Rwala Privacy Policy

Effective date: 20 July 2026 · Last updated: 20 July 2026

Rwala ("Rwala", "we", "us") operates an on-demand logistics platform in South Africa, consisting of the Rwala Driver mobile application, the Rwala Business portal, the public delivery-tracking page, and related services (together, the "Services").

This policy explains how we collect, use, store, share and protect personal information, in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA") and the right to privacy in section 14 of the Constitution of the Republic of South Africa, 1996. We process personal information lawfully, reasonably, and in a manner that does not infringe your privacy, in line with the eight conditions for lawful processing set out in Chapter 3 of POPIA.

1. Who is responsible for your information

For the purposes of POPIA, the "responsible party" is:

Rwala [registered entity name and registration number]
[Registered address]
Email: support@rwala.africa

Information Officer: [Name of Information Officer]. Under POPIA the Information Officer is responsible for ensuring our compliance and handling requests and complaints relating to personal information. You can reach the Information Officer at the email address above.

2. Whose information we process

Drivers — independent delivery drivers who use the Rwala Driver app.
Business customers — stores and businesses (and their staff) who use the Rwala Business portal to book deliveries.
Delivery recipients — customers of our business customers, whose contact and address details are provided to us by the business booking the delivery.

If you are a delivery recipient: the business that booked your delivery provided us with your name, phone number and delivery address so that we can complete the delivery and send you tracking and delivery notifications. We process this information only for that purpose.

3. What we collect

Category	Details	Who it relates to
Identity & contact	Name, phone number, email address	Drivers, business users, recipients
Driver & vehicle details	Vehicle type and registration (number plate), profile photo	Drivers
Location	Precise device location, collected only while the app is open and the driver is online or on an active delivery. We do not collect location in the background or when the driver is offline.	Drivers
Delivery information	Pickup and drop-off addresses, delivery notes, item photos, proof-of-delivery photos, delivery status and history	All users
Financial	Delivery pricing, driver earnings records, billing and invoice records. Card payments are processed by our payment provider (PayFast); we do not store card numbers.	Drivers, business customers
Device & technical	Push-notification tokens and device identifiers (used to deliver notifications), app diagnostics	Drivers, business users
Communications	In-app chat messages between drivers and businesses, and between drivers and Rwala support	Drivers, business users

4. Why we process it (purpose specification)

Creating and managing accounts, and verifying identity via phone-number authentication
Matching deliveries to drivers, and managing the delivery lifecycle from booking to proof of delivery
Showing live delivery tracking to the business and the delivery recipient
Sending service notifications (booking status, alerts) via push notification, WhatsApp and email
Calculating pricing, driver earnings, billing and invoices
Providing in-app communication and support
Safety, security, fraud prevention and resolving disputes about deliveries
Complying with our legal obligations

We rely on the following POPIA justifications (section 11): performance of a contract with you; your consent (which you may withdraw); our legitimate interests in operating a safe and reliable delivery platform; and compliance with the law. We collect information directly from you wherever possible, and we collect only what is adequate, relevant and not excessive for these purposes (minimality, section 10).

We do not sell personal information, and we do not use it for direct marketing by unsolicited electronic communication (section 69 of POPIA).

5. Who we share it with

Recipient	What and why
Businesses and drivers (each other)	A driver on an active job sees the pickup/drop-off details and recipient contact number needed to deliver; the business sees the driver's name, vehicle and live location for that delivery.
Delivery recipients	Receive a tracking link showing the driver's first name and live position for their delivery.
Google Firebase (Google LLC)	Authentication, database, file storage and hosting — our core infrastructure.
OneSignal, Inc.	Delivery of push notifications (processes push tokens and device identifiers).
PayFast (Network International)	Card payment processing for business billing.
Authorities	Where disclosure is required by law or a court order.

These providers act as "operators" under section 20–21 of POPIA where applicable, process information only on our instructions, and are bound by confidentiality and security obligations.

6. Cross-border transfers (section 72 of POPIA)

Our infrastructure providers (Google Firebase, OneSignal) store data on servers located outside South Africa, including in the United States and the European Union. We transfer personal information across borders only where permitted by section 72 of POPIA — in particular, where the recipient is subject to laws or binding agreements that provide substantially similar protection to POPIA, or where the transfer is necessary to perform our contract with you.

7. How long we keep it (retention, section 14 of POPIA)

Account information — for as long as your account is active, and thereafter only as long as needed to comply with legal, tax and audit obligations.
Delivery and financial records — retained for the periods required by South African tax and company law (generally 5 years), then deleted or de-identified.
Location data — retained only as part of the delivery record for the relevant job.
Chat messages — retained while the related account or booking record exists.

When information is no longer required, we delete it or de-identify it.

8. How we protect it (security safeguards, section 19)

We take reasonable, appropriate technical and organisational measures to secure personal information, including encryption in transit, authenticated access controls enforced by database security rules (for example, drivers can only access their own jobs and businesses only their own bookings), role-restricted administrative access, and payment processing delegated to a PCI-compliant provider. If we have reasonable grounds to believe your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and affected persons as required by section 22 of POPIA.

9. Your rights under POPIA

You have the right to:

Access — ask whether we hold personal information about you and request a copy (section 23);
Correction — ask us to correct or update inaccurate, irrelevant, out-of-date or incomplete information (section 24);
Deletion — ask us to delete or destroy personal information we are no longer entitled to retain (section 24);
Objection — object, on reasonable grounds, to processing based on our legitimate interests (section 11(3));
Withdraw consent — where processing is based on consent, withdraw it at any time;
Complain — lodge a complaint with the Information Regulator (details below).

To exercise any of these rights, contact our Information Officer at support@rwala.africa, or use the account deletion page at rwala.africa/delete-account. We will respond within a reasonable time and in accordance with POPIA and, where applicable, the Promotion of Access to Information Act 2 of 2000 (PAIA).

10. Account deletion

You may request deletion of your account and associated personal information at any time via rwala.africa/delete-account or by emailing support@rwala.africa. We will delete your personal information except where we are required by law to retain specific records (such as financial records), which are then kept only for the legally required period and only for that purpose.

11. Children

The Services are not directed at children. Drivers must be at least 18 years old and hold a valid driver's licence. We do not knowingly process the personal information of children as contemplated in section 34 of POPIA; if we become aware that we have done so, we will delete it.

12. Automated decision-making

Delivery pricing and driver-job matching are calculated automatically based on delivery distance, vehicle type and availability. No decision with legal or similarly significant consequences for you is based solely on automated processing as contemplated in section 71 of POPIA.

13. Changes to this policy

We may update this policy from time to time. The current version will always be available at rwala.africa/privacy, and material changes will be notified in the app or portal. Continued use of the Services after changes take effect constitutes acceptance of the updated policy.

14. The Information Regulator (South Africa)

If you believe we have processed your personal information unlawfully, you may lodge a complaint with the Information Regulator:

JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Email: POPIAComplaints@inforegulator.org.za / enquiries@inforegulator.org.za
Website: inforegulator.org.za