POPIA Privacy Notice

1. Who we are

This notice explains how Rephawk Pty Ltd ("we") processes personal information in terms of the Protection of Personal Information Act 4 of 2013 (POPIA). We are the responsible party for the personal information described here.

Where you are a carrier or business using HaulMetrix and you load your own customers', drivers' or employees' information into the platform, you are the responsible party for that information and we act as your operator. You must give those people their own privacy notice.

2. Information Officer

Our Information Officer is Chris Botha, reachable at [privacy@yourdomain.co.za]. Requests, objections and complaints under POPIA and PAIA should be directed there.

3. Personal information we collect

Depending on how you interact with us, we may collect:

• identity and contact details — name, business name, email address, telephone and WhatsApp number, physical and billing address;
• account and access data — credentials, role, organisation, seat status, login and audit records;
• operational data — loads, routes, vehicles, drivers, timesheets, leave, trip events, expenses and proof-of-delivery documents;
• financial data — invoices, payments, bank statement information and subscription billing records;
• location data — driver and vehicle location, collected only with the driver's recorded consent;
• technical data — IP address, device and browser type, and usage activity;
• communications — messages you send us, and messages sent through the platform's email, SMS and WhatsApp functions;
• payment data — processed by our payment provider; we receive only a token, status and the last digits of a card.

4. Why we process it and on what basis

We process personal information only for specific, explicitly defined and lawful purposes. Our basis is normally the performance of our agreement with you, or our legitimate interest in operating and securing the platform. Where neither applies — for example marketing to someone who is not yet a customer — we rely on consent.

• to create and administer your account and provide the Software;
• to process payments, invoices and subscriptions;
• to provide support and respond to your enquiries;
• to secure the platform, detect fraud and keep audit records;
• to comply with legal, tax and accounting obligations;
• to improve the Software using aggregated and de-identified information;
• to send service messages, and marketing only where you have consented.

5. Special personal information

We do not intentionally collect special personal information such as health, biometric or political information. If your use of the platform involves such information — for example medical-aid membership captured for payroll — you are responsible for obtaining the necessary authorisation, and we process it only as your operator.

6. Children

The Software is a business tool and is not intended for children. We do not knowingly process the personal information of a child without the consent of a competent person.

7. Who we share it with

We do not sell personal information. We share it only as needed, and only with operators bound to protect it:

• hosting, database and file-storage providers;
• payment processors, for subscription billing;
• email, SMS and messaging providers, to deliver communications you send through the platform;
• mapping and location services, to render routes and tracking;
• our professional advisers, auditors and insurers;
• a regulator, court or authority where the law requires it.

8. Transfers outside South Africa

Some of our providers store data outside South Africa. Where that happens we transfer information only as permitted by section 72 of POPIA — the recipient is subject to a law, binding agreement or corporate rules that provide a comparable level of protection, or the transfer is necessary to perform our agreement with you, or you have consented to it.

9. How we secure it

We apply reasonable technical and organisational measures to secure personal information, including credential-based access control, role-based permissions, encryption in transit, and audit logging. We review these measures as the platform develops.

10. How long we keep it

We keep personal information only as long as necessary for the purpose it was collected, or as the law requires — for example tax and company records are retained for the statutory periods. When it is no longer needed we delete it, destroy it or de-identify it. After a subscription ends we retain your data for 30 days to allow export, then remove it.

11. Your rights

As a data subject under POPIA you have the right to:

• be notified that we collect your personal information, and when it has been accessed without authorisation;
• request access to the personal information we hold about you;
• request the correction, destruction or deletion of information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or was obtained unlawfully;
• object, on reasonable grounds, to the processing of your personal information;
• withdraw any consent you have given, at any time;
• object to processing for direct marketing, and to opt out of marketing at any time;
• not be subject to a decision based solely on automated processing that significantly affects you;
• lodge a complaint with the Information Regulator.

12. How to exercise your rights

Send your request to our Information Officer at [privacy@yourdomain.co.za], using the forms prescribed by the Information Regulator where applicable. We may ask you to verify your identity first.

We will respond within 30 days. If we cannot, we will tell you why and when we will. A reasonable prescribed fee may be charged for access requests.

13. Direct marketing

We send marketing by email, SMS or similar electronic communication only with your consent, or where you are an existing customer and we are marketing our own similar products or services and you were given the chance to opt out when your details were collected.

Every marketing message identifies us and tells you how to opt out. You may withdraw consent at any time and we will stop.

14. Cookies and tracking

We use cookies and similar technologies to run the platform and understand how it is used. See our Cookie & Tracking Notice for the categories we use and how to manage them.

15. Security compromises

If there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and the affected data subjects as soon as reasonably possible, in the manner required by section 22 of POPIA.

16. Complaints

If you are unhappy with how we have handled your personal information, please contact our Information Officer first so we can try to resolve it.

You may also complain to the Information Regulator (South Africa), whose complaints process and contact details are published at inforegulator.org.za.

17. Changes to this notice

We may update this notice. Material changes will be notified on this page and, where appropriate, by email. The version and effective date are shown at the top of the document.