Privacy Policy

This policy explains how DriveSmart Africa (“DriveSmart”, “we”, “us”) collects, uses, shares and protects personal information. We follow the Protection of Personal Information Act 4 of 2013 (POPIA).

This policy covers:

• our website, www.drivesmartafrica.co.za (the “website”);
• the DriveSmart fleet management platform at app.drivesmartafrica.co.za, used by fleet operators and their staff (the “platform”); and
• the DriveSmart Driver mobile app for Android and iOS, used by drivers (the “Driver app”).

Together we call these the “services”.

1. Who is responsible for your information

When we decide why and how information is used, DriveSmart is the responsible party. This applies to website enquiries, and to the accounts and business contact details of our fleet customers.

When a fleet operator uses our services to manage its drivers and vehicles, the fleet operator (usually your employer or the company you drive for) is the responsible party. DriveSmart is the operator under POPIA. We process that information only on the fleet operator’s instructions and under a written agreement with them. Your fleet operator decides which records it keeps and for how long.

If you are a driver, you can contact your fleet operator or us about your information. If we receive a request that your fleet operator must decide, we send it to them and help them respond.

2. Information we collect

2.1 Website visitors

• Details you enter in the contact form: name, email address, phone number, company and message.
• Technical information that our hosting provider records for every request, such as IP address, browser type and pages visited. We use this to run and secure the website.

The website does not use advertising or analytics cookies.

2.2 Fleet operator staff using the platform

• Name, email address, phone number, organisation, role and permissions.
• Sign-in details. Passwords are stored only in hashed form by our authentication provider.
• A record of changes you make to fleet records (an audit log).

2.3 Driver records managed by fleet operators

Fleet operators enter or import this information, or it comes from their telematics provider:

• Identity and contact: full name, South African ID or passport number, email address and cellphone number.
• Licences and compliance: driving licence number, code and expiry, Professional Driving Permit (PrDP) category and expiry, and references to medical certificates and police clearance certificates.
• Work assignment: fleet, site, assigned vehicles and assignment history.
• Vehicle and driving data: vehicle location, routes, trips, stops, speed, harsh driving events, engine fault codes, signal-jamming events and odometer readings. This comes from the telematics system the fleet operator already uses (for example Cartrack, Ctrack, MiX or Netstar).
• Safety and conduct: safety scores, alerts, and traffic infringements and AARTO demerit points.
• Fuel and costs: fuel fills, fuel slips, fuel card use and fuel-economy results.
• Rewards: points, reward balances, reward and cash-out requests, and a masked label for the payout method (for example “Bank ••1234”). Full bank details are kept by the fleet operator’s finance system, not by us.

2.4 Drivers using the Driver app

In addition to the records above, the Driver app collects:

• Account: email address, cellphone number and sign-in details.
• Work records you submit: shift start and end, vehicle inspections, trip and stop updates, proof of delivery, fuel slips and bowser fills, expense claims, issue reports, SOS alerts, driving hours and breaks, training progress and messages with dispatch.
• Photos: pictures you take or choose of fuel slips, delivery notes, vehicle faults and issues. The app opens only the photos you select. It does not read your photo library.
• Voice notes that you record when you report an issue.
• Signatures and names of receivers who sign for a delivery. This is information about another person. Please tell receivers that their signature is recorded for the fleet operator.
• Location: with your permission, your phone’s precise location while a trip is active and the app is open, and when you send an issue report or SOS alert. The app does not collect location in the background.
• NFC tag IDs that a fuel attendant’s tag sends when you confirm a bowser fill.
• Device information: a push notification token, and app version and device model for crash diagnostics.

2.5 Special personal information

Some driver records are special personal information under POPIA: police clearance certificates and traffic infringements (criminal behaviour), and medical certificates (health). Fleet operators process these to meet their legal obligations for professional drivers, such as PrDP and road-transport safety requirements, as POPIA permits. Access is limited to authorised fleet staff.

3. How we use information

• To provide the services: fleet records, trips, fuel control, maintenance, compliance tracking and the Driver app.
• To calculate safety scores, fuel-economy results and alerts from telematics and fuel data.
• To read the fields on fuel-slip photos automatically, so that drivers type less.
• To send sign-in codes, invitations, push notifications and messages between drivers and dispatch.
• To send SOS and safety alerts to the fleet’s control room.
• To manage rewards and cash-out requests that the fleet operator approves.
• To keep the services secure, prevent fraud and fuel theft, fix faults and improve the services.
• To reply to enquiries and manage our relationship with fleet customers.
• To meet our legal obligations.

We do not sell personal information. We do not use it for advertising. We do not let service providers use it for their own purposes.

Lawful grounds

We process information because it is necessary for a contract (with the fleet customer, or with you), to meet a legal obligation, for the legitimate interests of the fleet operator or DriveSmart (such as road safety and fraud prevention), or with your consent. Phone permissions such as location, camera and microphone are based on your consent. You can withdraw it at any time.

Automated scores

Safety scores and alerts are calculated automatically from telematics data. They are designed to help fleet staff, not to replace their judgement. If you disagree with a score or alert, ask your fleet operator to review it.

4. Who we share information with

• Your fleet operator. Authorised fleet staff see driver records according to the permissions their organisation gives them. Drivers see their own records.
• Service providers that process information for us under contract:
  • Supabase — database, authentication and private file storage.
  • Vercel — website and platform hosting.
  • Anthropic — reads fuel-slip images to extract receipt fields. Images are not used to train its models.
  • Expo — delivers push notifications to the Driver app.
  • Google — map display in the Android Driver app.
  • Sentry — crash diagnostics from the Driver app, where enabled. Personal details are not attached by default.
  • Email and SMS providers — send sign-in codes and invitations.
  • Runtios — runs the website contact form.
• Telematics providers chosen by the fleet operator. We receive vehicle data from them under the fleet operator’s instructions.
• Authorities and advisers when the law requires it, to protect someone’s safety, or to establish or defend legal claims.
• A buyer or successor if our business is sold or restructured, under the same protections as this policy.

Transfers outside South Africa

Some service providers store or process information outside South Africa. When this happens we rely on agreements that give protection substantially similar to POPIA, as section 72 of POPIA requires.

5. How we protect information

• All connections to the services are encrypted in transit (HTTPS/TLS).
• Each fleet’s data is separated from other fleets’ data by database access rules.
• Fleet staff access is limited by role. Changes to records are logged.
• Photos, signatures and voice notes are kept in private storage and open only to authorised users.
• The Driver app keeps sign-in credentials in the phone’s secure storage.

If a security breach affects your personal information, we notify the Information Regulator and the affected fleet operators, and we help them notify affected people, as POPIA requires.

6. How long we keep information

• Website enquiries: up to 2 years after our last contact, unless you become a customer.
• Fleet and driver records: for as long as the fleet operator uses our services, or shorter if the fleet operator deletes them. When a customer leaves, we delete or return its records within 90 days, unless the law requires us to keep them longer.
• Records the law requires: financial, fuel, tax and road-transport records may be kept for the period the law sets (for example, five years for tax records).
• On your phone: the Driver app saves submissions that are waiting to upload. They are sent when you are online. Uninstalling the app removes them from the phone.

7. Deleting your Driver app account

1. In the Driver app, open Settings & language → Request account deletion.
2. Or, without the app, follow the steps at app.drivesmartafrica.co.za/driver/delete-account, or email hello@drivesmartafrica.co.za from the email address linked to your account.

Your fleet operator verifies the request. Your sign-in account is deleted, and your name and contact details in the driver record are anonymised. Work, financial and safety records that the fleet operator must keep by law are kept for the required period and then deleted.

8. Your rights

Under POPIA you have the right to:

• ask whether we hold information about you, and get a copy of it;
• ask us to correct, update or delete information;
• object to processing based on legitimate interests;
• withdraw consent, for example by turning off a phone permission;
• not receive direct marketing you have not agreed to; and
• complain to the Information Regulator (South Africa) at inforegulator.org.za.

To use these rights, email hello@drivesmartafrica.co.za. We may ask you to confirm your identity. We reply within 30 days. Requests about driver records may be sent to your fleet operator for a decision.

9. Driver app permissions

Permission	Why the app asks
Camera	Photograph fuel slips, deliveries, faults and issues, and scan the truck’s QR code.
Photos	Attach a photo you choose. Only that photo is shared with the app.
Microphone	Record a voice note for an issue report.
Location (while using the app)	Share your position during an active trip, and with issue reports and SOS alerts.
NFC	Confirm a company bowser fill with the attendant’s tag.
Notifications	Dispatch messages and break reminders.

You can change these permissions at any time in your phone’s settings. Some features stop working without them.

10. Cookies

The platform uses only essential cookies to keep you signed in. The website does not set advertising or analytics cookies. The contact form provider may set cookies it needs to work.

11. Children

The services are for businesses and professional drivers. They are not for anyone under 18. We do not knowingly collect information from children.

12. Changes to this policy

We may update this policy. We change the date at the top when we do. If a change is significant, we tell fleet customers before the change takes effect.

13. Contact us

DriveSmart Africa
Email: hello@drivesmartafrica.co.za