KZD Solutions (Pty) Ltd

DC Drive

Driver Application

PROTECTION OF PERSONAL INFORMATION ACT (POPIA)

Privacy Notice and Policy for Drivers

Table of Contents

1. Introduction

KZD Solutions (Pty) Ltd (“KZD Solutions”, “DC Drive”, “we”, “us”, or “our”) is committed to protecting the personal information of drivers who register for, and use, the DC Drive driver mobile application (the “App”). This Privacy Notice and Policy (“Notice”) is issued in accordance with the Protection of Personal Information Act, No. 4 of 2013 (“POPIA”), and explains what personal information we collect from drivers, why we collect it, how we use, store, and protect it, and what rights drivers have in relation to their personal information.

This Notice applies to all individuals who register as, or apply to become, drivers on the DC Drive platform, and who use the App on any device. By registering for, downloading, or using the App, you acknowledge that you have read and understood this Notice, and you consent to the processing of your personal information as described herein, to the extent such consent is required by law.

2. Definitions

For the purposes of this Notice, the following terms have the meanings assigned to them below, consistent with their meanings under POPIA:

• “Personal Information” means information relating to an identifiable, living, natural person, including but not limited to a driver's name, contact details, identity number, vehicle information, banking details, and location data.
• “Processing” means any operation or activity performed on personal information, including collection, receipt, recording, organisation, storage, updating, retrieval, use, dissemination, or destruction.
• “Responsible Party” means KZD Solutions (Pty) Ltd, which determines the purpose and means of processing driver personal information collected through the App.
• “Operator” means any third party that processes personal information on behalf of KZD Solutions, such as payment processors or mapping service providers, in terms of a contract or mandate.
• “Data Subject” means the person to whom personal information relates — in this Notice, primarily a registered or prospective DC Drive driver.
• “Information Regulator” means the regulatory body established under POPIA to oversee compliance with the Act in South Africa.

3. Responsible Party Details

The Responsible Party for the processing of personal information collected through the App is:

4. Information Officer

In accordance with section 55 of POPIA, KZD Solutions has appointed Nondyebo Nojiwa, Managing Director, as its Information Officer, with Steven Kazadi appointed as Deputy Information Officer in accordance with section 56 of POPIA. The Information Officer is responsible for ensuring compliance with POPIA within the organisation, encouraging compliance with the conditions for lawful processing of personal information, dealing with requests made to KZD Solutions in terms of POPIA, and working with the Information Regulator in relation to any investigations.

Any queries, requests, or complaints relating to the processing of your personal information, or the exercise of your rights under POPIA, should be directed to the Information Officer using the contact details set out in Section 3 above, or Section 15 (How to Contact Us) below.

5. Personal Information We Collect

In order to register drivers, verify their eligibility to use the platform, facilitate rides, process payments, and provide ongoing support, KZD Solutions collects the following categories of personal information through the App:

5.1 Information You Provide Directly

• Full name, date of birth, gender, and contact details (mobile number and email address)
• Profile photograph
• Identity document or passport number, and copies of identification documents submitted for verification
• Driver's licence details and Professional Driving Permit (PDP), where applicable
• Vehicle registration details, vehicle ownership or lease documentation, and vehicle roadworthy/inspection certificates
• Banking details (bank name, account number, branch code) for the purposes of processing earnings pay-outs and wallet top-ups
• Proof of address and other supporting registration or compliance documents requested during onboarding
• Messages sent through the in-app chat or support/help ticket features

5.2 Information Collected Automatically

• Real-time and historical GPS location data while the App is in use and, where enabled, while the driver is marked “online”, for the purposes of ride matching, navigation, and trip tracking
• Ride history, including pickup and drop-off locations, distances travelled, time and duration of rides, and total hours driven
• Device information, such as device model, operating system version, unique device identifiers, and mobile network information
• App usage information, including log-in times, session activity, and diagnostic or crash data used to improve App performance
• Ratings, feedback, and performance metrics associated with completed rides

5.3 Information From Third Parties

• Verification results from third-party background screening, licence, or document verification services, where used
• Transaction confirmations and payment status information from our payment gateway provider
• Location and mapping data facilitated through our third-party mapping/location services provider

6. Purpose of Processing

KZD Solutions processes driver personal information for the following purposes:

1. To register, verify, and onboard drivers onto the DC Drive platform, including confirming identity, licensing, and vehicle eligibility;
2. To facilitate the matching of drivers with ride requests, and to enable navigation, trip tracking, and safety features during active rides;
3. To process and reconcile driver earnings, wallet balances, and pay-outs through our payment gateway;
4. To communicate with drivers regarding their account, ride requests, promotions, incentives, referral rewards, and platform updates;
5. To provide customer support, respond to queries, and resolve complaints or support tickets;
6. To monitor, maintain, and improve the safety, security, and performance of the App and the wider DC Drive platform;
7. To detect, investigate, and prevent fraud, abuse, or breaches of our driver terms and conditions;
8. To comply with applicable legal, regulatory, tax, and record-keeping obligations.

7. Lawful Basis for Processing

KZD Solutions processes driver personal information on one or more of the following lawful grounds recognised under POPIA:

• Consent: where you have given consent to the processing of your personal information for a specific purpose, such as receiving marketing communications;
• Contractual necessity: where processing is necessary to perform our agreement with you as a registered driver on the platform, including ride facilitation and payments;
• Legal obligation: where processing is necessary to comply with an obligation imposed by law, such as tax, transport regulation, or record-keeping requirements;
• Legitimate interest: where processing is necessary for KZD Solutions' legitimate business interests, such as fraud prevention and platform security, provided this does not override your rights and interests.

8. Disclosure and Sharing of Personal Information

KZD Solutions does not sell driver personal information. We may, however, share personal information with the following categories of recipients, strictly for the purposes described in this Notice:

8.1 Payment Gateway Provider

We share limited personal and payment information with our third-party payment gateway provider to process driver payments, wallet top-ups, and related transactions. Our payment gateway provider processes this information as an Operator on our behalf and is contractually required to keep it secure and to use it only for the agreed purposes.

8.2 Maps and Location Services Provider

We share real-time location data with our third-party mapping and location services provider in order to enable navigation, distance calculation, and ride tracking functionality within the App.

8.3 Other Disclosures

• To riders, limited to the information reasonably necessary to facilitate a booked trip (such as driver name, vehicle details, and live location during an active ride);
• To the South African Police Service, or an equivalent accredited screening provider, for criminal record and background verification checks conducted as part of driver onboarding;
• To SARS, credit bureaus, or other regulatory bodies, where required for financial, tax, or legal compliance;
• To cloud infrastructure and hosting providers, under data processing agreements, for operational purposes;
• To regulators, law enforcement, or other authorities, where required by law, court order, or in order to protect the rights, safety, or property of KZD Solutions, its drivers, riders, or the public;
• To professional advisors (such as auditors or legal counsel), bound by confidentiality obligations;
• In connection with a merger, acquisition, restructuring, or sale of assets involving KZD Solutions, subject to appropriate confidentiality safeguards.

9. Cross-Border Transfer of Personal Information

KZD Solutions (Pty) Ltd, the operator of DC Drive, makes use of cloud-based services and hosting platforms that may store or process personal information outside South Africa, including our payment gateway and mapping/location services providers, Google Workspace (Google LLC, United States) for email and document storage, and cloud hosting providers whose infrastructure may be located in jurisdictions such as the United States or the European Union. KZD Solutions will take reasonable steps to ensure that any such transfers are conducted in compliance with POPIA, and that recipient parties apply an equivalent level of protection to your information, as required by Section 72 of the Act.

10. Data Security

KZD Solutions implements reasonable technical and organisational measures to protect driver personal information against loss, unauthorised access, interference, modification, or disclosure, including:

• Encryption of sensitive data such as banking/payment details and identity or verification documents, both in transit and at rest, where applicable;
• Password-protected systems and devices, with role-based access controls restricting personal information access to authorised personnel on a need-to-know basis;
• Antivirus and endpoint protection software on company devices;
• Secure cloud hosting with encryption in transit and at rest;
• Secure storage of documents submitted during registration and verification;
• Regular software updates and security patching, and regular data backups to prevent loss or corruption of information;
• Regular review of our security practices and prompt action in response to any suspected security incident.

While we take reasonable steps to protect personal information, no system can guarantee absolute security. Should a data breach occur that is likely to result in a real risk of harm to affected drivers, KZD Solutions will notify the Information Regulator and affected drivers as required under POPIA.

11. Data Retention

KZD Solutions retains driver personal information only for as long as necessary to fulfil the purposes described in this Notice, or as required by applicable law, including tax, transport regulation, and financial record-keeping requirements. Where a driver's account is deactivated or a driver requests deletion of their information, KZD Solutions will delete or de-identify the relevant personal information, save to the extent that continued retention is required by law or necessary to establish, exercise, or defend a legal claim.

12. Your Rights as a Data Subject

Subject to any applicable exceptions or limitations under POPIA, drivers have the right to:

• Be notified that personal information about them is being collected, and for what purpose;
• Access the personal information that KZD Solutions holds about them;
• Request the correction, updating, or deletion of inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained personal information;
• Object, on reasonable grounds, to the processing of their personal information;
• Withdraw consent to processing at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before such withdrawal;
• Object to the processing of their personal information for purposes of direct marketing;
• Lodge a complaint with the Information Regulator regarding the alleged interference with the protection of their personal information.

To exercise any of these rights, please contact our Information Officer using the details in Section 3 or Section 15. We will respond to legitimate requests within the timeframes required by POPIA.

13. Direct Marketing

KZD Solutions will only send you direct marketing communications (such as promotions, incentives, referral programmes, or platform updates) if you have consented to receive them, in line with Section 69 of POPIA. You may opt out of direct marketing communications at any time by following the unsubscribe instructions provided in such communications, adjusting your notification preferences within the App, or contacting our Information Officer directly.

14. Children's Information

The DC Drive App and driver registration process are intended for use by individuals who are 18 years of age or older and legally eligible to hold a driver's licence and operate a vehicle for commercial purposes in South Africa. KZD Solutions does not knowingly collect personal information from minors through the App.

15. How to Contact Us

If you have any questions, requests, or complaints regarding this Notice or the processing of your personal information, please contact our Information Officer or Deputy Information Officer:

Should you be dissatisfied with our response, or wish to lodge a complaint directly, you may also contact the Information Regulator (South Africa):

16. Changes to This Notice

KZD Solutions may update this Notice from time to time to reflect changes in our processing practices, the App's functionality, or applicable law. Where changes are material, we will notify drivers through the App or by email prior to the changes taking effect. The “Effective Date” at the top of this Notice indicates when it was last revised.

17. Acknowledgement and Consent

By registering as a driver on the DC Drive platform and/or using the App, you confirm that you have read and understood this Notice, and you consent to KZD Solutions processing your personal information as described herein, to the extent such consent is required under POPIA.

This document was prepared as a template for internal review. KZD Solutions is encouraged to have this Notice reviewed by a qualified attorney familiar with South African data protection law prior to publication, to confirm its accuracy and completeness for the company's specific operations.