Privacy Policy

Skootlink (Pty) Ltd
Last Updated: 16 June 2026

1. INTRODUCTION

1.1 Skootlink (Pty) Ltd ("Skootlink," "we," "us," or "our"), a company registered in the Republic of South Africa with registration number K2026386113, is committed to protecting your privacy and ensuring that your personal information is processed in a lawful, transparent, and secure manner.

1.2 This Privacy Policy explains how we collect, use, disclose, store, and protect your personal information when you access or use the Skootlink mobile application, website, and associated services (collectively, the "Platform"). It also describes your rights regarding your personal information and how you can exercise them.

1.3 Skootlink is a "responsible party" as defined in the Protection of Personal Information Act 4 of 2013 ("POPIA"). We determine the purpose and means of processing personal information collected through the Platform. Where we use third-party service providers to process personal information on our behalf, those providers act as our "operators."

1.4 By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any provision of this Privacy Policy, you must not use the Platform.

2. SCOPE OF THIS POLICY

2.1 This Privacy Policy applies to:

• (a) All users of the Platform, including both "Drivers" (users seeking to rent vehicles or provide delivery services) and "Owners" (users listing vehicles for rent);
• (b) Visitors to our website who do not register an account;
• (c) Any other individual whose personal information we may process in the course of operating the Platform.

2.2 This Privacy Policy does not apply to:

• (a) Personal information processed by other users of the Platform (e.g., information shared between Drivers and Owners). Skootlink is not responsible for how users process each other's personal information outside the Platform;
• (b) Third-party websites, applications, or services that may be linked to or accessible through the Platform, which are governed by their own privacy policies.

3. DEFINITIONS

3.1 In this Privacy Policy, the following terms shall have the meanings given to them in POPIA, unless the context indicates otherwise:

• "Personal Information" means any information relating to an identifiable, living natural person or juristic person, including but not limited to contact details, identity numbers, financial information, and location data.
• "Processing" means any operation or activity concerning personal information, including collection, receipt, recording, organisation, storage, updating, modification, retrieval, consultation, use, dissemination, distribution, merging, linking, blocking, degradation, erasure, or destruction.
• "Data Subject" means the person to whom personal information relates.
• "Information Officer" means the person designated by Skootlink to be responsible for compliance with POPIA.
• "Special Personal Information" means personal information concerning a person's religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health, sex life, biometric information, or criminal behaviour.

4. INFORMATION WE COLLECT

4.1 Skootlink collects personal information that you voluntarily provide to us, information automatically collected through your use of the Platform, and information obtained from third-party sources. We only collect personal information that is adequate, relevant, and not excessive for the purposes for which it is processed.

4.2 Personal Information You Provide to Us

(a) Account and Registration Data
When you create an account on the Platform, we collect:

• Full name
• Email address
• Password (encrypted)
• Account type (Driver or Owner)
• Mobile phone number

(b) Identity Verification Data
When you subscribe and undergo identity verification through our third-party verification provider, we collect and transmit the following for processing:

• South African ID number or passport number (for foreign nationals)
• A photograph or scan of your identity document or passport
• For Drivers: A photograph or scan of your driver's licence
• Facial biometric data (where consent is provided for selfie matching)
• Date of birth
• Nationality

(c) Vehicle Listing Data (Owners)
When you list a vehicle on the Platform, we collect:

• Vehicle make, model, year, and registration number
• Vehicle identification number (VIN)
• Vehicle photographs
• Rental rates and availability dates
• Vehicle location
• Insurance details

(d) Communications Data
When you communicate with us (via email, in-app chat, telephone, or social media), communicate with other users through the Platform, participate in user research or surveys, or submit a complaint or support request, we collect the content of your communication, the date and time, and any attachments or information you choose to provide.

4.3 Information Automatically Collected

(a) Usage Data
We collect information about your interactions with the Platform, including pages or screens viewed, searches conducted, listings created or viewed, bookings made, login history, time spent on pages or screens, navigation paths, and the date and time of your visits.

(b) Device and Technical Data
We collect information about the device you use to access the Platform, including device type, operating system and version, unique device identifiers (such as IDFA or AAID), mobile network information, browser type and version, IP address, and, where you grant permission, approximate or precise location data.

(c) Location Data
With your consent, we may collect precise geolocation data from your mobile device to enable features such as searching for nearby vehicles or tracking vehicle location during an active rental. You may withdraw this consent at any time through your device settings or the Platform's privacy controls.

(d) Cookies and Similar Technologies
We use cookies and similar tracking technologies (such as pixels, web beacons, and local storage) to enhance your experience on the Platform. Cookies are small data files placed on your device. We use:

• Essential Cookies — Necessary for the Platform to function (e.g., maintaining your login session).
• Performance Cookies — To analyse how users interact with the Platform and improve its performance.
• Functional Cookies — To remember your preferences and personalise your experience.
• Analytics Cookies — To understand usage patterns and optimise the Platform.

You can manage cookie preferences through your browser settings. Please see our Cookies Policy for detailed information on the specific cookies we use.

4.4 Information from Third-Party Sources
We may receive personal information about you from:

• Verification Providers: Confirmation of identity verification status and, where applicable, driving licence validity from Verifynow.
• Payment Processors: Confirmation of payment transactions from Payfast.
• Other Users: Information provided by other users in connection with a transaction, complaint, or review.
• Publicly Available Sources: Information from public registers or databases, where lawful and necessary.

5. LAWFUL BASES FOR PROCESSING YOUR PERSONAL INFORMATION

5.1 In accordance with POPIA, we process your personal information only where one or more of the following lawful bases apply:

• (a) Your Consent: You have given us explicit, informed consent to process your personal information for a specific purpose (e.g., processing sensitive biometric data for identity verification, sending direct marketing communications, or collecting precise geolocation data).
• (b) Contractual Necessity: The processing is necessary for the performance of a contract to which you are a party (i.e., our Terms of Service), or to take steps at your request prior to entering into a contract.
• (c) Legal Obligation: The processing is necessary for compliance with a legal obligation to which Skootlink is subject (e.g., tax laws, anti-money laundering regulations, or responding to lawful requests from regulatory authorities).
• (d) Legitimate Interests: The processing is necessary for the purposes of Skootlink's legitimate interests or those of a third party, except where such interests are overridden by your interests or fundamental rights and freedoms (e.g., monitoring and improving Platform security, detecting and preventing fraud, and analysing aggregated usage trends).
• (e) Protection of Legitimate Interests: The processing is necessary to protect a legitimate interest of yours.

5.2 Where we rely on consent as the lawful basis for processing, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal. To withdraw consent, please contact us using the details provided in clause 13.

6. PURPOSES FOR WHICH WE PROCESS YOUR PERSONAL INFORMATION

6.1 We process your personal information for the following specific purposes:

Purpose	Categories of Personal Information Processed	Lawful Basis
Account creation and management	Name, email, password, account type, phone number	Contractual necessity
Identity verification and driver's licence validation	ID/passport number, identity document scan, driver's licence scan, facial biometric data, date of birth	Consent
Facilitating connections between Drivers and Owners	Name, verification status, vehicle listing details, location data, contact details (shared only upon booking confirmation)	Contractual necessity
Communicating with you about your account, transactions, and Platform updates	Name, email, phone number, account type, transaction details	Contractual necessity; Legitimate interests
Sending marketing and promotional communications (with your prior consent)	Name, email, phone number, account type, usage data	Consent
Improving and personalising the Platform experience	Usage data, device data, location data, preferences	Legitimate interests; Consent (for location data)
Detecting and preventing fraud, abuse, and unauthorised activity	All categories as reasonably necessary	Legitimate interests; Legal obligation
Complying with legal obligations, law enforcement requests, and regulatory requirements	All categories as required by applicable law	Legal obligation
Resolving disputes between users or between users and Skootlink	Account data, transaction data, communications data, verification data	Legitimate interests

6.2 We will not process your personal information for any purpose incompatible with the purposes stated above without obtaining your prior consent.

7. DISCLOSURE OF YOUR PERSONAL INFORMATION

7.1 Skootlink does not sell, rent, or trade your personal information to third parties for their own marketing purposes. We may disclose your personal information to the following categories of recipients, only to the extent necessary for the purposes described in this Privacy Policy:

• (a) Service Providers and Operators: Third-party providers who perform services on our behalf, including:
  • VerifyNow — for identity and driver's licence verification;
  • Payfast — for payment processing;
  • Brevo (Sendinblue) — for email delivery and transactional communications;
  • BulkSMS — for SMS notifications;
  • Supabase — for data hosting and storage.
  We have written contracts in place with all operators who process personal information on our behalf. These contracts require operators to process personal information only in accordance with our instructions, to implement appropriate security measures, and to comply with POPIA.
• (b) Other Platform Users: When a Driver and Owner agree to a rental transaction, we disclose certain personal information to each party to facilitate the transaction, including the names and contact details of each party. Where GPS tracking devices are used (whether smartphone-based or hardware-based), location data is shared between the relevant Driver and Owner during an active rental.
• (c) Legal and Regulatory Authorities: We may disclose personal information to law enforcement agencies, courts, regulators (including the Information Regulator of South Africa), or other governmental authorities where we are required to do so by law, or where we reasonably believe that such disclosure is necessary to protect our rights, your safety, or the safety of others.
• (d) Business Transfers: In the event that Skootlink is involved in a merger, acquisition, reorganisation, or sale of all or a portion of its assets, your personal information may be transferred as part of that transaction. You will be notified via email and/or a prominent notice on the Platform of any change in ownership or use of your personal information.

8. CROSS-BORDER TRANSFERS OF PERSONAL INFORMATION

8.1 Some of our service providers may be located outside the Republic of South Africa, or may process personal information on servers located outside South Africa. Where we transfer your personal information to a third party in a foreign country, we will ensure that:

• (a) The recipient is subject to a law, binding corporate rules, or a binding agreement that provides an adequate level of protection for your personal information, as determined by the Information Regulator; or
• (b) You have consented to the transfer; or
• (c) The transfer is necessary for the performance of a contract between you and Skootlink, or for the implementation of pre-contractual measures taken in response to your request; or
• (d) The transfer is necessary for the conclusion or performance of a contract concluded in your interest between Skootlink and a third party.

8.2 You acknowledge that our payment processor, Payfast, may process your payment information and, where necessary, transfer personal data outside your country to other Payfast entities or third-party service providers as part of providing its services. Payfast is POPIA compliant and maintains appropriate security measures. Further information about Payfast’s data protection practices can be found in Payfast’s own privacy policy at https://www.payfast.co.za/privacy-policy/.

9. DATA SECURITY

9.1 Skootlink takes the security of your personal information seriously and implements reasonable and appropriate technical and organisational measures to protect your personal information from unauthorised access, accidental or unlawful destruction, loss, alteration, or disclosure. These measures include, but are not limited to:

• (a) Encryption: All personal information transmitted between your device and our servers is encrypted using Transport Layer Security (TLS) technology. Passwords are hashed and never stored in plain text. Payment card data is encrypted by Payfast and is not accessible to Skootlink.
• (b) Access Controls: Access to personal information is restricted to authorised employees, contractors, and service providers who have a legitimate business need to access it. Access rights are reviewed periodically and revoked when no longer required.
• (c) Data Minimisation: We only collect and retain personal information that is necessary for the purposes for which it is processed.
• (d) Regular Security Assessments: We conduct periodic security reviews and vulnerability assessments of our systems and processes.
• (e) Incident Response: We maintain an incident response plan to address data security incidents promptly and effectively.

9.2 Despite our security measures, no method of transmission over the Internet or electronic storage is entirely secure. While we strive to protect your personal information, we cannot guarantee its absolute security. In the unfortunate event of a data breach involving your personal information, we will notify you and the Information Regulator as required by POPIA and the 2025 POPIA Regulations.

10. DATA RETENTION

10.1 We retain your personal information only for as long as is necessary to fulfil the purposes for which it was collected, or as required or permitted by applicable law.

10.2 The following retention periods apply, unless a longer retention period is required by law:

Category of Personal Information	Retention Period
Account and profile data	Duration of account plus 5 years after account closure (for legal and tax compliance)
Identity verification data	Duration of account plus 5 years after account closure
Communications data	3 years after the relevant communication or until the resolution of any related dispute
Vehicle listing data	Duration of listing plus 5 years after removal
Marketing consent records	Duration of consent plus 3 years after withdrawal
Usage data and analytics	3 years from date of collection (in aggregated or anonymised form where possible)

10.3 Where personal information is retained beyond the periods stated above, it will be anonymised so that it can no longer be associated with an identifiable data subject.

10.4 Upon expiry of the applicable retention period, personal information is securely destroyed or deleted in accordance with our data destruction protocols.

11. YOUR RIGHTS UNDER POPIA

11.1 POPIA grants you certain rights regarding your personal information. Skootlink is committed to honouring these rights. You have the right to:

• (a) Access: Request confirmation of whether we hold personal information about you, and to request a copy or description of such personal information. You may access and update certain personal information directly through your account settings.
• (b) Correction or Deletion: Request that we correct, update, or delete your personal information if it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully. In accordance with the 2025 POPIA Regulations, you may make this request through various channels, including email, at no cost to you. We will notify you of the action taken as a result of your request.
• (c) Objection: Object to the processing of your personal information, at no cost to you, where such processing is based on our legitimate interests, is for direct marketing purposes, or is otherwise not in compliance with POPIA. In accordance with the 2025 POPIA Regulations, objections may be submitted through various convenient channels, including email and WhatsApp. We must clearly communicate to you your right to object.
• (d) Withdraw Consent: Withdraw consent previously given for the processing of your personal information, including consent for direct marketing, biometric data processing, and location data collection. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.
• (e) Complaints: Lodge a complaint with the Information Regulator of South Africa if you believe that we have interfered with the protection of your personal information. Under the 2025 POPIA Regulations, complaints may be submitted online, by email, or in person, and in your preferred language where reasonably possible. Your identity may be kept confidential in sensitive cases.

11.2 To exercise any of these rights, please contact our Information Officer using the contact details set out in clause 13. We will respond to your request within a reasonable time and in accordance with POPIA. We may request proof of identity to verify your request.

11.3 The Information Regulator's contact details are:

12. DIRECT MARKETING

12.1 Skootlink will only send you direct marketing communications (including promotional emails, SMS messages, or in-app notifications) if you have given your prior, explicit, written consent to receive such communications. In accordance with the 2025 POPIA Regulations, this consent must be obtained clearly and simply, at no cost to you, and properly recorded. Opt-out mechanisms do not constitute valid consent.

12.2 You may withdraw your consent to receive direct marketing at any time, free of charge, by clicking the "unsubscribe" link in any marketing email, adjusting your notification preferences in the Platform settings, or contacting us using the details provided in clause 13.

12.3 Transactional communications (such as booking confirmations, payment receipts, security alerts, and account-related notices) are not direct marketing and will be sent to you as necessary for the performance of our contract with you.

13. INFORMATION OFFICER AND CONTACT DETAILS

13.1 Skootlink's Information Officer is responsible for overseeing compliance with POPIA and handling inquiries and requests related to this Privacy Policy.

13.2 For any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact us:

13.3 In accordance with section 55(2) of POPIA, our Information Officer is registered with the Information Regulator of South Africa. Our registration details are available upon request.

14. CHILDREN'S PRIVACY

14.1 The Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal information from a person under the age of 18, we will take prompt steps to delete such information. If you believe that we may have collected personal information from a child, please contact us immediately using the details provided in clause 13.

15. CHANGES TO THIS PRIVACY POLICY

15.1 Skootlink reserves the right to update or modify this Privacy Policy at any time to reflect changes in our practices, the Platform, or applicable law. When we make material changes, we will notify you by email (sent to the email address associated with your account), by a prominent notice on the Platform prior to the change becoming effective, and by updating the "Last Updated" date at the top of this Privacy Policy.

15.2 Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the revised Privacy Policy. If you do not agree with any changes, you must discontinue use of the Platform.

16. RELATED POLICIES AND NOTICES

16.1 This Privacy Policy should be read in conjunction with:

• Our Terms of Service, which govern your use of the Platform;
• Our Cookies Policy, which explains how we use cookies and similar technologies;
• Our PAIA Manual, which is available on request and describes how to access records held by Skootlink in accordance with the Promotion of Access to Information Act 2 of 2000.

17. ACKNOWLEDGEMENT

17.1 By using the Skootlink Platform, you acknowledge that you have read, understood, and agree to the terms of this Privacy Policy. You consent to the collection, use, disclosure, and processing of your personal information as described herein. If you do not agree with any provision of this Privacy Policy, please do not use the Platform.

© Skootlink (Pty) Ltd 2026. All rights reserved.