EXPRESS ROAD PRIVACY POLICY

Effective Date: 26 October 2023

This Privacy Policy describes how Quadtech CC t/a Express Road (hereinafter referred to as "Express Road", "we", "us", or "our"), collects, uses, stores, processes, and protects the personal information of individuals ("you" or "data subject") in accordance with the Protection of Personal Information Act, 4 of 2013 (POPIA) and other applicable South African laws.

Express Road is committed to protecting your privacy and ensuring that your personal information is collected and used properly, lawfully, and transparently.

1. ABOUT EXPRESS ROAD (RESPONSIBLE PARTY)

Quadtech CC t/a Express Road (Company Registration Number: [Insert Company Reg No.]) is a courier and logistics service provider. We are the 'Responsible Party' as defined by POPIA, meaning we determine the purpose and means of processing your personal information.

2. DEFINITIONS (as per POPIA)

• "Personal Information": Information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person.
• "Processing": Any operation or activity or any set of operations, whether or not by automatic means, concerning personal information, including the collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation, use, dissemination by means of transmission, distribution or making available in any other form, merging, linking, as well as blocking, degradation, erasure or destruction of information.
• "Responsible Party": The public or private body or any other person which, alone or in conjunction with others, determines the purpose of and means for processing personal information.
• "Operator": A person who processes personal information for a responsible party in terms of a contract or mandate, without coming under the direct authority of that responsible party.
• "Data Subject": The person to whom personal information relates.

3. COLLECTION OF PERSONAL INFORMATION

We collect personal information directly from you when you:

• Use our website, mobile applications, or online platforms.
• Register an account with us.
• Request a quote or book a courier service.
• Communicate with us via phone, email, chat, or social media.
• Subscribe to our newsletters or marketing communications.
• Participate in surveys or promotions.
• Apply for employment or engagement as an independent contractor/driver.

In some instances, we may collect information from third-party sources (e.g., business partners, public registers, or credit bureaux for verification purposes), but only where permitted by law or with your consent.

4. TYPES OF PERSONAL INFORMATION WE COLLECT

The personal information we collect depends on the nature of your interaction with us and may include:

• Identity Information: Full name, company name, ID number (if required for specific services or legal compliance), passport number.
• Contact Information: Email address, postal address, delivery address, billing address, telephone numbers.
• Financial Information: Payment details (e.g., credit card numbers, bank account details for billing and refunds), payment history. (Note: We do not store full credit card details on our servers).
• Transactional Information: Details about services you have purchased from us, delivery instructions, recipient details (name, address, contact number).
• Technical Information: IP address, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform, device information.
• Usage Information: Information about how you use our website, products, and services (e.g., browsing patterns, search queries).
• Marketing and Communications Information: Your preferences in receiving marketing from us and your communication preferences.
• Special Personal Information (limited): In certain rare circumstances and only with your explicit consent or as legally required (e.g., medical information if necessary for specific delivery accommodations related to an individual's health), we may collect special personal information. You will be informed specifically if this is required and the relevant legal basis.

5. PURPOSE AND LEGAL BASIS FOR PROCESSING PERSONAL INFORMATION

We process your personal information for specific, explicitly defined, and legitimate purposes related to our business operations, including:

• To Provide Courier and Logistics Services: To process your service requests, schedule collections and deliveries, track shipments, provide quotes, and manage your account. (Legal Basis: Contractual Necessity).
• Customer Relationship Management: To communicate with you regarding your shipments, respond to inquiries, provide customer support, and manage feedback. (Legal Basis: Contractual Necessity, Legitimate Interest).
• Billing and Financial Administration: To process payments, issue invoices, manage outstanding balances, and conduct fraud prevention checks. (Legal Basis: Contractual Necessity, Legal Obligation).
• Marketing and Promotions: To send you updates, promotions, and marketing communications about our services, where you have consented or where there is a legitimate interest. You have the right to opt-out at any time. (Legal Basis: Consent, Legitimate Interest).
• Website and Service Improvement: To understand how our website and services are used, to enhance user experience, and for internal reporting and analysis. (Legal Basis: Legitimate Interest).
• Compliance with Legal Obligations: To comply with applicable laws, regulations (e.g., tax, customs, consumer protection), and legal processes. (Legal Basis: Legal Obligation).
• Security: To protect our IT systems, prevent fraud, and ensure the security of our operations and data. (Legal Basis: Legitimate Interest, Legal Obligation).
• Human Resources & Contractor Management: For recruitment, employment, and management of independent drivers/contractors (covered by separate internal policies but based on contractual necessity and legal obligation).

6. SHARING AND DISCLOSURE OF PERSONAL INFORMATION

We may share your personal information with:

• Our Employees and Authorised Agents: On a strictly "need-to-know" basis to perform their job functions related to providing our services.
• Service Providers/Operators: Third-party service providers (e.g., IT support, payment processors, cloud hosting, marketing agencies, other courier networks for cross-border deliveries, last-mile delivery partners) who process data on our behalf under strict confidentiality agreements and POPIA-compliant terms.
• Delivery Recipients: Limited information (e.g., sender name, contents description, tracking number) may be shared with the intended recipient of a shipment for delivery and tracking purposes.
• Regulatory and Government Bodies: Where required by law, court order, or for purposes of legal compliance (e.g., customs agencies, SARS, police).
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your personal information may be transferred as part of that transaction.

We will not sell, rent, or lease your personal information to third parties.

7. INTERNATIONAL DATA TRANSFERS

Express Road may transfer your personal information to recipients in other countries where our service providers, partners, or associated entities are located, particularly for international shipments. These countries may not have data protection laws equivalent to POPIA.

When we transfer your personal information to other countries, we will ensure that:

• The recipient is subject to a law, binding corporate rules, or a binding agreement that provides an adequate level of protection similar to POPIA.
• You have consented to the transfer.
• The transfer is necessary for the performance of a contract to which you are a party.
• The transfer is for your benefit and it is not reasonably practicable to obtain your consent, and if it were, you would have given it.

We aim to use service providers who have robust data protection measures in place and adhere to internationally recognised standards.

8. SECURITY SAFEGUARDS

Express Road is committed to protecting the personal information in our possession from loss, misuse, unauthorised access, disclosure, alteration, and destruction. We implement and continuously review appropriate technical and organisational measures, including:

• Physical Security: Secure premises and restricted access to data centers and offices.
• Electronic Security: Firewalls, encryption (for data in transit and at rest where appropriate), secure coding practices, regular vulnerability assessments.
• Access Control: Limiting access to personal information to authorised personnel on a need-to-know basis.
• Employee Training: Regular training for staff on data privacy and security best practices.
• Data Minimisation: Collecting only the personal information that is necessary for the stated purposes.
• Data Breach Notification: In the event of a suspected or actual data breach that may result in a risk of harm to data subjects, Express Road will notify the Information Regulator and affected data subjects as required by POPIA.

9. YOUR RIGHTS AS A DATA SUBJECT (POPIA)

As a data subject, you have the following rights concerning your personal information held by Express Road:

• Right to be informed (Sections 18 & 21): The right to know that your personal information is being collected and the specific purpose for its collection. (Addressed by this Privacy Policy).
• Right of access (Section 23): You have the right to request confirmation whether we hold personal information about you, and if confirmed, to request a copy of that information.
• Right to rectification/correction (Section 24): You have the right to request that Express Road corrects or deletes personal information that is inaccurate, irrelevant, excessive, outdated, incomplete, misleading or unlawfully obtained.
• Right to deletion/destruction (Sections 14(5), 24(1)): You have the right to request the destruction or deletion of your personal information where we are no longer authorised to retain it.
• Right to object (Section 11(3), 11(4)): You have the right to object, on reasonable grounds relating to your particular situation, to the processing of your personal information. You also have an absolute right to object to the processing of your personal information for purposes of direct marketing by unsolicited electronic communications.
• Right to withdraw consent (Section 11(2)(b)): Where processing is based on your consent, you have the right to withdraw your consent at any time. This will not affect the lawfulness of processing based on consent before its withdrawal.
• Right to complain to the Information Regulator (Section 77): You have the right to lodge a complaint with the Information Regulator regarding our processing of your personal information.

  Information Regulator Contact Details:

  Tel: 010 023 5200

  Email: complaints.IR@justice.gov.za

  Website: https://www.justice.gov.za/inforeg/

  Postal Address: P.O Box 31533, Braamfontein, Johannesburg, 2017

10. RETENTION OF PERSONAL INFORMATION

We will retain your personal information for as long as necessary to fulfil the purposes for which it was collected, or as required by law (e.g., tax, financial regulations), or for legitimate business purposes (e.g., dispute resolution, audit purposes). Once no longer required, we will securely destroy or de-identify your personal information.

11. COOKIES

This website uses cookies. Cookies are small text files placed on your device by websites that you visit. They are widely used to make websites work, or work more efficiently, as well as to provide information to the owners of the site.

• Essential Cookies: Some cookies are essential for the operation of our website (e.g., to enable login, manage your shopping cart). We do not require your consent for these.
• Non-Essential Cookies: We use non-essential cookies (e.g., for analytics like Google Analytics) to understand how visitors use our site, improve user experience, and for marketing purposes. We obtain your consent for these cookies where required by law (e.g., through a cookie banner).

Your Choices Regarding Cookies:

Most web browsers allow some control of most cookies through the browser settings. You can block or delete cookies by adjusting your browser settings. However, doing so may impact the functionality of our website.

To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, visit allaboutcookies.org. To opt-out of being tracked by Google Analytics across all websites, visit tools.google.com/dlpage/gaoptout.

12. CHANGES TO THIS PRIVACY POLICY

Express Road may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any significant changes by posting the new policy on our website. We encourage you to review this Privacy Policy periodically.

13. CONTACT US

If you have any questions about this Privacy Policy, our data processing practices, or if you wish to exercise any of your rights regarding your personal information under POPIA, please contact our Information Officer via: