POPIA Compliance & Data Governance Policy

1. Statutory Commitment to POPIA

CodeWays (Pty) Ltd trading as CarWallet ("CarWallet", "we", "us", or "our") is committed to full compliance with the Protection of Personal Information Act, 2013 (Act No. 4 of 2013) ("POPIA") and the Promotion of Access to Information Act, 2000 (Act No. 2 of 2000) ("PAIA") of the Republic of South Africa.

This POPIA Compliance Policy sets out the legal basis on which we process personal and juristic person information, the strict division of statutory responsibilities between Fleet Operators/Employers ("Responsible Parties") and CarWallet ("Operator"), and how Data Subjects can exercise their statutory rights.

2. Responsible Party vs. Operator Roles (Crucial for Fleets & Employers)

Under POPIA, different legal obligations apply depending on whether CarWallet is processing your direct account registration data or processing vehicle telematics and driver logs on behalf of your business or fleet:

3. Adherence to the 8 Conditions for Lawful Processing

CarWallet enforces all eight statutory conditions prescribed in Chapter 3 of POPIA:

1. Accountability (Section 8): We have appointed an Information Officer and implemented technical and organizational controls across our Cloudflare and mobile architectures.
2. Processing Limitation & Lawful Basis (Sections 9–12): We process personal information strictly on the grounds of: (a) explicit Data Subject consent at checkout and registration; (b) necessity for the conclusion and performance of our hardware/SaaS contract with you; (c) compliance with statutory tax record-keeping obligations under Section 29 of the Tax Administration Act; and (d) protecting your legitimate interest in fleet governance and fuel cost verification.
3. Purpose Specification & 5-Year Retention (Sections 13–14): Data is collected solely for vehicle telematics, fuel management, and SARS Section 8(1)(b) logbook archiving. In accordance with Section 14(1)(a) of POPIA, synchronized tax logbook records are retained for up to 5 years to satisfy Section 29 of the Tax Administration Act, unless you exercise your right to delete them earlier.
4. Further Processing Limitation (Section 15): We never repurpose your telematics or fuel data for unrelated commercial profiling, insurance underwriting, or third-party advertising.
5. Information Quality & User Verification Duty (Section 16): We provide real-time editing tools in the mobile app and Web Dashboard so you can keep your odometer readings, trip classifications, and fuel logs accurate and complete. Because you control the input and classification of your vehicle records, you remain responsible for verifying the accuracy of your data prior to tax submission.
6. Openness (Sections 17–18): We transparently disclose all data collection practices prior to checkout and registration via this POPIA Policy, our Privacy Policy, and our Terms of Service.
7. Security Safeguards (Sections 19–22): All API transmissions use TLS 1.3 encryption, authentication relies on cryptographic Bearer tokens and 6-digit passwordless OTPs, and cloud storage is isolated within Cloudflare D1 and R2 vaults. In the event of any unauthorized data compromise (Section 22), we will notify the Information Regulator and affected Data Subjects as required by law.
8. Data Subject Participation (Sections 23–25): Data Subjects can view, export (CSV/PDF), rectify, or permanently erase their personal information and vehicle records at any time.

4. Cross-Border Cloud & AI OCR Processing Safeguards (POPIA Section 72)

To deliver ultra-low-latency synchronization, high-accuracy AI document extraction, and resilient 5-year cloud backups, CarWallet utilizes enterprise cloud infrastructure operated by Cloudflare, Inc., ephemeral vision OCR infrastructure operated by Google Cloud / Gemini Vision API, and payment infrastructure operated by Stripe, Inc., which process or replicate encrypted data across secure data centres outside the borders of the Republic of South Africa.

• Driver's Licence Cards, MVLX Discs & Fuel Receipts (Section 72 Disclosure): When you scan a South African Driver's Licence card (containing your ID number, full name, licence number, and facial photograph), an MVLX vehicle licence disc, or a petrol receipt, the image is transmitted over TLS 1.3 encryption to our cloud OCR pipeline (Google Cloud / Gemini Vision API) strictly for automated text extraction.
• Optional Vault Storage vs. Text-Only Extraction: When scanning a South African Driver's Licence card in the mobile app, you have an explicit toggle to choose whether to store the encrypted card photo in your private Cloudflare R2 vault (AES-256 encrypted at rest) or extract the text fields only (in which case the raw photo is discarded immediately after OCR text extraction).
• Printed-Text OCR Only (Zero NaTIS Barcode Decryption): CarWallet exclusively performs Optical Character Recognition (OCR) on the human-readable printed text on the face of your licence card and vehicle licence disc. CarWallet never decrypts or accesses the encrypted PDF417 barcode on the reverse of South African driver's licence cards.

In strict compliance with Section 72(1) of POPIA, we ensure that any cross-border transfer of personal information only occurs where: (a) the third-party cloud processor is bound by binding corporate rules, standard contractual clauses (SCCs), and internationally recognized data protection frameworks (such as GDPR / ISO 27001 / SOC 2 Type II) that provide an adequate level of protection substantially similar to POPIA; (b) the transfer is necessary for the performance of the contract and features requested by you; and (c) you explicitly consent to such processing upon registration, checkout, or initiating a scan.

5. How to Exercise Your POPIA Rights & Regulatory Contact Details

As a Data Subject under POPIA, you have the right to:

• Object to Processing (POPIA Form 1): Object, on reasonable grounds, to the processing of your personal information in terms of Section 11(3)(a) of POPIA.
• Request Correction or Deletion (POPIA Form 2): Request the correction or permanent deletion of personal information that is inaccurate, irrelevant, excessive, out of date, or incomplete in terms of Section 24 of POPIA.
• Withdraw Consent: Withdraw your consent to optional communications or cancel your telematics subscription at any time.