Vendor Consent Management Policy

1. SCOPE AND APPLICABILITY

This policy applies to all vendors, sellers and fulfilment partners who register, list products, or otherwise transact on Pet Union’s marketplace. It governs the consents required for account setup, order fulfilment, shipping and pickup coordination, returns handling, marketing communications, and optional services such as third‑party fulfilment or analytics.

Vendors must provide required consents as a condition of onboarding unless a separate written vendor agreement specifies otherwise.

2. CONSENT TYPES AND PURPOSES

Operational consents (required)

• Account administration: processing identity, bank and tax details to verify and operate the vendor account.
• Order fulfilment and shipping: sharing order, origin address and contact details with couriers and locker services (including Bob Go) to enable pickups, waybills and delivery.
• Returns handling: receiving returned items at the vendor’s address and processing refunds or exchanges per marketplace rules.

Optional consents (opt‑in)

• Marketing and promotions: receiving marketplace marketing, promotional offers, or inclusion in marketplace campaigns.
• Analytics and performance insights: sharing anonymised or pseudonymised sales and performance data with third‑party analytics providers.
• Fulfilment services: enabling Pet Union or third‑party fulfilment providers to store and ship inventory on the vendor’s behalf.

Legal basis and transparency. Required consents are necessary to perform the contract between Pet Union and the vendor. Optional consents are collected only with explicit opt‑in and are clearly labelled.

3. DATA COLLECTED FROM VENDORS

Categories of vendor data:

• Identity and business details: company name, trading name, registration number, VAT/tax number, contact person, phone and email.
• Address details: physical store/warehouse addresses used for pickups, returns and fulfilment.
• Financial details: bank account details for payouts (collected securely).
• Operational data: product listings, stock levels, SKU dimensions and weights, shipping preferences, and fulfilment instructions.
• Communications and consent records: timestamps, IP addresses, and audit logs showing when and how consent was given or withdrawn.

Minimum data for required consents. Vendors must provide accurate identity, contact and return address information to enable order fulfilment and returns. The vendor’s return address is the address to which returned items must be sent unless otherwise agreed.

4. HOW CONSENT IS CAPTURED AND RECORDED

Capture methods

• Onboarding form: required consents are presented as clear checkboxes and statements during vendor registration. Required consents must be accepted to complete onboarding.
• Vendor dashboard: optional consents can be managed and updated in the vendor’s account settings.
• Transactional flows: consents tied to specific actions (e.g., enabling Bob Go shipping) are captured at the point of activation or shipment creation.

Recordkeeping

• Audit trail: every consent action is logged with vendor ID, consent type, timestamp, method (web, API), and IP address.
• Versioning: when consent language or purposes change, vendors are presented with updated text and asked to reconfirm; prior consent records are retained for audit purposes.

Consent requests are granular and written in plain language. Required consents are clearly labelled as necessary for marketplace operation.

5. SHARING DATA WITH THIRD PARTIES INCLUDING BOB GO

Purpose of sharing. Vendor data (order details, pickup address, contact number) is shared with third‑party service providers to enable shipping, locker delivery, payment processing, fraud prevention and analytics.

Bob Go integration

• What is shared: origin address, parcel dimensions and weight, recipient address, contact number, and waybill instructions when creating shipments via Bob Go.
• Why it is shared: to generate live courier quotes, schedule pickups, create waybills, and provide tracking updates.
• Consent requirement: vendors must consent to share origin and fulfilment data with Bob Go as part of required operational consents if they use Bob Go for shipping. Vendors who do not consent cannot use Bob Go integration and must arrange shipping independently.

Data minimisation and contractual safeguards. Pet Union shares only the data necessary for the third party to perform the service and requires data processing agreements that include confidentiality, security, and permitted use restrictions.

6. VENDOR RIGHTS AND WITHDRAWAL OF CONSENT

Rights available to vendors

• Access: request a copy of consents and the data Pet Union holds about them.
• Rectification: correct inaccurate or incomplete vendor data.
• Withdrawal: withdraw optional consents at any time via the vendor dashboard or by contacting support@petunion.co.za. Withdrawal does not affect processing based on consent prior to withdrawal.
• Restriction and objection: request restriction of processing or object to certain processing activities where applicable under law.

Effect of withdrawal

Withdrawing optional consents stops future processing for those purposes. Withdrawing required operational consents (e.g., sharing order data with couriers) may prevent Pet Union from providing marketplace services; Pet Union will notify the vendor of consequences and offer alternatives where feasible.

How to withdraw

Vendors can withdraw consents in the vendor dashboard or by emailing support@petunion.co.za. Pet Union will confirm receipt and update consent records promptly.

7. RETENTION, RECORDKEEPING AND AUDIT TRAIL

Consent records and related transactional data are retained for as long as necessary to provide services, comply with legal obligations, resolve disputes, and for audit purposes. Specific retention periods are documented in Pet Union’s data retention schedule.

Pet Union maintains an auditable log of consent events and will provide evidence of consent where required by regulators or in dispute resolution.

8. SECURITY AND DATA PROTECTION MEASURES

Pet Union implements appropriate security measures including encryption in transit and at rest for sensitive data, access controls, role‑based permissions, and regular security assessments.

Vendor responsibilities: vendors must keep account credentials secure, promptly update contact and address information, and follow secure practices when sharing sensitive information.

Breach notification: in the event of a data breach affecting vendor personal data, Pet Union will follow applicable breach notification laws and notify affected vendors and regulators as required.

9. COMPLIANCE, DISPUTE RESOLUTION AND SANCTIONS

Pet Union complies with applicable data protection and consumer protection laws. Vendors are responsible for complying with laws applicable to their products and operations.

Dispute resolution

Disputes about consent or data processing should be raised with support@petunion.co.za. If unresolved, vendors may pursue remedies under applicable law or follow the marketplace dispute resolution procedures.

Sanctions for non‑compliance

Failure to provide required consents or to comply with data accuracy and fulfilment obligations may result in suspension of vendor services, withholding of payouts, or termination of the vendor account in accordance with marketplace terms.

10. CONTACT AND VENDOR ONBOARDING CHECKLIST

Contact
For consent management, data requests or disputes contact: support@petunion.co.za.

Onboarding checklist for vendors

• Provide legal business name and contact person.
• Provide accurate pickup and returns addresses for each origin.
• Provide bank details for payouts (securely).
• Accept required operational consents (account administration, order fulfilment, returns).
• Opt in to optional services if desired (marketing, analytics, fulfilment).
• Confirm whether you will use Bob Go integration and consent to share origin and shipment data if yes.