Privacy Policy

Moto Buy back (Pty) Ltd (“MBB”, “we”, “us”) is the responsible party, as defined under the Protection of Personal Information Act 4 of 2013 (POPIA), for the personal information we collect and process in connection with the Moto Buyback programme. Registration No: [Company Reg No]. Address: [Registered Address], South Africa. Our Information Officer is [Name], reachable at kerrenwolfin@motobuyback.com. Because many of our clients are EU or UK residents, we also apply the principles of the GDPR.

This policy applies to:

• All individuals who enquire about or use the Moto Buyback programme.
• All visitors to the MBB website.
• All individuals who communicate with MBB by email, WhatsApp, phone, or any other channel.

It covers personal information collected directly and through the operation of the programme — including GPS location data from tracking devices installed on programme motorcycles.

We collect only what is necessary for the purposes below. We do not collect special personal information (health data, political opinions, religious beliefs) unless you volunteer it and it is directly relevant to your participation.

• Legal obligation — customer due diligence and record-keeping under the Financial Intelligence Centre Act (FICA), Exchange Control Regulations (SARB), and SARS requirements.
• Contract performance— registering the vehicle in MBB’s name on your behalf, arranging insurance, managing your subscription, processing payments, and remitting buyback proceeds under the Agency Agreement, Subscription Agreement and Sale Mandate.
• Legitimate interest — GPS monitoring and vehicle tracking to protect the vehicle, enforce contract terms, approve cross-border travel, and facilitate recovery where authorised use has ended; plus the security audit trail.
• Consent — where we rely on your consent (for example marketing communications), you may withdraw it at any time; withdrawal does not affect processing that happened before.

Every motorcycle in the MBB programme has a GPS tracking device installed. The tracker is not active during the pre-arrival storage period— the bike is then under MBB’s direct physical supervision. It activates on collection day, and from then continuously records the motorcycle’s location. By entering the programme you consent to MBB collecting and retaining this GPS data for the full subscription period.

We use GPS data only for:

• Security monitoring and stolen-vehicle recovery.
• Verifying compliance with cross-border travel approvals.
• Locating the motorcycle to facilitate recovery where authorised use has ended.
• Providing live location data to you, where your tier includes it (Overland Max).

We do not sell GPS data, do not use it for marketing or profiling, do not share real-time location with any third party except where required by law or for vehicle recovery, and do not use it to monitor your personal movements beyond confirming the motorcycle’s location. GPS records are retained for 12 months after your subscription ends — longer only if legal proceedings or FICA compliance require it.

We are required to collect and retain identity documentation and transaction records under FICA and SARB Exchange Control Regulations, including passport copies, source-of- funds information, transaction records, and Balance of Payments declaration information. These records are retained for a minimum of 5 years from your last transaction and may be disclosed to the Financial Intelligence Centre, SARS, or the South African Reserve Bank where legally required. MBB may be required to file a Suspicious Transaction Report where there are grounds to suspect funds are connected to unlawful activity — we are not permitted to tell you if such a report is filed.

We never sell your personal information. We share it only where necessary:

Every third party we share with is required to handle your data lawfully and only for the purpose it was shared.

Because our clients are based overseas, some processing involves cross-border transfers — payment processors may process data in their home jurisdictions, and remitting buyback proceeds involves transferring financial data to your country. Where we transfer personal information outside South Africa we take reasonable steps to ensure the recipient provides a comparable level of protection to POPIA, relying on contractual safeguards where needed.

After the applicable period, information is securely deleted or anonymised.

All data is encrypted in transit and at rest. The most sensitive fields — your passport number and payout banking details — carry an additional layer of application-level encryption, so they are unreadable even in a copy of the database. Document scans live in private, access-controlled storage served only through short-lived signed links, with malware scanning on every upload. Staff access is role-restricted and every access to sensitive data is recorded in an append-only audit log. Card payments are handled by PCI-compliant processors — MBB never stores card numbers. If you believe your information has been compromised, contact us immediately; in the event of a breach that poses a risk to your rights we will notify you and the Information Regulator as POPIA requires.

• Access— download a complete copy of your data any time from your dashboard (Support → Privacy & your data).
• Correction — ask us to fix inaccurate or incomplete information.
• Deletion — request deletion from the same dashboard section; requests are reviewed against our legal retention obligations and answered within 30 days. Records we must keep under FICA, SARS or SARB rules cannot be deleted regardless of the request — we will always explain why.
• Objection — object to processing based on legitimate interest, including any direct marketing.
• Withdraw consent — where processing is based on consent, withdraw it at any time.
• Complain — lodge a complaint with the Information Regulator of South Africa: www.justice.gov.za/inforeg · inforeg@justice.gov.za · JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001. EU/UK residents may also approach their local supervisory authority.

We use only essential cookies: encrypted, httpOnly session cookies that keep you signed in. We set no advertising or tracking cookies that follow you across other websites.

The programme is available to adults 18 and over only. We do not knowingly collect personal information from anyone under 18 — if you believe we have, contact us and we will delete it.

The current version of this policy always lives at this address. Material changes affecting your rights will be notified by email or WhatsApp with at least 30 days’ notice. Privacy questions, requests and complaints go to our Information Officer at kerrenwolfin@motobuyback.com — we respond within 30 days. See also our Terms of Service.