PRIVACY POLICY – CROSSTATE AUCTIONEERS

Last Updated: August 2026

Crosstate Auctioneers (“the Company”, “We”, “Us”, or “Our”) respects your privacy and is committed to protecting your personal information. This Privacy Policy sets out how we collect, use, process, and safeguard your Personal Information in accordance with the Protection of Personal Information Act, No. 4 of 2013 (“POPIA”) and other applicable privacy laws.

RESPONSIBLE PARTY DETAILS

Entity Name: Crosstate Auctioneers

Physical Address: Corner Top & Skew Road, Boksburg, Johannesburg, South Africa

Email Contact: info@crosstate.co.za

Website: www.crosstate.co.za

INFORMATION WE COLLECT
We collect personal information necessary for carrying out commercial auctions, buyer/seller registrations, legal compliance (including FICA requirements), and operating our website services:

Identity Data: Full name, ID/Passport number, company registration details, and FICA verification documentation.

Contact Data: Email address, phone number, and physical/billing address.

Financial Data: Proof of payment, bank details for processing deposits or payouts, and tax numbers.

Transaction Data: Details of bids placed, lots purchased, registration history, and invoice records.

Technical & Usage Data: IP address, device identifier, browser type, and interactions on www.crosstate.co.za via cookie technologies.

PURPOSE & LEGAL BASIS FOR PROCESSING
We process your personal information under the following lawful grounds:

Performance of a Contract: To process auction registrations, verify eligibility, manage bidding activities, and facilitate payment and delivery of goods.

Legal Obligation: To comply with South African statutory requirements, including FICA (Financial Intelligence Centre Act), Consumer Protection Act auction rules, and SARS requirements.

Legitimate Interests: To prevent fraud, ensure platform security, manage business operations, and improve website functionality.

Consent: Where required for direct marketing communications, which you may opt out of at any time.

HOW WE SHARE YOUR INFORMATION
We do not sell your personal data. We may share necessary information with:

Service Providers: Third-party IT support, website hosting providers, payment gateways, and logistics/courier services acting under strict confidentiality.

Regulatory & Legal Authorities: Law enforcement agencies, tax authorities, or regulators when legally obligated to do so.

Business Transfers: Parties involved in potential corporate restructurings, subject to non-disclosure agreements.

CROSS-BORDER DATA TRANSFERS
Where personal data is transferred across international borders (e.g., using secure cloud hosting services located outside South Africa), we ensure that appropriate safeguards are in place in compliance with Section 72 of POPIA.

DATA SECURITY & RETENTION

Security: Technical and organizational measures—including encryption, firewalls, and restricted administrative access—are maintained to prevent loss, unauthorized access, or disclosure.

Retention: Personal data is retained only as long as necessary to fulfill the operational purpose for which it was collected or to comply with statutory retention periods (e.g., tax and financial record-keeping laws).

YOUR RIGHTS UNDER POPIA
Subject to statutory limits, you have the right to:

Access: Request confirmation of whether we hold personal information about you and obtain a copy.

Rectification: Request correction or updating of inaccurate, incomplete, or out-of-date information.

Objection & Deletion: Object to processing based on legitimate interests or request the erasure of your personal data where legally permissible.

Withdraw Consent: Withdraw consent at any time where processing relies on your consent.

To exercise any of these rights, please contact our Information Officer at info@crosstate.co.za.

COOKIES & TRACKING TECHNOLOGIES
We use functional and analytical cookies to maintain user sessions and enhance user experience. For detailed information regarding cookie categories and consent controls, please refer to our Cookie Policy on www.crosstate.co.za.

COMPLAINTS
If you believe that your personal data has been processed unlawfully, we encourage you to contact us directly to resolve the matter. You also retain the right to submit a complaint to the South African Information Regulator:

Website: https://inforegulator.org.za/

Email: enquiries@inforegulator.org.za / POPIAComplaints@inforegulator.org.za

POLICY UPDATES
We reserve the right to update this Privacy Policy periodically to reflect changes in legal requirements or operational practices. Updated versions will be published on www.crosstate.co.za with an updated revision date.