KZD Solutions (Pty) Ltd

DC Rides

Rider (Passenger) Application & Website

PROTECTION OF PERSONAL INFORMATION ACT (POPIA)

Privacy Notice and Policy for Riders

Table of Contents

1. Introduction

KZD Solutions (Pty) Ltd (“KZD Solutions”, “DC Rides”, “we”, “us”, or “our”) is committed to protecting the personal information of riders who register for, and use, the DC Rides passenger mobile application and website (together, the “App”) (the “App”). This Privacy Notice and Policy (“Notice”) is issued in accordance with the Protection of Personal Information Act, No. 4 of 2013 (“POPIA”), and explains what personal information we collect from riders, why we collect it, how we use, store, and protect it, and what rights riders have in relation to their personal information.

This Notice applies to all individuals who register as, or apply to become, riders on the DC Rides platform, and who use the App on any device. By registering for, downloading, or using the App, you acknowledge that you have read and understood this Notice, and you consent to the processing of your personal information as described herein, to the extent such consent is required by law.

2. Definitions

For the purposes of this Notice, the following terms have the meanings assigned to them below, consistent with their meanings under POPIA:

• “Personal Information” means information relating to an identifiable, living, natural person, including but not limited to a rider's name, contact details, payment information, ride history, and location data.
• “Processing” means any operation or activity performed on personal information, including collection, receipt, recording, organisation, storage, updating, retrieval, use, dissemination, or destruction.
• “Responsible Party” means KZD Solutions (Pty) Ltd, which determines the purpose and means of processing rider personal information collected through the App.
• “Operator” means any third party that processes personal information on behalf of KZD Solutions, such as payment processors or mapping service providers, in terms of a contract or mandate.
• “Data Subject” means the person to whom personal information relates — in this Notice, primarily a registered or prospective DC Rides rider.
• “Information Regulator” means the regulatory body established under POPIA to oversee compliance with the Act in South Africa.

3. Responsible Party Details

The Responsible Party for the processing of personal information collected through the App is:

4. Information Officer

In accordance with section 55 of POPIA, KZD Solutions has appointed Nondyebo Nojiwa, Managing Director, as its Information Officer, with Steven Kazadi appointed as Deputy Information Officer in accordance with section 56 of POPIA. The Information Officer is responsible for ensuring compliance with POPIA within the organisation, encouraging compliance with the conditions for lawful processing of personal information, dealing with requests made to KZD Solutions in terms of POPIA, and working with the Information Regulator in relation to any investigations.

Any queries, requests, or complaints relating to the processing of your personal information, or the exercise of your rights under POPIA, should be directed to the Information Officer using the contact details set out in Section 3 above, or Section 15 (How to Contact Us) below.

5. Personal Information We Collect

In order to register riders, verify their eligibility to use the platform, facilitate rides, process payments, and provide ongoing support, KZD Solutions collects the following categories of personal information through the App:

5.1 Information You Provide Directly

• Full name and email address (sign-up and sign-in currently use email only — phone number and OTP verification are not in use at this time)
• Saved locations (e.g. home, work, favourites), entered by you
• Payment method details, entered via our third-party payment provider (DC Rides does not directly store full card details)
• Selected ride preferences for a booking (e.g. Pet Allowed, Extra Luggage Space, Child Seat, Smoke-Free)
• Messages sent via in-app chat with staff, and support ticket details (subject, description, department, priority, and any attached files)

Note: no personal information is required to browse the App or select a destination as a Guest. Sign-in or account creation is only required when proceeding to book a ride.

5.2 Information Collected Automatically

• Real-time GPS location, used to determine your pickup point and provide ride tracking
• Trip origin and destination history
• Ride history, fares, ratings, and promo code usage
• Booking details for scheduled rides and rentals
• In-app wallet balance and top-up transaction history
• Device identifiers and push-notification tokens, used for ride and account notifications
• App and website usage and diagnostic logs, for troubleshooting and service reliability

5.3 Information From Third Parties

• Transaction confirmations and payment status information from our payment gateway provider
• Location and mapping data facilitated through our third-party mapping/location services provider
• Driver and vehicle information relevant to your trip (e.g. driver name, vehicle details, and live location), provided once you are matched with a driver for an active ride

6. Purpose of Processing

KZD Solutions processes rider personal information for the following purposes:

1. To register Riders and manage your Rider account;
2. To match you with an available driver and facilitate your ride, including navigation and trip tracking;
3. To process wallet top-ups and ride payments through our payment gateway;
4. To provide customer support and respond to queries, tickets, or complaints;
5. To send ride-related notifications (driver arrival, trip status, receipts) and, with consent, promotions and platform updates;
6. To monitor, maintain, and improve the safety, security, and performance of the App and the wider Platform;
7. To detect, investigate, and prevent fraud, abuse, or breaches of our Rider terms and conditions;
8. To comply with applicable legal, regulatory, tax, and record-keeping obligations.

7. Lawful Basis for Processing

KZD Solutions processes rider personal information on one or more of the following lawful grounds recognised under POPIA:

• Consent: where you have given consent to the processing of your personal information for a specific purpose, such as receiving marketing communications;
• Contractual necessity: where processing is necessary to perform our agreement with you as a registered rider on the platform, including ride facilitation and payments;
• Legal obligation: where processing is necessary to comply with an obligation imposed by law, such as tax, transport regulation, or record-keeping requirements;
• Legitimate interest: where processing is necessary for KZD Solutions' legitimate business interests, such as fraud prevention and platform security, provided this does not override your rights and interests.

8. Disclosure and Sharing of Personal Information

KZD Solutions does not sell rider personal information. We may, however, share personal information with the following categories of recipients, strictly for the purposes described in this Notice:

8.1 Payment Gateway Provider

We share limited personal and payment information with our third-party payment gateway provider to process rider payments, wallet top-ups, and related transactions. Our payment gateway provider processes this information as an Operator on our behalf and is contractually required to keep it secure and to use it only for the agreed purposes.

8.2 Maps and Location Services Provider

We share real-time location data with our third-party mapping and location services provider in order to enable navigation, distance calculation, and ride tracking functionality within the App.

8.3 Other Disclosures

• To assigned drivers, limited to the information reasonably necessary to complete a ride (such as your name, pickup location, and contact number);
• To SARS, credit bureaus, or other regulatory bodies, where required for financial, tax, or legal compliance;
• To cloud infrastructure and hosting providers, under data processing agreements, for operational purposes;
• To regulators, law enforcement, or other authorities, where required by law, court order, or in order to protect the rights, safety, or property of KZD Solutions, its drivers, riders, or the public;
• To professional advisors (such as auditors or legal counsel), bound by confidentiality obligations;
• In connection with a merger, acquisition, restructuring, or sale of assets involving KZD Solutions, subject to appropriate confidentiality safeguards.

9. Cross-Border Transfer of Personal Information

KZD Solutions (Pty) Ltd, the operator of DC Rides, makes use of cloud-based services and hosting platforms that may store or process personal information outside South Africa, including our payment gateway and mapping/location services providers, Google Workspace (Google LLC, United States) for email and document storage, and cloud hosting providers whose infrastructure may be located in jurisdictions such as the United States or the European Union. KZD Solutions will take reasonable steps to ensure that any such transfers are conducted in compliance with POPIA, and that recipient parties apply an equivalent level of protection to your information, as required by Section 72 of the Act.

10. Data Security

KZD Solutions implements reasonable technical and organisational measures to protect rider personal information against loss, unauthorised access, interference, modification, or disclosure, including:

• Encryption of sensitive data such as banking/payment details and identity or verification documents, both in transit and at rest, where applicable;
• Password-protected systems and devices, with role-based access controls restricting personal information access to authorised personnel on a need-to-know basis;
• Antivirus and endpoint protection software on company devices;
• Secure cloud hosting with encryption in transit and at rest;
• Secure storage of documents submitted during registration and verification;
• Regular software updates and security patching, and regular data backups to prevent loss or corruption of information;
• Regular review of our security practices and prompt action in response to any suspected security incident.

While we take reasonable steps to protect personal information, no system can guarantee absolute security. Should a data breach occur that is likely to result in a real risk of harm to affected riders, KZD Solutions will notify the Information Regulator and affected riders as required under POPIA.

11. Data Retention

KZD Solutions retains rider personal information only for as long as necessary to fulfil the purposes described in this Notice, or as required by applicable law, including tax, transport regulation, and financial record-keeping requirements. Where a rider's account is deactivated or a rider requests deletion of their information, KZD Solutions will delete or de-identify the relevant personal information, save to the extent that continued retention is required by law or necessary to establish, exercise, or defend a legal claim.

12. Your Rights as a Data Subject

Subject to any applicable exceptions or limitations under POPIA, riders have the right to:

• Be notified that personal information about them is being collected, and for what purpose;
• Access the personal information that KZD Solutions holds about them;
• Request the correction, updating, or deletion of inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained personal information;
• Object, on reasonable grounds, to the processing of their personal information;
• Withdraw consent to processing at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before such withdrawal;
• Object to the processing of their personal information for purposes of direct marketing;
• Lodge a complaint with the Information Regulator regarding the alleged interference with the protection of their personal information.

To exercise any of these rights, please contact our Information Officer using the details in Section 3 or Section 15. We will respond to legitimate requests within the timeframes required by POPIA.

13. Direct Marketing

KZD Solutions will only send you direct marketing communications (such as promotions, incentives, referral programmes, or platform updates) if you have consented to receive them, in line with Section 69 of POPIA. You may opt out of direct marketing communications at any time by following the unsubscribe instructions provided in such communications, adjusting your notification preferences within the App, or contacting our Information Officer directly.

14. Children's Information

The App is not intended for use by Riders under the age of 18. KZD Solutions does not knowingly collect personal information from minors through the App. If we become aware that we have inadvertently collected such information, we will take reasonable steps to delete it.

15. How to Contact Us

If you have any questions, requests, or complaints regarding this Notice or the processing of your personal information, please contact our Information Officer or Deputy Information Officer:

Should you be dissatisfied with our response, or wish to lodge a complaint directly, you may also contact the Information Regulator (South Africa):

16. Changes to This Notice

KZD Solutions may update this Notice from time to time to reflect changes in our processing practices, the App's functionality, or applicable law. Where changes are material, we will notify riders through the App or by email prior to the changes taking effect. The “Effective Date” at the top of this Notice indicates when it was last revised.

17. Acknowledgement and Consent

By creating an account or using the App as a Rider, you confirm that you have read and understood this Notice, and you consent to KZD Solutions processing your personal information as described herein, to the extent such consent is required under POPIA.

This document was prepared as a template for internal review. KZD Solutions is encouraged to have this Notice reviewed by a qualified attorney familiar with South African data protection law prior to publication, to confirm its accuracy and completeness for the company's specific operations.