Privacy notice & POPIA compliance

1. Who we are

Taxic operates a rural delivery platform that moves parcels along existing minibus taxi routes in South Africa. Depending on the processing activity, Taxic acts as the Responsible Party (where we determine why and how information is processed) or as an Operator (where we process on behalf of a merchant or fleet owner).

Our designated Information Officer can be reached at officer@taxic.co.za. Registration with the Information Regulator is pending, alongside our first taxi association filing.

2. Lawful basis for processing

We process personal information only where one of the following applies:

• Consent. You gave it explicitly, such as when enabling location or opting into notifications.
• Contractual necessity. We cannot deliver an order, pay a driver or settle a merchant without processing the details involved.
• Legal obligation. Operator permits, transport compliance and financial record-keeping requirements.
• Legitimate interest. Fraud prevention, dispute resolution and platform security, balanced against your rights.

3. What we collect

We do not collect identity numbers from customers, we do not read your messages, and we do not build advertising profiles.

4. Location tracking & geofencing

Real-time location is central to matching parcels to taxis, so it is deliberately constrained:

• Drivers are tracked only while on duty with an active assignment. Location sharing terminates the moment a driver goes off duty or completes the loop. There is no background tracking of a driver's private movements.
• Containment, not surveillance. A vehicle's position is tested against the active route polygon using point-in-polygon ray casting. Leaving the geofence flags the job or suspends tracking; it does not follow the driver elsewhere.
• Customers share a stop, not a home. Orders are addressed to a named loop stop. We do not require or store your home address.
• Purpose limitation. Location data is used to assign orders, generate arrival estimates and confirm drop-offs. It is not used for any other purpose and is not sold or shared with advertisers.

5. Custody logs

Each physical hand-over writes a timestamped record: merchant to driver, driver to hub, hub to customer. These logs record pseudonymous database identifiers, the parcel ID, the route code and the time — not names, addresses or message content. They exist to settle disputes and prove payment splits, and they are retained as an audit trail for that purpose alone.

6. Who we share information with

• The driver carrying your order sees your first name, the loop stop and the parcel ID — enough to complete the hand-over.
• The merchant sees the order contents and a pseudonymous customer reference.
• Taxi associations and fleet owners receive aggregated earnings and route performance data. They do not receive customer personal information.
• Service providers — cloud hosting, SMS/OTP delivery and payment processing — process data under contract, on our instruction only.
• Authorities, where we are legally compelled to disclose.

We do not sell personal information, and we do not share it for third-party marketing.

7. How long we keep it

• Order and settlement records: retained while required for accounting and dispute resolution, then anonymised.
• Driver on-duty location traces: retained only as long as needed to verify the run and resolve disputes, then deleted or aggregated.
• Account details: kept while your account is active. Closed accounts are anonymised, except where records must be kept by law.
• Website enquiries: kept until the enquiry is resolved and for a reasonable follow-up period afterwards.

8. Security & data residency

• Traffic between mobile apps and our backend is encrypted in transit using current TLS.
• Database access is governed by per-role security rules; wallet cash-outs additionally require dual one-time PIN confirmation.
• Settlement records are sealed with a SHA-256 hash chain so historical amounts cannot be altered without detection.
• In line with section 72 of POPIA, we host core databases in a manner intended to keep personal information within South Africa or in jurisdictions with comparable protection, and we will disclose the location of processing on request.
• If a breach occurs that is likely to compromise personal information, we will notify the Information Regulator and affected users as soon as reasonably possible after establishing the scope.

9. Your rights

Under POPIA you may ask us to:

• Confirm what personal information we hold about you, and give you a copy;
• Correct or delete information that is inaccurate, irrelevant, excessive or out of date;
• Object to processing based on legitimate interest;
• Withdraw consent where processing relies on it (this may prevent us from delivering a service);
• Complain to the Information Regulator if you believe we have not handled your information lawfully.

Send requests to officer@taxic.co.za. We respond within a reasonable period and may ask you to verify your identity first.

10. Children

Taxic accounts are for people aged 18 and over. We do not knowingly create accounts for children. If you believe a child has registered, contact the Information Officer and we will remove the account.

11. Changes to this notice

We will post any material change on this page with a new version number and effective date, and notify account holders in the app. Continuing to use Taxic after a change means you accept the updated notice.