Privacy Policy

1. Introduction

RRK Systems (Pty) Ltd ( "we", "us", or "our") operates the Carpool Match mobile application and associated services (collectively, the "Platform").

We are committed to protecting your privacy and processing your personal information responsibly and lawfully. This Privacy Policy explains what personal information we collect, why we collect it, how we use it, and your rights in relation to it.

By using our Platform, you confirm that you have read and understood this Policy and consent to the processing of your personal information as described herein.

2. Who We Are (Responsible Party)

Under POPIA, RRK Systems (Pty) Ltd, the company running Carpool Match mobile application, is the Responsible Party — the entity that determines the purpose and means of processing your personal information.

Our Information Officers are registered with the Information Regulator of South Africa as required by POPIA.

3. Personal Information We Collect

We collect the following categories of personal information when you register and use the Platform:

3.1 Identity & Contact Information

• Full name
• South African ID number — collected for identity verification purposes as required by law
• Email address
• Mobile phone number
• Profile photograph (head and shoulders selfie)

3.2 Identity Documents

• Photographs of your South African ID card or ID book (front and back)
• These are collected solely for the purpose of verifying your identity in compliance with our obligations under applicable law

3.3 Vehicle Information (Drivers only)

• Vehicle make, model, year, and colour
• Vehicle registration (number plate)
• Photographs of the vehicle and licence disc
• Number of passenger seats

3.4 Location Information

• Pick-up and destination addresses you enter when posting or searching for trips
• Route coordinates (selected Google Maps route) associated with a trip
• We do not track your device's GPS location continuously or in the background

3.5 Financial Information

• Wallet transaction history (top-ups, trip charges, driver earnings)
• We do not store card numbers, CVV codes, or banking credentials — card payments are tokenised by an accredited third party vendor and are never transmitted to our servers

3.6 Usage & Technical Information

• Trip history (dates, routes, matched parties)
• In-app messages between matched users
• App ratings and feedback you submit
• Device type and operating system (for support purposes)
• App crash logs and error reports

4. Why We Collect Your Information (Lawful Basis)

Under POPIA, we may only process personal information if we have a lawful basis to do so. The table below sets out our lawful basis for each processing activity:

5. How We Use Your Information

We use your personal information exclusively for the following purposes:

• To create, verify, and manage your account on the Platform
• To verify your identity and vehicle before granting driver status
• To match you with compatible drivers or passengers based on your trip details
• To process wallet transactions and maintain your transaction history
• To facilitate communication between matched drivers and passengers via in-app messaging
• To send you trip confirmations, updates, and safety alerts
• To investigate safety incidents, disputes, or fraudulent activity
• To respond to your support queries
• To comply with our legal obligations under South African law
• To improve the Platform based on usage patterns and your feedback

6. Sharing of Your Personal Information

6.1 Information shared with other users

When you are matched with another user for a trip, we share limited information necessary for the trip to take place:

• Your first name and profile photo
• Your star rating
• For drivers: vehicle make, colour, and number plate
• Pick-up and destination details for the shared trip

Your ID number, email address, full ID documents, and financial details are never shared with other users.

6.2 Service providers (Operators under POPIA)

We engage the following service providers who process personal information strictly on our behalf and under written data processing agreements:

All service providers are contractually required to process personal information only as instructed by us, to implement appropriate security measures, and not to disclose it to any other party.

6.3 Legal disclosures

We may disclose personal information to law enforcement, regulators, or courts where we are legally required to do so under South African law, including but not limited to the South African Police Service Act, the Electronic Communications and Transactions Act (ECTA), or a valid court order. We will notify you of such disclosures where we are legally permitted to do so.

7. Identity Verification & Document Security

We collect photographs of your South African ID document and a selfie for the sole purpose of verifying that you are a real person and that your identity matches your account details. This reduces fraud, impersonation, and safety risks on the Platform.

7.1 How we store your documents

• ID document images are stored in an encrypted, access-controlled storage environment
• Access is restricted to authorised administrators processing verifications
• Documents are not shared with other users, passengers, drivers, or any third party
• Once verification is complete, document images are retained only as long as your account is active and as required by law

7.2 Retention after account deletion

Upon account deletion, your ID documents and selfie are securely deleted within 30 days, unless we are required to retain them for a longer period under applicable law (for example, in connection with an ongoing safety investigation).

8. Your Rights Under POPIA

As a data subject under POPIA, you have the following rights in respect of your personal information held by us:

To exercise any of these rights, contact our Information Officer at info@rrksystems.co.za. We will respond within 30 days as required by POPIA.

9. Data Retention

We retain your personal information only for as long as necessary for the purpose for which it was collected, or as required by law:

10. Security Measures

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, destruction, or disclosure, including:

• Encryption of personal data at rest and in transit (TLS 1.2+)
• Role-based access controls limiting who can view sensitive data
• Secure, access-controlled cloud storage for ID documents
• Regular security assessments and vulnerability testing
• Staff training on data protection and confidentiality obligations

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the Information Regulator as required by POPIA section 22, without undue delay and within 72 hours of becoming aware of the breach.

11. Children's Privacy

The Platform is intended for users who are 18 years of age or older. We do not knowingly collect personal information from persons under 18. If you are under 18, please do not use the Platform or provide any personal information to us.

If we become aware that we have inadvertently collected personal information from a person under 18, we will delete it promptly. Please contact us at info@rrksystems.co.za if you believe we may have collected such information.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via the app and by email at least 14 days before the changes take effect. Continued use of the Platform after that date constitutes your acceptance of the updated Policy.

13. Contact Us

For any questions, requests, or complaints relating to this Privacy Policy or the processing of your personal information, please contact our Information Officer: