Privacy Policy

Rocket Van Express (Pty) Ltd ("we", "us", "our") is committed to protecting your personal information and your right to privacy in accordance with South African law. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our delivery and mini-move services. It is drafted in compliance with: - The Protection of Personal Information Act, 2013 (Act No. 4 of 2013) ("POPIA") - The Promotion of Access to Information Act, 2000 (Act No. 2 of 2000) ("PAIA") - The Electronic Communications and Transactions Act, 2002 (Act No. 25 of 2002) ("ECTA") By using our services, you acknowledge that you have read, understood, and consent to the data practices described in this policy. You may withdraw your consent at any time by contacting our Information Officer.

In terms of POPIA, the Responsible Party for the processing of your personal information is: Rocket Van Express (Pty) Ltd Western Cape, South Africa Email: Info@rocketvan.co.za Phone: +27 736596239

We collect and process only the minimum personal information necessary to provide our services (data minimisation principle under POPIA Section 10). Personal Information You Provide: - Full name and contact details (phone number, email address, WhatsApp number) - Pickup and delivery addresses - Payment information (billing details, banking information) - Business information (for business accounts: company name, registration details, tax number) - Communication records (WhatsApp messages, emails, phone calls) - Photos of items for quote purposes (if provided) - Proof-of-delivery photos and signatures Information Automatically Collected: - Website usage data (IP address, browser type, device information) - Booking timestamps and service history - Location data (for route optimisation and driver dispatch) - Transaction history and payment records - Cookie data (see our Cookie Policy for details) Special Personal Information: We do not intentionally collect any special personal information as defined in Section 26 of POPIA (e.g., religious beliefs, race, trade union membership, health information, biometric data). Should we inadvertently receive such information, it will be deleted immediately.

We use your personal information strictly for the following purposes: - Process and fulfill your delivery and mini-move bookings - Communicate booking confirmations, updates, and delivery notifications via WhatsApp - Generate quotes and invoices - Process payments and maintain billing records - Provide customer support and respond to inquiries - Send proof-of-delivery confirmations - Improve our services through anonymised data analysis - Comply with legal obligations and resolve disputes - Send promotional offers and service updates (only with your explicit opt-in consent) - Maintain business account relationships and consolidated reporting - Detect and prevent fraud or unlawful activity We will not process your personal information for any purpose incompatible with the above unless we obtain your further consent or are required to do so by law.

We process your personal information based on one or more of the following lawful grounds: - Consent (Section 11(1)(a)): You have given explicit, informed, and voluntary consent for specific purposes - Contractual necessity (Section 11(1)(b)): Processing is necessary to perform our service agreement with you - Legal obligation (Section 11(1)(c)): We are required by law to process certain information (e.g., tax legislation, consumer protection laws) - Legitimate interests (Section 11(1)(f)): Processing is necessary for our legitimate business operations, provided it does not prejudice your rights and freedoms Processing Limitation: In accordance with POPIA Section 10, we only process personal information that is adequate, relevant, and not excessive for the stated purposes.

We may share your information with the following categories of recipients, each bound by confidentiality obligations: Service Delivery: - Our drivers and dispatch team (name, contact details, addresses — limited to what is necessary) - Payment processors (for transaction processing only) Business Operations: - Accounting and invoicing services - IT service providers and hosting platforms - Customer support tools Legal Requirements: - Law enforcement or government agencies when required by law or court order - The Information Regulator, if requested - Legal proceedings or to protect our rights and safety We do NOT: - Sell your personal information to third parties - Share your data for third-party marketing purposes without your consent - Transfer data outside the Republic of South Africa without ensuring adequate safeguards as required by POPIA Section 72 (including binding corporate rules, contractual obligations, or the recipient being subject to equivalent privacy laws)

We implement appropriate technical and organisational security measures to protect your personal information against loss, unauthorised access, alteration, or destruction: - Encrypted data transmission (HTTPS/TLS) - Secure payment processing (PCI-compliant providers) - Access controls and authentication (role-based access) - Regular security assessments and vulnerability testing - Staff training on data protection and POPIA obligations - Incident response procedures In the event of a data breach that poses a risk to you, we will notify the Information Regulator and affected data subjects as soon as reasonably possible, in accordance with POPIA Section 22. No method of transmission over the internet is 100% secure. While we take every reasonable step to protect your information, we cannot guarantee absolute security.

We retain your personal information only for as long as is necessary to fulfill the purposes for which it was collected, or as required by law. Retention periods: - Active customer data: Duration of the relationship + 1 year - Transaction records: 5 years (as required by the Tax Administration Act and Companies Act) - Communication records: 2 years - Marketing consent records: Until you withdraw consent + 30 days - Proof-of-delivery records: 3 years After the applicable retention period expires, personal information is securely deleted or de-identified so that it can no longer be associated with you. Destruction of records is carried out in accordance with POPIA Section 14(4).

Under POPIA, you have the following rights regarding your personal information: - Right to be informed (Section 18): Know what personal information we hold and how we use it - Right of access (Section 23): Request a copy of your personal information we hold - Right to correction (Section 24): Request that inaccurate, irrelevant, excessive, out-of-date, incomplete, or misleading information be corrected or deleted - Right to deletion (Section 24): Request deletion of your personal information where it is no longer necessary (subject to legal retention requirements) - Right to object (Section 11(3)(a)): Object to the processing of your personal information for direct marketing purposes - Right to restrict processing: Request that we limit how we use your data in certain circumstances - Right to withdraw consent: Withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal - Right to submit a complaint: Lodge a complaint with the Information Regulator if you believe your rights have been infringed To exercise any of these rights, contact our Information Officer: Email: privacy@rocketvan.co.za Phone: +27 736596239 WhatsApp: +27 736596239 We will acknowledge your request within 5 business days and respond substantively within 30 days, as required by POPIA. We may request proof of identity before processing your request to protect your information from unauthorised access.

In accordance with POPIA Section 69 and the Consumer Protection Act: With your explicit opt-in consent, we may send: - Promotional offers and special deals - Service updates and new features - Tips and helpful content - Business account updates and reports You may opt out at any time by: - Replying "STOP" to marketing WhatsApp messages - Clicking "unsubscribe" in marketing emails - Contacting us directly to update your preferences Once you opt out, we will cease direct marketing communications within 5 business days. Note: You cannot opt out of essential transactional communications (booking confirmations, delivery updates, invoices) as these are necessary for service delivery.

Our website uses cookies and similar technologies. For full details on the types of cookies we use, how to manage them, and your choices, please refer to our separate Cookie Policy. In summary: - Essential cookies (required for website operation) — cannot be disabled - Analytics cookies (Google Analytics — anonymised data) — optional - Marketing cookies (advertising and remarketing) — optional - Preference cookies (remember your settings) — optional You can manage your cookie preferences at any time through the cookie settings on our website or through your browser settings.

Our website may contain links to third-party websites and services (e.g., Google Maps, payment gateways, social media platforms). We are not responsible for the privacy practices of these external sites. We encourage you to review their respective privacy policies before providing any personal information.

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children as defined in POPIA. If we become aware that we have collected data from a child without the consent of a competent person (parent or guardian), we will take steps to delete it immediately in accordance with POPIA Section 35.

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on you without human intervention. Any automated processes (such as route optimisation or pricing estimates) are used solely as aids to our team and do not constitute binding decisions.

We may update this Privacy Policy from time to time to reflect: - Changes in our data processing practices - Legal or regulatory requirements - New service features or business operations Changes will be posted on this page with an updated "Last Updated" date. Material changes will be communicated directly to active customers via email or WhatsApp at least 14 days before they take effect. Continued use of our services after the effective date of changes constitutes acceptance of the updated policy. If you do not agree with the changes, you may discontinue use of our services and request deletion of your data.

In terms of POPIA, our designated Information Officer is responsible for ensuring compliance with data protection legislation and handling all data subject requests. Information Officer Contact Details: Email: privacy@rocketvan.co.za General Enquiries: Info@rocketvan.co.za Phone: +27 736596239 Contact the Information Officer for: - POPIA and PAIA-related enquiries - Data subject access, correction, or deletion requests - Privacy concerns or complaints - Reporting a suspected data breach PAIA Manual: A copy of our PAIA manual (as required by Section 51 of PAIA) is available upon request by emailing privacy@rocketvan.co.za.

If you are unsatisfied with our response to a data protection concern, or believe your privacy rights have been violated, you may: 1. Contact us directly: Email: privacy@rocketvan.co.za WhatsApp: +27 736596239 We will investigate and provide a substantive response within 30 days. 2. Lodge a complaint with the Information Regulator (South Africa): Physical address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 Postal address: P.O. Box 31533, Braamfontein, Johannesburg, 2017 Complaints email: complaints.IR@justice.gov.za General enquiries: inforeg@justice.gov.za Phone: +27 (0)10 023 5207 Website: https://inforegulator.org.za