” — in line with the Information Regulator’s December 2024 Cookie Guidance Note. No analytics or marketing scripts run until you grant consent.

We split cookies into three categories:

• Essential — always on. Keeps the site usable (session continuity for contact buttons, remembering your cookie choice). Cannot be disabled.
• Analytics — off by default. Loads Google Analytics 4 (with anonymised IP) so we can see which pages help people find Nissan parts. No personally-identifying information is collected.
• Marketing — off by default. Reserved for future advertising pixels (e.g. Meta / Facebook). Currently unused.

Your choice is saved in localStorage and a first-party cookie (one-year expiry) so you aren’t prompted again. You can change your preferences at any time via the Cookie preferences link in the footer, or by clearing site data in your browser.

You can also disable cookies entirely through your browser preferences.

Security and breach notification (POPIA s.19, s.22)

We protect your personal information using:

• HTTPS/TLS encryption on all pages and form submissions;
• Encrypted storage of CRM records (Supabase EU region, AES-256 at rest);
• Access controls — only authorised personnel with a defined need can view personal information;
• Audit logging on all CRM read/write operations;
• Regular review of operator security postures.

In the event of a security compromise involving your information, we will notify you and the Information Regulator as soon as reasonably possible, in line with POPIA s.22.

PAIA Manual

In line with the Promotion of Access to Information Act 2 of 2000, our PAIA Manual is available for download at /paia-manual.pdf, or on request from our Information Officer at leads@usednissanparts.co.za. The Manual lists the categories of records we hold and the procedure for requesting access.

Changes to this Privacy Notice

We may update this Notice from time to time to reflect changes in law, our operators or our business. The "Last Updated" date at the top of the page will always reflect the most recent revision. Material changes (e.g. new operator categories, new retention periods, new lawful bases) will be flagged with a banner on this page for at least 30 days.

Related policies

• Terms & Conditions
• Trademark Disclaimer
• PAIA Manual (PDF)