Data Retention Schedule
Last updated 2 October 2026
Amirify is operated by Amir Group (Pty) Ltd (registration number 2026/608946/07), trading as Amirify, 77 Hendry Road, Unit 5, Morningside, Durban, 4001, South Africa. This schedule sets out how long Amirify keeps personal information, why, and what happens when the retention period ends. It forms part of the Amirify Privacy and POPIA Notice.
Retention Schedule 1: Our approach
1.1 We keep personal information only for as long as it is needed for the purpose it was collected for, or for as long as the law requires or allows. This follows section 14 of the Protection of Personal Information Act 4 of 2013 (POPIA).
1.2 Where the law sets a minimum period, we keep the record for at least that period. Where the law sets no period, we use the shortest period that lets us run the Marketplace, protect buyers and sellers, resolve disputes and defend legal claims.
1.3 The periods below run from the date stated in the “Starts from” column. If a record is needed for a dispute, complaint, investigation or legal claim, we keep it until that matter is finally closed, even if the normal period has ended.
Retention Schedule 2: Retention periods
| Information | Examples | Kept for | Starts from | Reason |
|---|---|---|---|---|
| Customer account | Name, email, phone, saved addresses, account settings | While the account is active, and 12 months after closure | Account closure | Account service; resolving late queries |
| Inactive customer accounts | Accounts with no login or order | Closed after 36 months of inactivity, following written notice to the customer | Last login or order | POPIA s14: no longer necessary |
| Order and delivery records | Items ordered, delivery address, tracking, order status, payment status (never card numbers) | 5 years | Order completion | Tax Administration Act 28 of 2011, s29; Consumer Protection Act and ECTA disputes and warranties |
| Financial and accounting records | Ledgers, commissions, payouts, reserves, refunds, invoices | 7 years | End of the financial year | Companies Act 71 of 2008, s24; Tax Administration Act s29; VAT Act 89 of 1991, s55 (once VAT-registered) |
| Seller identity and verification | Owner or representative details, registration or identity documents, trading address, bank details | Duration of the seller relationship plus 5 years | Termination or closure of the store | Tax and accounting law; fraud prevention; claims after payout |
| Seller Agreement acceptance | Version accepted, date and time, account | Duration of the agreement plus 5 years | Termination of the agreement | Proof of contract; Prescription Act 68 of 1969 |
| Returns, refunds and cancellations | Return requests, photos, refund decisions | 5 years | Case closure | Consumer Protection Act and ECTA; tax and accounting records |
| Complaints and disputes | Buyer reports, seller responses, Amirify decisions, evidence | 3 years | Case closure | Prescription Act, s11 (3-year period for most claims); longer if proceedings are pending |
| Support requests | Emails and messages to Amirify support | 3 years | Request closed | Service quality; dispute and claim defence |
| Chat assistant conversations | Messages typed in the Amirify chat | 12 months | Last message | Service improvement and support. Where a chat is part of a complaint, dispute or order problem, it is kept with that case record |
| Marketing consent and preferences | Opt-in date, channel, opt-out | While consent is active. After withdrawal we keep only a suppression record (the contact detail and the opt-out date) | Withdrawal of consent | POPIA s69: honouring opt-outs |
| Device, usage and security logs | IP address, device type, access and error logs, fraud checks | 12 months, then deleted or anonymised | Date of the log entry | Platform security and fraud prevention |
| Security incident records | Details of any security compromise and our response | 5 years | Incident closed | POPIA s22; accountability |
| Privacy requests | Access, correction or deletion requests and our responses | 3 years | Request closed | Accountability; Prescription Act |
| Backups | Encrypted system backups | Overwritten within 90 days | Backup date | Business continuity |
Retention Schedule 3: What happens at the end of the period
3.1 When a period ends, we securely delete the information, or anonymise it so that it can no longer identify a person. Anonymised information may be kept for statistics and reporting.
3.2 Where deletion is not possible straight away (for example information in backups), we restrict further use of the information and delete it when the backup is overwritten, subject to POPIA section 14; this backup process does not create a general exemption from deletion duties.
3.3 If a legal hold applies because of a dispute, investigation, regulator request or court process, deletion is paused until the matter is finally closed.
Retention Schedule 4: Sellers
4.1 Sellers receive buyer information only to fulfil and support orders. A seller must delete or de-identify buyer information when it is no longer needed for the order, returns or warranty, unless the law requires the seller to keep a record (for example tax records). Sellers must not keep buyer information for marketing unless the buyer has given valid consent.
4.2 Sellers must tell Amirify without delay if they suspect a security compromise involving buyer information.
Retention Schedule 5: Your rights
5.1 You may ask Amirify to confirm what personal information we hold about you, to correct it, or to delete it where we no longer need it. You may also object to processing, and withdraw marketing consent at any time.
5.2 We cannot delete information we are legally required to keep (such as tax and accounting records). In that case we restrict its use and delete it when the legal period ends.
5.3 Send privacy requests to our Information Officer, Rashid Amir, at info@amirify.co.za. We respond to valid requests within a reasonable time and not later than 30 days.
5.4 If you are not satisfied, you may complain to the Information Regulator (South Africa) at inforegulator.org.za.
Retention Schedule 6: Security
We protect personal information with access controls limited to people who need it, encryption in transit, secure hosting, backups and monitoring. We tell affected people and the Information Regulator about a security compromise as POPIA requires.
Retention Schedule 7: Review
We review this schedule at least once a year, and whenever the law or our services change. The current version is always the one published on the Marketplace.
*Version 1.0 — Amir Group (Pty) Ltd, trading as Amirify.*