How we handle your information
What Buybackgold.com collects, why, who else sees it, how long we keep it, and what you can require us to do about it under the Protection of Personal Information Act 4 of 2013 (POPIA).
In effect from 16 September 2026
Only what the job needs
When you use the calculator: the karat and weight you enter, and — if you choose to upload one — a photograph of your item. We do not need your name to give you an estimate, and we do not ask for it.
When you ask us to contact you: your name, phone number and email address, so we can arrange a visit and send your quotation. When we confirm a booking we send the date, time and your reference number to that phone number on WhatsApp.
When a sale goes ahead: proof of identity, proof of residence, and your bank account details (a bank confirmation letter). Verifying identity before buying second-hand precious metals is a legal requirement in South Africa, and it protects an honest seller from disputes as much as it protects us. Your ID number is stored as a one-way cryptographic digest, never as readable text — we can confirm a number you give us matches, but we cannot read it back out.
Automatically, as you browse: pages viewed, approximate location derived from your IP address, device and browser, and how you move through a page. See the cookie policy for the detail, including session replay.
What happens to a photo you upload
It is sent to an AI provider to be assessed. To produce an instant estimate, the photograph is transmitted to a specialist AI provider outside South Africa, which assesses the image and returns a valuation. Nothing else about you goes with it — not your name, not your contact details, not your account. The image goes out and the estimate comes back.
It is kept, whether or not you sell. Photographs are retained on our systems including where you never give us your contact details. We keep them to check and improve the accuracy of our valuations, to resolve disputes about what was assessed, and to meet our record-keeping obligations.
Think about what is in frame. A photograph of an item is one thing; a photograph that also captures a document, a face, or an address label is another. We would rather you cropped it than sent us more than you meant to.
Photographs are stored privately and are visible only to authorised staff — never published, never sold, never shared for marketing. If you would like one removed, contact us on 010 157 5180 and we will delete it, unless it forms part of a completed transaction we are legally required to retain.
The services we rely on
We do not sell your personal information, and we do not share it for anyone else's marketing. We do rely on specialist service providers to run the service, set out below by category. Each acts on our instructions under a written agreement, and each processes data outside South Africa.
| Category of recipient | What it does for us | What it receives |
|---|---|---|
| Cloud database and file storage | Holds accounts, valuations, uploaded photographs and transaction records. | Contact details, identity records, photographs, transaction history. |
| Website and application hosting | Serves this website and the services behind it. | IP address and the request metadata inherent in serving a web page. |
| Automated image assessment | A photograph you upload is sent to a specialist AI provider, which assesses the image to produce your indicative estimate. | The photograph itself, and nothing else about you. |
| Business messaging | Delivers booking confirmations to your phone on WhatsApp, and any replies you send us there. | Your first name, phone number, booking date and time, and reference number. |
| Website analytics and session replay | Measures how the public site is used and replays sessions so we can see where people get stuck. | Pages viewed, clicks, scrolling and mouse movement, device and browser, approximate location from IP. |
We also call live precious-metal and currency price feeds. Those receive no personal information at all — they are asked what gold costs, not anything about you.
We identify these by what they do rather than by name. If you want to know who a particular provider is before you deal with us, ask and we will tell you.
Beyond this, we disclose information only where the law requires it: to the South African Police Service in relation to an item we have reasonable grounds to believe is stolen, to the Financial Intelligence Centre where FICA requires a report, and to a court or regulator acting within its powers.
Information that leaves South Africa
Every service in the table above stores or processes data outside South Africa. Section 72 of POPIA permits this where the recipient is bound by an agreement that upholds principles substantially similar to POPIA's, or where the transfer is necessary to perform a contract with you. We rely on both: our agreements with these operators impose equivalent protections, and hosting the service is how we deliver what you asked for.
If you would rather no photograph of yours left the country, do not upload one — book a visit instead, and a buying agent will assess the item in front of you. The estimate is the only thing the upload buys you, and it is not a necessary step.
How long we keep things
| Record | Kept for | Why |
|---|---|---|
| Identity and transaction records for a completed purchase | At least 5 years after the transaction | Financial Intelligence Centre Act 38 of 2001 (FICA), s23 |
| Dealer's register of second-hand goods acquired | As prescribed for a registered dealer | Second-Hand Goods Act 6 of 2009 |
| Accounting and company records | 7 years | Companies Act 71 of 2008, s24 |
| Tax records | 5 years | Tax Administration Act 28 of 2011, s29 |
| Photographs uploaded for a valuation that did not lead to a sale | Until you ask us to delete them | Kept to check valuation accuracy and resolve disputes; no statutory minimum applies |
What you can require us to do
Under POPIA you may ask what we hold about you and require a copy of it; ask us to correct or delete information that is inaccurate, irrelevant, excessive or obtained unlawfully; object to us processing information on grounds of your particular situation; and withdraw a consent you previously gave. We keep a dated record of every consent so both sides know where they stand.
Direct marketing. We will not send you electronic marketing without your consent, and every message we do send carries a way to stop it. Asking us to stop is free and takes effect immediately.
What we cannot delete. Once a transaction is completed, the identity, financial and dealer's-register records listed above must be retained for the periods the law prescribes. Everything outside that we will remove on request.
Automated decisions. The photo estimate is generated automatically, but it decides nothing. No offer is made and no price is set without a person physically testing the item, so nothing here produces a legal effect on you by automated means alone.
How it is protected, and what happens if that fails
Access to customer records is restricted by role and enforced by the database itself rather than only by the screens staff see. Identity numbers are stored as one-way digests, uploaded files are held in private storage reachable only through short-lived authorised links, and staff access to client records is logged.
If personal information is accessed or acquired by an unauthorised person, section 22 of POPIA requires us to notify the Information Regulator and to notify you, and we will do both as soon as we reasonably can — describing what happened, what it means for you, and what we recommend you do.
Our Information Officer, and the Regulator
Requests and complaints about personal information go to our Information Officer. Call us on 010 157 5180 and ask to be put through, and we will give you their direct details.
You also have the right to complain to the supervisory authority, whether or not you come to us first:
- Authority
- Information Regulator (South Africa)
- Address
- JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
- Complaints
- complaints.IR@justice.gov.za
- General enquiries
- enquiries.IR@justice.gov.za
- Website
- inforegulator.org.za