Privacy Policy

This policy explains how Supa SD, operated by YM3B9860 (Pty) Ltd, collects and uses your personal information. We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA), the South African law governing how organisations handle personal information.

1. Information We Collect

Supa SD collects the following types of information:

• Account Information: Name, email address, phone number, and location
• Instructor Information: Driving instructor licence number, PrDP details, vehicle information, and verification documents
• Usage Data: How you interact with our platform, including searches, views, and booking requests
• Communications: Messages sent between learners and instructors through our platform
• Device & Notification Information: If you turn on notifications, we collect a push notification token for your device so we can send you alerts, along with basic device information (such as device type and operating system) needed to deliver notifications and run the app. This token is removed when you sign out or disable notifications.
• Payment Information (instructors and driving schools): When you pay for a listing, we keep a record of the payment: the amount, what it covered (for example, three months), the date, whether it went through, and a reference number from our payment provider. We do not collect or store your card number, expiry date or security code. You enter those on our payment provider's secure page. Learners do not pay Supa SD in the app, so this applies only to instructors and driving schools.

2. How We Use Your Information

We use your information to:

• Provide and maintain our platform services
• Verify instructor credentials
• Facilitate connections between learners and instructors
• Send important notifications about your account
• Send push notifications about booking requests, messages, and account activity — only if you have enabled notifications, which you can turn off at any time in your device settings
• Improve our platform and develop new features
• Take payment for your listing, switch it on once the payment goes through, and keep accounting and tax records of it
• Comply with legal obligations

3. Information Sharing

We do not sell your personal information. We may share your information in the following circumstances:

• With Other Users: When you send a booking request, your contact information is shared with the instructor you're contacting
• With Service Providers: With trusted third parties who assist in operating our platform
• For Legal Reasons: When required by law or to protect our rights
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• With Notification Providers: To deliver push notifications, your device's notification token is processed by our notification service providers, Expo and Google (Firebase Cloud Messaging), who use it only to route notifications to your device.
• With Our Payment Provider: When an instructor or driving school pays for a listing by card, the payment is handled by Yoco Technologies (Pty) Ltd ("Yoco"), a South African payment services provider. You enter your card details on Yoco's secure payment page, and Yoco collects and processes them, along with anything else it asks you for on that page, under its own privacy policy, which you can read at yoco.com/za/legal. To start a payment we send Yoco only the amount, a description of what is being bought (for example, "Supa SD listing - 3 months") and our own reference numbers. We do not send Yoco your name, email address or phone number. Yoco tells us whether the payment went through, so we can switch on your listing.

4. Data Security

We implement appropriate security measures to protect your personal information, including encryption, secure servers, and access controls. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

5. Data Retention

We retain your personal information for as long as necessary to provide our services and comply with legal obligations. You may request deletion of your account and associated data at any time by contacting support@supasd.com

Records of listing payments are kept for as long as the law requires us to keep accounting and tax records, even if you delete your account.

6. Your Rights

Under South African law, you have the right to:

• Access your personal information
• Correct inaccurate information
• Request deletion of your information
• Object to processing of your information
• Withdraw consent where processing is based on consent

7. Account and Data Deletion

You have the right to request deletion of your account and all associated personal data from Supa SD. To request account deletion, please contact us at support@supasd.com with the subject line "Account Deletion Request" and include your registered email address.

Upon receiving your deletion request, we will:

• Verify your identity to ensure the request is legitimate
• Process your request within 30 days of verification
• Delete your account and personal information from our active databases
• Remove your profile from public view (if applicable)

Please note that certain information may be retained for legal, security, or business purposes, including:

• Records required for legal compliance or ongoing legal proceedings
• Transaction records for accounting and tax purposes
• Security logs and fraud prevention data
• Anonymized data that cannot be reasonably linked to you

Once your account is deleted, you will not be able to recover your data or reactivate your account. If you wish to use Supa SD again in the future, you will need to create a new account.

8. Cookies and Tracking

We do not set any advertising or tracking cookies, and we do not share your browsing with third-party advertisers.

When you first visit supasd.com you are asked whether to allow analytics. Nothing is loaded until you answer:

• If you accept: we load Vercel Web Analytics, which counts page views and referrers, and Vercel Speed Insights, which measures how quickly pages load for you. Both are served from our own domain, and neither uses cookies or identifies you personally.
• If you decline: no analytics are loaded at all.

Either way, your answer is stored in your browser's local storage so we do not ask again. That entry stays on your device, is never sent to us, and can be cleared at any time through your browser settings, which will make the choice appear again on your next visit.

Fonts and other assets are served from our own domain, so viewing the site does not report your visit to any third party.

9. Third-Party Links

Our platform may contain links to third-party websites. We are not responsible for the privacy practices of these external sites. We encourage you to read their privacy policies. For example, when you pay for a listing, our payment provider's page opens in your browser. That page is run by Yoco, not by us.

10. Children's Privacy

Supa SD is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this privacy policy from time to time. We will notify users of significant changes by posting the new policy on our platform and updating the "Last updated" date.

12. Contact Us

If you have questions about this Privacy Policy or your personal information, please contact us at support@supasd.com or on WhatsApp at +27 67 545 1694.

13. Information Officer

As required by POPIA, we have registered an Information Officer with the Information Regulator of South Africa. They are responsible for overseeing our compliance with the Act:

• Information Officer: Y Mvayo
• IO Registration Number: 2026-005152 (Information Regulator of South Africa)

14. Complaints to Information Regulator

To lodge a complaint about how we handle your personal information, you may contact the Information Regulator of South Africa:

• Website: www.inforegulator.org.za
• Email: inforeg@justice.gov.za

15. Lawful Basis for Processing

POPIA permits processing only on a lawful basis. We process personal information on one or more of the following grounds:

• User consent
• Performance of a contract
• Legal obligations
• Legitimate business interests related to service delivery and security