Privacy Policy

Moto Buy Back (Pty) Ltd (“MBB”, “we”, “us”) is the responsible party, as defined under the Protection of Personal Information Act 4 of 2013 (POPIA), for the personal information we collect and process in connection with the Moto Buyback programme. Registration No: 2026/412224/07. Address: 25 Protea, Mountainside, Gordon's Bay, Cape Town, Western Cape, South Africa. Our Information Officer is Kerren Wolfin, reachable at kerrenwolfin@motobuyback.com. Because many of our clients are EU or UK residents and we offer the programme to them in their languages, the GDPR applies to their data alongside POPIA (GDPR Article 3(2)), and we apply its rules to them. We are appointing a representative in the EU/UK under GDPR Article 27; until then, requests and complaints go to the Information Officer above. Our manual under section 51 of the Promotion of Access to Information Act is available from the Information Officer on request.

This policy applies to:

• All individuals who enquire about or use the Moto Buyback programme.
• All visitors to the MBB website.
• All individuals who communicate with MBB by email, WhatsApp, phone, or any other channel.

It covers personal information collected directly and through the operation of the programme — including GPS location data from tracking devices installed on programme motorcycles.

We collect only what is necessary for the purposes below. We do not collect special personal information (health data, political opinions, religious beliefs) unless you volunteer it and it is directly relevant to your participation.

• Contract performance — the main basis: verifying who you are so a vehicle can be registered in MBB’s name for a non-resident, registering it, arranging insurance, managing your subscription, processing payments, and remitting buyback proceeds under the Agency Agreement, Subscription Agreement and Sale Mandate. Identity details are collected at registration because the sourcing conversation and the quote depend on them; if you never verify your email and never receive a quote, the account and everything in it is deleted after 30 days.
• Legal obligation — record-keeping and reporting under the Exchange Control Regulations (SARB) and tax law (SARS, VAT Act) for your payments and the buyback remittance, and the Financial Intelligence Centre Act (FICA) to the extent it applies to MBB or to the bank that receives and remits your funds.
• Legitimate interest — GPS monitoring and vehicle tracking to protect the vehicle, enforce contract terms, approve cross-border travel, and facilitate recovery where authorised use has ended; plus the security audit trail.
• Consent — where we rely on your consent (for example marketing communications), you may withdraw it at any time; withdrawal does not affect processing that happened before.

Every motorcycle in the MBB programme has a GPS tracking device installed. The tracker is not active during the pre-arrival storage period — the bike is then under MBB’s direct physical supervision. It activates on collection day, and from then continuously records the motorcycle’s location. By entering the programme you consent to MBB collecting and retaining this GPS data for the full subscription period.

We use GPS data only for:

• Security monitoring and stolen-vehicle recovery.
• Verifying compliance with cross-border travel approvals.
• Locating the motorcycle to facilitate recovery where authorised use has ended.
• Providing live location data to you, where your tier includes it (Overland Max).

We do not sell GPS data, do not use it for marketing or profiling, do not share real-time location with any third party except where required by law or for vehicle recovery, and do not use it to monitor your personal movements beyond confirming the motorcycle’s location. The location data is collected and held by the tracker vendor on MBB’s behalf; the MBB platform itself stores no location history. We access the vendor’s data only for the purposes above and require the vendor to delete it within 12 months after your subscription ends — longer only if legal proceedings require it. The vendor’s name and country are added to section 7 when the device contract is concluded.

We are required to collect and retain identity documentation and transaction records under FICA and SARB Exchange Control Regulations, including passport copies, source-of- funds information, transaction records, and Balance of Payments declaration information. These records are retained for a minimum of 5 years from your last transaction and may be disclosed to the Financial Intelligence Centre, SARS, or the South African Reserve Bank where legally required. MBB may be required to file a Suspicious Transaction Report where there are grounds to suspect funds are connected to unlawful activity — we are not permitted to tell you if such a report is filed.

We never sell your personal information. We share it only where necessary:

Every third party we share with is bound by a written agreement to handle your data lawfully, only for the purpose it was shared and with appropriate security (POPIA sections 20–21, GDPR Article 28). We never sell your personal information and do not run any operational mirror of your file in a third-party tool.

Your documents (passport scan, agreements, invoices) are stored in South Africa (AWS S3, af-south-1). Some processors hold or process data outside South Africa: DocuSeal (cloud e-signing), Sentry (error reports, USA), the email delivery provider, Vercel and Railway (the website and API hosting, in the regions stated in their agreements with MBB — Railway’s region is being pinned and will be named here), and Anthropic (USA — Market Watch page text only, never your data). Remitting buyback proceeds transfers your banking details to your bank in your country. South Africa has no adequacy decision under the GDPR, and POPIA section 72 requires the recipient to be bound by a law or agreement giving comparable protection: each transfer above rests on the processor’s written data-processing agreement with MBB, and for EU/UK residents on the European Commission’s standard contractual clauses (or the UK addendum) with that processor. You may ask the Information Officer for a copy of the safeguards that apply to you.

These periods are enforced by an automatic daily process, not only by policy: when a period lapses the record is deleted from our systems and storage, and the deletion is logged. If you ask for deletion earlier (section 11), everything not covered by a legal retention duty is deleted within 30 days and the rest is kept under a tombstoned identity until its period lapses.

All data is encrypted in transit and at rest. The most sensitive fields — your passport number and payout banking details — carry an additional layer of application-level encryption, so they are unreadable even in a copy of the database. Document scans live in private, access-controlled storage in South Africa, served only through short-lived signed links that force a download; every upload is checked for file type, size and structure, and PDFs containing scripts are rejected. Full malware scanning of uploads is being added; until it is live, staff open uploaded scans with that in mind. Staff access is role-restricted and every access to sensitive data is recorded in an append-only audit log. Card payments are handled by PCI-compliant processors — MBB never stores card numbers. If you believe your information has been compromised, contact us immediately; in the event of a breach that poses a risk to your rights we will notify you and the Information Regulator as POPIA section 22 requires, and EU/UK residents’ supervisory authority within 72 hours as the GDPR requires. We keep a written incident-response procedure and a record of every incident.

• Access — download a complete copy of your data any time from your dashboard (Support → Privacy & your data).
• Correction — ask us to fix inaccurate or incomplete information.
• Deletion — request deletion from the same dashboard section. The request is logged with a 30-day due date and completed by then: your name, passport number and scan, contact and travel details, card token, payout account and any document we have no duty to keep are deleted, and your sessions are ended. Invoices, receipts, signed agreements and the audit trail must be kept for their legal period (5–7 years) under a tombstoned identity and are deleted when it lapses. A request cannot be completed while a subscription is live; if we must refuse any part of it, we tell you why in writing.
• Objection — object to processing based on legitimate interest, including any direct marketing.
• Withdraw consent — where processing is based on consent, withdraw it at any time.
• Complain — lodge a complaint with the Information Regulator of South Africa: www.justice.gov.za/inforeg · inforeg@justice.gov.za · JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001. EU/UK residents may also approach their local supervisory authority.

We use only strictly necessary cookies: two signed, httpOnly session cookies that keep you signed in (they carry a signed token, not your personal details). We set no advertising, analytics or tracking cookies that follow you across other websites. A few functional values (your chosen language and display currency, whether you have seen the cookie notice, a signed-in hint and a draft of the registration form) are kept in your browser’s own storage and never sent to us. Country flag images are loaded from flagcdn.com, and technical error reports go to Sentry — neither receives your personal information. Each item is listed, with its purpose and lifetime, in our Cookie Policy.

When you create an account you tick a box confirming you accept our Terms of Service and have read this policy. We record the time of that tick and the version of the Terms it referred to, and keep it with your file. When you accept a quote you tick again, confirming the Terms version shown and, for card payment, the recurring card payment authorisation; that record and the quote exactly as accepted are kept with your file. Marketing messages are a separate, optional tick that is off by default; the time you gave or withdrew it is recorded. You can withdraw it at any time under Account in your dashboard, by the one-click unsubscribe link in any marketing email, or by emailing us.

The programme is available to adults 18 and over only. We do not knowingly collect personal information from anyone under 18 — if you believe we have, contact us and we will delete it.

The current version of this policy always lives at this address. Material changes affecting your rights will be notified by email or WhatsApp with at least 30 days’ notice. Privacy questions, requests and complaints go to our Information Officer at kerrenwolfin@motobuyback.com — we respond within 30 days. See also our Terms of Service.