Privacy policy

1. Who we are and when this policy applies

Driva (Pty) Ltd ("Driva", "we", "us" or "our") provides technology that connects passengers with independent drivers and transport providers for taxi, shuttle, airport-transfer and rideshare services. For purposes of the Protection of Personal Information Act 4 of 2013 (POPIA), Driva is the responsible party for the personal information described in this policy, except where another party is identified as responsible for its own processing.

This policy applies to our websites, including mydriva.co.za, our passenger and driver applications, communications with us, and related services (together, the "Services"). It applies to passengers, drivers, prospective drivers, website visitors and people who contact us.

2. Personal information we collect

The information we collect depends on how you use the Services. It may include:

• Account and contact information, such as your name, mobile number, email address, profile photograph, preferred language and account credentials.
• Driver and vehicle information, such as identity details, driving licence, permits, screening or verification information, vehicle details, insurance information, banking or payout details, availability and service performance.
• Trip and location information, including precise or approximate device location, pickup and destination, route, distance, time, trip status and trip history. A driver device may provide location while the driver is online or completing a trip, including when the app is running in the background where device permissions allow.
• Payment and transaction information, such as payment method, payment token, fare, tip, refund, payout and transaction records. Payment providers may process full card or banking details under their own privacy terms; Driva may receive limited confirmation and transaction information.
• Communications and support information, including messages, ratings, feedback, complaints, call or chat records, safety reports, and information supplied when you contact support.
• Device, technical and usage information, such as IP address, device and advertising identifiers, operating system, app version, browser type, language, network information, app interactions, diagnostic information and crash data.
• Marketing and attribution information, such as campaign source, ad interactions and communication preferences.
• Information from other people and lawful sources, including passengers, drivers, referral partners, verification providers, payment or fraud-prevention providers, public records and authorities where permitted by law.

3. How we use personal information

We use personal information only for lawful, specific and relevant purposes, including to:

• create, verify, administer and secure accounts;
• connect passengers and drivers, estimate fares, arrange trips, provide navigation and process payments or payouts;
• show trip participants the information reasonably needed to complete a ride, such as first name, profile photograph, vehicle information, pickup location and live trip location;
• provide customer support, investigate incidents, handle complaints, recover lost property and respond to emergencies;
• promote safety, prevent fraud, misuse and unauthorised access, and enforce our terms and policies;
• operate, maintain, personalise, troubleshoot and improve the Services;
• measure performance, conduct analytics, test features and understand how the Services are used;
• send service messages and, where allowed, news, promotions or offers;
• meet tax, accounting, transport, insurance, law-enforcement and other legal or regulatory obligations; and
• establish, exercise or defend legal claims and protect the rights, safety and property of Driva, users and others.

4. Our lawful grounds for processing

Depending on the circumstances, we process personal information with your consent; to conclude or perform a contract with you; to comply with a legal obligation; to protect your legitimate interests or those of another person; or to pursue Driva's legitimate interests where those interests are not overridden by your rights. Our legitimate interests include operating and improving the Services, preventing fraud, keeping users safe, securing our systems and communicating about our services.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that was lawful before withdrawal. Certain information, including trip location and account details, is necessary to provide core features; if it is not supplied, we may be unable to provide those features.

5. When we share personal information

We do not sell personal information. We may disclose or make information available to the following recipients when reasonably necessary and permitted by law:

• Passengers, drivers and transport providers involved in a requested or completed trip.
• Service providers that support hosting, cloud storage, maps, navigation, communications, identity or driver verification, payment processing, analytics, advertising attribution, customer support, security and fraud prevention.
• Business partners where you request a partner service or where a trip is arranged through an organisation, subject to appropriate safeguards.
• Professional advisers, insurers, auditors and financing or transaction counterparties where confidentiality protections apply.
• Government authorities, regulators, courts, emergency services or law-enforcement bodies where disclosure is required or permitted by law, or is reasonably necessary to protect safety or legal rights.
• A successor or participant in a merger, reorganisation, financing, sale of assets or similar business transaction, subject to applicable confidentiality and data-protection requirements.

Service providers may process information only for agreed purposes and under contractual or legal duties appropriate to their role. Third parties that determine their own purposes, such as payment providers or authorities, are responsible for their own privacy practices.

6. Location information

Location is central to an e-hailing service. Depending on your settings and role, the Services may collect precise location while the app is open, while a trip is in progress, or in the background. We use it to identify pickup points, match and dispatch drivers, provide route guidance, calculate trip information, support live trip sharing, respond to safety events, prevent fraud and maintain service records.

You can manage app location permissions in your device settings. Disabling location may prevent ride-request, navigation, live-tracking or driver-online features from working correctly.

7. Cookies, analytics and advertising technologies

Our website and apps may use cookies, software development kits, pixels, device identifiers and similar technologies to keep the Services working, remember settings, measure performance, diagnose problems, understand usage and attribute marketing campaigns. Some analytics or advertising partners may receive identifiers, usage data, diagnostics or general location information and may process them under their own policies.

You can control cookies through your browser and certain tracking or advertising permissions through your device settings. Blocking these technologies may affect functionality. Where the law requires consent, we will request it before using non-essential technologies.

8. Storage, retention and deletion

We retain personal information only for as long as reasonably necessary for the purposes described in this policy, including providing the Services, maintaining safety and transaction records, resolving disputes, enforcing agreements and meeting legal, tax, accounting or regulatory requirements. Retention periods vary according to the type of information, the nature of our relationship, legal requirements and risk.

When information is no longer required or authorised to be retained, we will delete or de-identify it in accordance with applicable law. Residual copies may remain temporarily in secure backups or where retention is required for legal claims, fraud prevention or compliance.

9. International processing

Some service providers or systems may be located outside South Africa. Where personal information is transferred across borders, we take reasonably practicable steps to ensure that the recipient is subject to a law, binding corporate rules, agreement or other safeguard that provides an adequate level of protection as required by POPIA.

10. Security

We use reasonable technical and organisational safeguards designed to protect personal information against loss, damage, unauthorised destruction, access, use, alteration or disclosure. Measures may include encryption in transit, access controls, authentication, monitoring, staff confidentiality obligations and incident-response processes.

No system is completely secure. Please use a strong device passcode, protect verification codes and account access, and tell us promptly if you suspect unauthorised activity. If a security compromise creates a risk to you, we will notify affected people and the Information Regulator where required by law.

11. Your privacy rights

Subject to POPIA and other applicable law, you may ask us to:

• confirm whether we hold personal information about you and request access to it;
• correct or update information that is inaccurate, incomplete, misleading or out of date;
• delete or destroy information that we are no longer authorised to retain;
• object, on reasonable grounds, to certain processing;
• withdraw consent where processing is based on consent;
• stop direct-marketing communications; and
• provide information about a decision based solely on automated processing where applicable.

To exercise a right, email info@driva.online with the subject line "Privacy request". We may need to verify your identity and may retain limited information where required or permitted by law. We will respond within the period required by applicable law.

12. Automated processing

The Services may use automated rules or models to support matching, dispatch, fare calculation, fraud detection, safety, account security and service quality. Where a decision that has legal or similarly significant effects is based solely on automated processing, we will provide the protections required by applicable law, which may include an opportunity to make representations or request appropriate review.

13. Children

The Services are not intended for a child to create and operate an independent account unless this is allowed by law and supported by the consent or authorisation of a competent person where required. If we learn that a child's personal information was collected unlawfully, we will take reasonable steps to delete it. A parent or guardian may contact us about a child's information.

14. Direct marketing and communications

We may send operational messages needed for your account or trips. We may send direct marketing only as permitted by law. You can opt out through the unsubscribe option in a message, relevant app settings, or by contacting us. Opting out of marketing does not stop necessary service, safety, transaction or legal notices.

15. Changes to this policy

We may update this policy to reflect changes to the Services, our practices or the law. We will publish the revised policy and change the effective date. If a change is material, we may also provide notice in the app, on the website or by another appropriate method.

16. Contact us and lodge a complaint

Questions, concerns and privacy requests may be directed to Driva's Information Officer at info@driva.online or +27 68 562 4762, or delivered to Driva (Pty) Ltd, 9 Lausanne Street, Bloemfontein, 9301, South Africa.

If you are not satisfied with our response, you may lodge a complaint with the Information Regulator (South Africa) through its eServices portal or at POPIAComplaints@inforegulator.org.za. General enquiries: enquiries@inforegulator.org.za or 010 023 5200. Information Regulator address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191.