Privacy Policy

1. Who is responsible for your information

Car4Less (“we”, “us”) is the responsible party, as defined in POPIA, for personal information collected through this website and through our WhatsApp, email and telephone channels. Privacy queries can be directed to us via the contact page or the business WhatsApp, for the attention of the information officer.

2. The information we collect

We collect only what we need, namely:

• Identity and contact details you give us — name, phone number, WhatsApp number, email address, and your town or region where relevant to delivery.
• Enquiry details — the vehicle, service, finance question or business-agency opportunity you ask about, and the content of your messages to us.
• Business Agency applications — your preferred area and capital package, and information you provide during onboarding.
• Technical and usage data — device and browser information, pages viewed and approximate location, collected through cookies and similar technologies (see section 7).

We do not intentionally collect special personal information (such as health or biometric data) or information about children through this website.

3. How we collect it

Directly from you — when you complete a form, message us on WhatsApp, email or call us — and automatically, through cookies when you browse the website. Website forms hand off to WhatsApp: the message content you send there is also processed by WhatsApp under its own privacy terms.

4. Why we process it (purposes and lawful basis)

• To respond to your enquiry and run your vehicle purchase from quote to delivery (performance of, or steps towards, a contract).
• To submit your finance application to the approved banks at your request, and to co-ordinate delivery with the authorised franchise dealer network (performance of a contract; your consent).
• To administer the Payment Saver Plan and Shop & Save programmes for participants, including qualification tracking (performance of a contract).
• To evaluate and conclude Business Agency applications (steps towards a contract).
• To operate, secure and improve the website (our legitimate interests).
• To comply with legal obligations, and to establish or defend legal claims.

We will only send you marketing communications where POPIA and the Consumer Protection Act allow it, and you may opt out at any time.

5. Who we share it with

We do not sell personal information. We share it only as needed to serve you, with:

• The authorised franchise dealer network — the details required to prepare, register and deliver your vehicle, released at the point delivery must take place.
• Banks and finance providers — the information required for the finance application you ask us to arrange.
• Loyalty and rewards partners and underwriters — the minimum needed to administer the rewards programmes for participants.
• Service providers — hosting (this website is served by Vercel), analytics and communications platforms (including WhatsApp), bound to appropriate protections.
• Authorities — where the law requires it.

6. Cross-border transfers

Some service providers (for example our hosting and communications platforms) store or process information outside South Africa. We only permit this where the recipient is subject to laws, contracts or binding rules providing an adequate level of protection substantially similar to POPIA, as section 72 of POPIA requires.

7. Cookies

We use necessary cookies to make the website function and measurement cookies to understand how it is used, as indicated in the cookie notice shown on your first visit. You can block or delete cookies in your browser settings; necessary cookies are required for parts of the site to work.

8. How long we keep it

We keep personal information only as long as needed for the purposes above: enquiry records for as long as reasonably needed to serve you and then for our legitimate record-keeping; transaction, rewards and agency records for the periods required by tax, consumer and company law; and technical logs for short operational periods. Thereafter information is deleted or de-identified.

9. How we protect it

We apply reasonable, appropriate technical and organisational measures — encrypted connections (HTTPS), access controls, reputable hosting and minimal data collection — to secure personal information against loss, damage and unauthorised access or processing. Should a data breach occur that poses a risk to you, we will notify you and the Information Regulator as POPIA requires.

10. Your rights as a data subject

Under POPIA you have the right to:

• be told what personal information we hold about you;
• request access to it;
• request correction or deletion of inaccurate, out-of-date or unlawfully held information;
• object to processing, including for direct marketing;
• withdraw consent where processing is based on consent;
• complain to the Information Regulator (South Africa) — inforeg.org.za — if you believe your information has been mishandled.

To exercise any of these rights, contact us via the contact page. We may need to verify your identity before acting on a request.

11. Automated decisions

We do not make decisions with legal consequences for you based solely on automated processing. Credit decisions are made by the banks under their own processes and policies.

12. Changes to this policy

We may update this policy from time to time; the version published here applies. Material changes will be reflected in the “last updated” date above.