40FY Request access

Legal

Privacy policy

Last updated 18 September 2026

40FY is a trading platform for fresh produce exporters, importers, producers and the companies that work with them. This policy explains what personal information 40FY collects, why, who it is shared with, how long it is kept, and what you can ask us to do with it. It is written for the Protection of Personal Information Act, 2013 (POPIA) of South Africa, where 40FY is operated.

Questions, requests and complaints go to info@40fy.co.za, which reaches the person responsible for personal information at 40FY.

What we collect

  • Your account: your name, email address, phone number, the company you act for and your role in it, and the settings you choose.
  • Checks on your company: the information and documents a company provides so it can trade on the platform (registration details, identity documents of directors and owners, proof of address and, for producers who are paid through 40FY, bank details). Names are also checked against published sanctions lists (the United Nations, the United States Treasury and the European Union).
  • Your trade: offers, orders, shipments, stock, documents, invoices, payments, claims and the messages about them, including mail in a company mailbox a company chooses to connect.
  • WhatsApp: if you link a WhatsApp number to your account, that number, the messages and files (photos and PDFs of documents) you send to 40FY's WhatsApp number, and what 40FY sends back.
  • Wallets: if your company uses the platform's payment or escrow features, the wallet addresses you link and the transactions made with them.
  • How you use the service: sign-in times, the device address you connect from, and records of changes made on the platform, kept for security and so every change can be traced to who made it.
  • Requests from this website: your name, email address, company and message when you ask for access or a demo, used only to reply to you.

Why we use it

  • To run the platform for you and your company: trading, shipping, documents, payments and reporting.
  • To meet legal duties: knowing who we deal with, sanctions screening, tax and trade records.
  • To keep accounts safe: sign-in, two-factor sign-in, detecting misuse.
  • To tell you about your trades, in the app, by email or, if you ask for it, on WhatsApp.
  • To answer questions you ask the 40FY assistant, in the app, on WhatsApp or by email, and to read documents you send it.

We do not sell personal information and we do not use it for advertising.

Who it is shared with

Your trade information is shared with the other party to a trade, as far as that trade needs it: for example, a buyer sees the documents for the shipment they are buying. Beyond that, 40FY uses service providers who process information on our behalf and only for our purposes:

  • Amazon Web Services hosts 40FY's servers and databases, in its Cape Town region.
  • Vercel serves the 40FY web app, and Netlify serves this website.
  • Meta (WhatsApp) carries the messages between your phone and 40FY if you link a WhatsApp number. Meta's own terms and privacy policy apply to your use of WhatsApp.
  • Anthropic or Google provide the artificial intelligence behind the 40FY assistant and document reading, for companies that use those features. Each person can switch these features off in Settings, and then nothing of theirs is sent to them.
  • VALR, for companies that connect it for payments.
  • Email providers deliver the mail 40FY sends.

Some of these providers process information outside South Africa, among them Meta, Anthropic, Google, Vercel and Netlify. We use them because they are bound to protect it to a standard comparable to POPIA.

Escrow and payment records made on a public blockchain, including the wallet addresses involved, can be seen by anyone and cannot be changed or removed by 40FY or anybody else.

We also share information when the law requires it.

How long we keep it

We keep your information for as long as your account is open and your company trades on the platform. Trade, tax and customer-check records are kept for as long as the law requires, generally five years after the trade or the business relationship ends. After that, information is deleted or kept only in a form that no longer identifies you. A linked WhatsApp number stops acting for your account after 180 days unless you link it again, and you can remove it at any time.

How we protect it

Information travels encrypted between your device and 40FY. Access inside the platform follows your company's roles, a company sees only its own trades and those it is party to, passwords are never stored in readable form, secrets such as payment and messaging keys are stored encrypted, and two-factor sign-in is available for every account.

Your rights

You may ask us:

  • whether we hold personal information about you, and for a copy of it;
  • to correct information that is wrong or out of date;
  • to delete information we no longer need or have no right to keep (see deleting your data);
  • to stop using your information for a particular purpose, where you are entitled to object.

Write to info@40fy.co.za from the email address on your account. If you are unhappy with our answer, you may complain to the Information Regulator of South Africa (inforegulator.org.za).

Cookies

The 40FY web app uses a cookie and your browser's storage only to keep you signed in and to remember your settings. There are no advertising or tracking cookies, on the app or on this website.

Children

40FY is a service for businesses and is not meant for anyone under 18.

Changes to this policy

When this policy changes, the date at the top changes with it. If a change affects how your information is used, we will tell you in the app before it takes effect.