1. Introduction

Welcome to Zorq. We value your privacy and are committed to protecting your personal information. This Privacy Policy explains how Zorq Technologies (Pty) Ltd ("Zorq," "we," "us") collects, uses, stores, and safeguards your personal information when you use our platform, mobile application, and related services (together, the "Platform").

As the responsible party under the Protection of Personal Information Act 4 of 2013 (“POPIA”), Zorq is accountable for the collection, use, and protection of personal information in our possession. This policy also explains the rights you have under POPIA and the Promotion of Access to Information Act 2 of 2000 (“PAIA”) and how you can exercise them.

Zorq is a platform that connects individuals and businesses with independent drivers for transportation, furniture removal, and delivery services. By using the Platform, you acknowledge and consent to the practices described in this Privacy Policy.

If you have questions or concerns about this Privacy Policy, or wish to exercise any of your rights, please contact us using the details in Section 12.

2. Information We Collect

When you use Zorq, we may collect the following types of information to provide and improve our services:

2.1 Personal Information

Name and Contact Details: such as your first and last name, phone number, and email address.
Profile Information: including your profile photo and account details.
Identity Information: where you sign in using a third-party provider (such as Google), we may receive basic profile information you authorise that provider to share with us, including your name, email address, and profile photo.
Payment Information: such as payment method, billing details, and transaction history. We do not store card numbers directly; payments are initiated, processed, and the card details are stored by PCI-DSS-compliant third-party payment providers (such as Paystack), who provide us only with payment tokens, statuses, and transaction records we need to operate the Platform.

2.2 Location Information

Real-Time Location: we collect location data from drivers during active searching or an active trip to enable accurate pickups, navigation, trip matching, and real-time trip tracking for customers.
Approximate or Pickup/Drop-off Location: from customers, to help identify nearby drivers, calculate pricing, and arrange pickups. Your precise location is only used where necessary to provide the requested service.

2.3 Usage Information

App Activity: interactions within the app, including bookings, cancellations, messages, and support enquiries.
Device Information: such as device type, operating system, app version, and unique device identifiers.
Log Data: IP address, time of access, and error logs, used to improve performance and security.

2.4 Optional Information

Feedback and Reviews: ratings, comments, or support inquiries submitted through the app.
Referral Information: if you arrive through a partner or referral link, we store a secure, signed referral token so that the booking can be attributed to the relevant partner, in accordance with Zorq’s Partner Program Terms.

2.5 Device Permissions

Depending on your device platform, the app may request access to certain features. These permissions are strictly required for the operational functionality of the app:

Precise Location: Required to identify driver availability for incoming booking requests, allow customers to track their booked driver in real-time on the map, and provide turn-by-turn navigation during the trip. Driver location is only utilized when the app is in active use/searching or during an active trip.
Camera Access: Used exclusively during the driver onboarding and profile management process, so that drivers can photograph their documents (e.g., driver's license, ID/Passport, vehicle photos) for verification purposes.
Photo Library (Media/Files): Used exclusively during the driver onboarding and profile management process, so that drivers can select and upload existing photos of their required documents from their device gallery for verification.
Notifications: Essential for real-time operational communication, including alerts for new booking requests, job status updates, and critical system notifications regarding the driver's account.

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 To Provide and Improve Our Services

Trip Matching and Fulfillment: to connect customers with available drivers, determine appropriate vehicle types, and calculate upfront pricing.
Navigation and Routing: to provide drivers with directions and ensure accurate pickup and drop-off locations.
Booking Management: to process bookings, update trip statuses, and send notifications about trip progress.

3.2 For Safety and Security

Identity Verification: to verify drivers, vehicles, and customer accounts to maintain trust and safety.
Fraud Prevention: to monitor, detect, and prevent fraudulent or unauthorized activity, including fraudulently obtained referrals, discounts, or refunds.
Emergency Assistance: to share location or contact details with emergency contacts or relevant authorities in urgent situations.

3.3 For Payments and Transactions

Payment Processing: to facilitate payments and pre-authorisations between customers and drivers through secure third-party payment providers.
Billing and Invoicing: to issue digital receipts and manage transaction history.
Dispute Resolution: to investigate and resolve payment or service-related disputes, including chargebacks.

3.4 For Communication

Service Updates: to send notifications about bookings, cancellations, estimated times of arrival, or driver assignments.
Marketing Messages: where we are permitted by law to do so, to send offers, discounts, and product updates. You may opt out as described in Section 7.
Customer Support: to respond to inquiries, troubleshoot issues, and improve user experience.

3.5 For Analytics and Product Development

Usage Analysis: to understand how the Platform is used and improve features, design, and performance.
Market Research: to better understand customer preferences and service demands.
New Features: to test and roll out new tools, functionalities, and updates.

3.6 To Comply with Legal Obligations

Regulatory Compliance: to meet requirements under applicable transport, data protection, and financial laws.
Law Enforcement Requests: to provide necessary information when legally required by government or law enforcement authorities.

4. Lawful Bases for Processing

Under POPIA, we process personal information on one or more of the following bases:

Consent: where you have given us your consent (for example, for direct marketing or certain location features). You may withdraw consent at any time.
Performance of a contract: where processing is necessary to provide the services you request and to manage bookings, payments, and disputes.
Legal obligation: where we must process information to comply with a legal or regulatory obligation.
Legitimate interest: where we have a legitimate business interest that is not outweighed by your rights, such as fraud prevention, security of the Platform, network and information security, and abuse detection.

We will only collect personal information for a specific, lawful, and defined purpose, and we will not keep it for longer than necessary for that purpose (see Section 9).

We only share your information when it is necessary for the operation of our services, to comply with the law, or with your consent.

5.1 With Drivers and Customers

For service fulfillment:

If you are a customer, we may share your name, pickup and drop-off address, phone number, and any booking notes with your assigned driver.
If you are a driver, we may share your name, profile photo, vehicle details, license plate, and rating with customers who book with you.

This information is shared only to complete the booking and ensure transparency.

5.2 With Service Providers and Operators

We work with trusted third-party service providers who help us operate and improve the Platform, including:

Payment Processors (such as Paystack) — to securely handle payments, pre-authorisations, refunds, and chargebacks;
Hosting and Database Providers (such as Supabase and Vercel) — to store and manage data securely, including authentication, databases, and file storage;
Mapping and Location Services (such as Mapbox) — to provide maps, navigation, geocoding, and location routing;
AI Service Providers (such as Google Gemini) — to power AI-assisted features (for example, suggesting a vehicle from your description of the items to be moved). Text you submit to these features may be processed by the provider to generate the output;
Sign-In Providers (such as Google) — where you choose to sign in using their service;
Analytics and Support Tools — to understand usage trends and provide support.

These providers are bound by contractual obligations to protect your information and may only process it to provide services to us. Where your personal information is transferred outside the Republic of South Africa, we take appropriate steps to safeguard it as required by POPIA (Section 72), such as relying on binding agreements or other lawful transfer mechanisms.

5.3 For Legal and Safety Purposes

We may disclose your information where required to:

Comply with applicable laws, regulations, legal proceedings, or governmental requests;
Respond to valid law enforcement requests, court orders, or regulatory requirements;
Protect the safety, rights, or property of our users, the public, or our company;
Investigate and address suspected fraud, security issues, or potential violations of our Terms of Service.

5.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets, your information may be transferred as part of the business transaction. We will notify you (where legally required) before your personal data is transferred and becomes subject to a different privacy policy.

In cases where you have provided explicit consent, we may share your information for purposes not covered above. You may withdraw your consent at any time.

6. Cookies, Local Storage & Similar Technologies

The Zorq website and app use local storage (or cookies, where applicable) to make the Platform work and to remember your preferences. The items we store include:

Application Preferences: such as your chosen settings and preferences.
Referral Token: a signed, server-verified token that records which partner referred you, so bookings can be attributed for the Partner Program. This token is not readable or forgeable by other users.
Push Notification Subscription: a reference that lets us send you operational notifications you have opted into.

We do not use third-party advertising cookies, and we do not use cross-site tracking to build advertising profiles about you. You can clear browser/app storage through your device settings at any time; doing so may remove preferences or referral attribution.

7. Direct Marketing

Where we send you promotional or marketing communications (as distinct from operational messages about your bookings), we do so:

With your consent where POPIA requires it (for example, to consumers); or
Where we may rely on an existing-customer relationship with you and a right to opt out (for example, marketing of similar services to existing customers).

Every marketing message we send gives you a simple way to opt out of future messages. You can also opt out by contacting us using the details in Section 12. Withdrawing consent or opting out will not affect the provision of services you have requested; we will simply stop sending you marketing.

8. Data Security & Storage

We apply appropriate technical and organizational measures to protect personal information against loss, theft, unauthorized access, alteration, and disclosure, including:

Encryption: data is protected in transit (TLS) and, where appropriate, at rest.
Access Controls: access to personal information is restricted to personnel and systems that need it to perform their role, enforced through access control lists and database security policies (including row-level security).
Data Minimization: we collect only the information necessary for the purposes described in this policy.
Transparency in Access: we do not access camera or media library contents outside the explicit, user-initiated document upload flows within the onboarding and profile screens.
Location Security: driver location is only utilized when the app is in active use/searching or during an active trip.
Secure Storage: verification documents (e.g., driver's license, ID/Passport, vehicle photos) are stored securely using restricted-access storage with appropriate controls to prevent unauthorized access.
Breach Response: where a personal information breach occurs, we will manage it in line with POPIA (Section 22), including notifying the Information Regulator and, where the breach is likely to result in harm to data subjects, notifying affected individuals as required by law.

9. Data Retention

We retain personal information only for as long as it is needed for the purposes described in this policy, which may include:

The period during which your account is active and services are provided to you;
The period required to meet legal, tax, accounting, or record-keeping obligations;
The period needed to investigate or resolve disputes, detect fraud, or enforce agreements; and
The limited period personal information is held in backups.

When personal information is no longer needed, we will delete it or de-identify/anonymise it so that it can no longer be linked to you. Where you ask us to delete your information, we will comply subject to any legal retention obligations that apply.

10. Your Rights as a Data Subject

Under POPIA you have rights in respect of your personal information, including:

Access: to request confirmation of whether we hold your personal information and to request a copy (POPIA Section 23).
Correction: to request that we correct or update inaccurate or incomplete information (POPIA Section 24).
Deletion: to request deletion or destruction of information that we no longer need or that you object to being processed.
Objection: to object, on reasonable grounds, to the processing of your personal information (POPIA Section 11(3)).
Withdraw consent: to withdraw any consent you have given, at any time, without affecting the lawfulness of processing carried out before withdrawal.
Complaint: to lodge a complaint with the Information Regulator of South Africa (inforeg.org.za) if you believe we have processed your information contrary to POPIA (POPIA Section 77).

To exercise any of these rights, please contact us using the details in Section 12. We will respond within a reasonable period (generally no more than thirty days) and, where permitted, may request reasonable identification to protect your information and the information of others. If you require access under PAIA, you may also make a PAIA request to us and we will handle it in accordance with that Act.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, the law, or how we process information. Material changes will be posted on the Platform and, where appropriate, communicated by email or in-app notification. Where POPIA requires your fresh consent for new or changed purposes, we will seek it before applying the change.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact:

mphumier@outlook.com

https://zorq.co.za