# Privacy Policy — Zola Driving
**Effective date: 17 August 2026**
This privacy policy applies to the Zola Driving mobile application and any related
services operated by Zola ("the Service Provider", "we", "us"). Zola Driving
is a navigation and passenger-management application for taxi drivers operating in
South Africa.
Zola is the **responsible party** for the processing of your personal
information as defined in the Protection of Personal Information Act 4 of 2013
("POPIA"). This policy describes how we process personal information in accordance
with POPIA.
By using the Application you agree to the collection and use of information as
described in this policy.
---
## Information we collect
### Information you provide
When you create an account and complete your driver profile, we collect:
* First name and last name
* Email address
* Phone number
* Vehicle registration number
* Vehicle make
### Location information
**The Application collects precise location data, including while the app is
running in the background.**
Location collection is essential to the core function of the Application. Zola
Driving is a driver navigation tool: it cannot show your position on the map,
identify passengers along your route, detect your arrival at a pickup point, or
share your position with passengers who have requested a ride without continuous
access to your device's location.
* **Foreground collection.** While the app is open, your device's GPS position is
read continuously and used to position you on the map, calculate your route,
and measure your distance from waiting passengers.
* **Background collection.** When you begin a trip and then switch to another app
(for example Google Maps for turn-by-turn directions) or move the Application to
the background, location collection continues via an Android foreground service.
A persistent notification is displayed while this is active. Background
collection stops when you end the trip.
* **Storage.** Your most recent coordinates are stored in our database so that
passengers assigned to you can see your approach in real time. Coordinates are
overwritten as you move and are cleared when you go off duty.
You may revoke location permission at any time through your device settings.
Doing so will prevent the Application from functioning.
### Trip and messaging information
* Trip records, including pickup locations, destinations and the passengers
assigned to each trip
* Saved preferred routes and waypoints
* Messages exchanged between you and passengers through the in-app chat
* On-duty status and activity timestamps
### Automatically collected information
* Device Internet Protocol (IP) address
* Mobile operating system and device type
* Dates, times and duration of app usage
* Diagnostic and crash information
---
## How we use your information
We use the information described above to:
* Position you on the map and calculate routes
* Identify and display passengers travelling along your route
* Detect your arrival at a passenger's pickup location
* Share your live position with passengers who have been assigned to you
* Enable messaging between you and your passengers
* Maintain your driver profile and trip history
* Operate, maintain, secure and improve the Application
* Send you notifications relevant to your trips
* Comply with legal obligations
---
## How your information is shared
### With passengers
When a passenger is assigned to you, your live location is shared with that
passenger so they can see your approach. Your first name and last name are also
visible to them. Correspondingly, assigned passengers' names and live locations
are shared with you so you can locate them for pickup.
### With service providers
The Application relies on the following third-party services, each of which
processes data on our behalf under its own privacy policy:
| Service | Purpose | Privacy policy |
|---|---|---|
| Supabase | Database and real-time data delivery. Stores driver profiles, passenger assignments, location coordinates, trip records and chat messages. | https://supabase.com/privacy |
| Clerk | Account authentication and identity management | https://clerk.com/privacy |
| Google Maps Platform | Map rendering and route calculation. Coordinates are sent to Google to generate directions. | https://policies.google.com/privacy |
| Google Play Services | App distribution and device services | https://policies.google.com/privacy |
| Expo | Application build, delivery and push notification infrastructure | https://expo.dev/privacy |
We do not sell your personal information, and we do not share it with third
parties for advertising purposes.
### For legal reasons
We may disclose your information where we believe in good faith that disclosure
is necessary to comply with a legal obligation, court order or lawful government
request; to protect our rights or property; to investigate fraud; or to protect
the safety of any person.
---
## Cross-border transfers
The Application is operated from South Africa, but our service providers store and
process personal information on servers located outside South Africa.
Section 72 of POPIA permits such transfers where the recipient is subject to a law
or binding agreement providing an adequate level of protection. We rely on the
contractual data-processing terms of each service provider listed above, which
require them to protect personal information on substantially the same terms as
this policy and to process it only on our instructions.
Data protection laws in the countries where our providers operate may differ from
South African law.
---
## Data retention
* **Profile information** is retained for as long as your account remains active,
and for 12 months after account closure unless a longer period is required by law.
* **Location coordinates** are transient. Your current position is overwritten as
you move and cleared when you go off duty.
* **Trip records** are retained for 24 months to support dispute resolution and
service improvement.
* **Chat messages** are deleted when the associated trip ends.
* **Diagnostic data** is retained for up to 24 months.
* **Aggregated or anonymised data** that no longer identifies you may be retained
indefinitely.
---
## Your rights under POPIA
As a data subject you have the right to:
* Be notified that your personal information is being collected
* Request confirmation of whether we hold personal information about you, and to
request a record or description of that information
* Request correction or deletion of personal information that is inaccurate,
irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully
* Object to the processing of your personal information on reasonable grounds
* Withdraw consent where processing is based on consent, without affecting
processing already carried out
* Not have your personal information processed for direct marketing by means of
unsolicited electronic communications except as permitted by POPIA
* Lodge a complaint with the Information Regulator
* Institute civil proceedings regarding an alleged interference with your personal
information
To exercise any of these rights, email **veekash708@gmail.com**. We will respond
within a reasonable period. We may need to verify your identity before acting on a
request.
Uninstalling the Application stops further collection from your device, but does
not by itself delete data already transmitted to us. To have that data deleted,
contact us at the address above.
### Complaints to the Information Regulator
If you are not satisfied with how we have handled your personal information or your
request, you may lodge a complaint with:
**Information Regulator (South Africa)**
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Email: complaints.IR@inforegulator.org.za
Website: https://inforegulator.org.za
---
## Security
We apply physical, electronic and procedural safeguards to protect the
information we process. Authentication is handled by Clerk, and data is
transmitted over encrypted connections. No method of transmission or storage is
completely secure, and we cannot guarantee absolute security.
---
## Data breach notification
If a breach affecting your personal data occurs, we will notify you in accordance
with applicable legal requirements, including, where required, the nature of the
breach and the steps taken to address it.
---
## Children
The Application is intended for licensed taxi drivers and is not directed at
children. POPIA prohibits the processing of the personal information of children
without the consent of a competent person. We do not knowingly collect personal
information from anyone under 18. If we discover that we have collected such
information, we will delete it. If you are a parent or guardian who believes a
child has provided us with personal information, contact us at
**veekash708@gmail.com**.
---
## Changes to this policy
We may update this policy from time to time. Material changes will be posted here
with a revised effective date, and where required by law we will seek your consent
before they take effect. Previous versions are available on request.
---
## Contact
Questions about this policy, our privacy practices, or to exercise your rights
under POPIA:
**Zola** — Responsible Party
Information Officer: Veekash Singh
Email: veekash708@gmail.com
South Africa