Privacy Policy

1. Who We Are (Responsible Party)

In terms of the Protection of Personal Information Act 4 of 2013 (POPIA), ON MY WAY CARPOOL (PTY) LTD is the Responsible Party in respect of all personal information processed through the OMW Carpool application.

2. What Personal Information We Collect

2.1 Information you provide directly

• Full name
• South African identity document number or passport number
• Date of birth
• Email address
• Mobile phone number
• Profile photograph
• South African driver's licence number and expiry date (drivers only)
• Vehicle registration number, make, model, and colour (drivers only)
• Bank account details including account holder name, account number, account type, and branch code (drivers only)
• Trip information including routes, departure times, seat prices, and passenger capacity
• Booking details including trip selections, payment amounts, and booking history

2.2 Information collected automatically

• Device information including device type, operating system, and unique device identifiers
• Location data when you use the App and permit location access
• GPS tracking data during active trips where you have consented
• App usage data including features accessed, time spent, and interaction patterns
• Push notification tokens for delivering booking and safety notifications
• Log data including IP addresses, access times, and error reports

2.3 Information collected from third parties

• Identity verification data from Smile Identity including biometric liveness check results and document verification outcomes
• Payment processing data from TradeSafe including transaction references, escrow status, and payout confirmation
• Africa's Talking SMS delivery confirmations for emergency contact notifications

2.4 Special personal information

OMW collects biometric information (facial biometrics via Smile Identity liveness checks) for the purpose of driver identity verification. This constitutes special personal information under POPIA. This data is processed solely for security and verification purposes and is not stored by OMW — it is processed by Smile Identity in accordance with their own privacy policy and returned to OMW only as a verification result (verified or failed).

3. Why We Collect Your Information (Purpose of Processing)

OMW processes your personal information only for the following specific, explicitly defined, and lawful purposes:

1. To create and manage your user account on the OMW platform
2. To verify your identity as a driver using Smile Identity biometric verification
3. To facilitate connections between drivers and riders on the platform
4. To process payments and manage escrow transactions through TradeSafe
5. To pay out driver earnings to their registered South African bank accounts
6. To send you booking confirmations, trip reminders, and payout notifications via push notification and SMS
7. To send emergency contact SMS notifications via Africa's Talking when a rider confirms boarding
8. To display your profile information (name, profile photo, rating) to other users for the purpose of facilitating trust and safety
9. To investigate and resolve disputes between drivers and riders
10. To enforce our Terms and Conditions and Platform policies
11. To comply with applicable South African laws and regulations
12. To improve the OMW platform, detect fraud, and ensure security
13. To send you marketing communications where you have given your opt-in consent, with the right to withdraw consent at any time

4. Legal Basis for Processing

OMW processes your personal information on the following lawful grounds under POPIA:

• Consent — where you have given voluntary, specific, and informed consent to processing, including consent to these terms at registration
• Contractual necessity — processing is necessary to perform the contract between you and OMW (facilitating your use of the platform as a driver or rider)
• Legal obligation — processing is necessary to comply with applicable South African laws
• Legitimate interest — processing is necessary for OMW's legitimate interest in operating a safe, secure, and functional marketplace platform, balanced against your right to privacy

5. How We Share Your Information

5.1 Third-party service providers

OMW shares your personal information with the following categories of third-party processors who are contractually required to protect your information and process it only for the purposes OMW specifies:

5.2 Other users

Certain information is visible to other users of the OMW platform as part of the normal functioning of the marketplace:

• Your first name, profile photograph, and user rating are visible to drivers and riders when a booking is made
• Driver profile information including vehicle details and verified status is visible to riders browsing available trips
• Trip route, departure time, seat price, and available seats are visible to all users searching for trips

5.3 Law enforcement and legal requirements

OMW may disclose your personal information to law enforcement authorities, courts, or regulatory bodies where required to do so by law, court order, or legal process, or where OMW reasonably believes disclosure is necessary to protect the rights, property, or safety of OMW, its users, or the public.

5.4 What we do not do

• OMW does not sell your personal information to any third party
• OMW does not share your personal information with advertisers
• OMW does not use your personal information for automated decision-making that produces legal consequences without human review

6. Cross-Border Transfers of Personal Information

Some of our third-party service providers process data outside the borders of South Africa. Specifically:

• Firebase (Google) operates data centres in multiple global regions. Data may be processed outside South Africa.
• Smile Identity processes biometric verification data and may process data in data centres outside South Africa.

Where personal information is transferred outside South Africa, OMW ensures that adequate protection exists through contractual safeguards or that the transfer is necessary for the performance of a contract with you, in accordance with Section 72 of POPIA.

7. How Long We Keep Your Information

OMW retains your personal information only for as long as necessary to fulfil the purposes for which it was collected or as required by law. The following retention periods apply:

8. Your Rights Under POPIA

As a data subject under POPIA you have the following rights in respect of your personal information:

8.1 Right to be notified

You have the right to be notified when your personal information is being collected. This Privacy Policy serves as that notification.

8.2 Right of access

You may request confirmation of whether OMW holds your personal information and request access to that information. Submit your request to info@omwcarpool.co.za with proof of identity.

8.3 Right to correction or deletion

You may request that OMW correct inaccurate, irrelevant, excessive, out-of-date, incomplete, misleading, or unlawfully obtained personal information. You may also request deletion of personal information that OMW is no longer authorised to retain. Under the 2025 POPIA Amendment Regulations OMW will respond to such requests in writing within 30 days.

8.4 Right to object

You have the right to object to the processing of your personal information on reasonable grounds. If the objection is justified OMW must stop processing. Objections may be submitted by email to info@omwcarpool.co.za, by post, or by WhatsApp. Telephonic objections will be recorded and the record made available to you on request free of charge.

8.5 Right to withdraw consent

Where processing is based on your consent you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that took place before the withdrawal. Withdrawing consent to certain processing may affect your ability to use some or all features of the OMW App.

8.6 Right not to be subject to automated decision-making

You have the right not to be subject to a decision based solely on automated processing if that decision produces legal consequences or substantially affects you.

8.7 Right to lodge a complaint

If you believe OMW has violated your data protection rights you may lodge a complaint with the Information Regulator of South Africa:

• Website: www.justice.gov.za/inforeg
• Email: inforeg@justice.gov.za
• Physical address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

9. How We Protect Your Information

OMW implements reasonable technical and organisational measures to protect your personal information against loss, unauthorised access, use, modification, or disclosure. These measures include:

• All data stored in Firebase Firestore is protected by Firebase security rules restricting access to authorised users and Cloud Functions only
• Sensitive fields including banking details, PIN hashes, and TradeSafe tokens are write-protected on the client side and can only be written by server-side Cloud Functions
• All communication between the App and Firebase is encrypted in transit using TLS
• Driver bank account details are stored with access controls and are never exposed to other users
• Boarding PINs are hashed using SHA256 salted with the booking ID before storage and the raw PIN is never stored
• Payment processing is handled entirely by TradeSafe in a PCI-compliant environment — OMW does not store card details
• Access to the Firebase admin console and production credentials is restricted to authorised personnel only
• Environment variables and API keys are never committed to source code repositories

No method of electronic transmission or storage is 100% secure. While OMW takes all reasonable steps to protect your personal information, we cannot guarantee absolute security.

10. Data Breach Notification

In the event of a security compromise that involves your personal information, OMW will:

1. Notify the Information Regulator as soon as we are reasonably certain that a security compromise has occurred, in accordance with the 2025 POPIA Amendment Regulations which require immediate notification upon reasonable certainty (not only after full investigation)
2. Notify affected data subjects of the security compromise as soon as reasonably practicable
3. Take immediate steps to contain, investigate, and remediate the compromise
4. Maintain a log of the security compromise for regulatory purposes

11. Cookies and Tracking Technologies

The OMW mobile application does not use browser cookies. The App does use the following tracking technologies:

• Firebase Analytics — anonymous, aggregated usage analytics to help improve the App. No personally identifiable information is included in analytics events.
• Push notification tokens — used solely to deliver notifications you have opted into. You can withdraw consent to notifications through your device settings at any time.
• Location services — used during active trips and trip search with your explicit permission. You can revoke location access through your device settings.

12. Children's Personal Information

The OMW App is not intended for use by persons under the age of 18. OMW does not knowingly collect personal information from minors. Riders under the age of 18 must have the consent of a parent or legal guardian to use the platform. If you believe OMW has inadvertently collected personal information from a child without appropriate consent please contact info@omwcarpool.co.za immediately and we will delete that information.

13. Direct Marketing

OMW will only send you marketing communications where you have given your explicit opt-in consent as required by Section 69 of POPIA. You have the right to opt out of direct marketing communications at any time by:

• Tapping the unsubscribe link in any marketing email
• Updating your notification preferences in the App settings
• Emailing info@omwcarpool.co.za with the subject line "Unsubscribe"

OMW will not use your personal information for marketing purposes beyond what you have consented to.

14. Changes to This Privacy Policy

OMW may update this Privacy Policy from time to time to reflect changes in the law, our practices, or the features of the App. We will notify you of material changes by:

• Sending a push notification to your device
• Displaying a notice in the App when you next log in
• Sending an email notification to your registered email address

The updated Privacy Policy will indicate the date it was last revised. Continued use of the App after notification of changes constitutes acceptance of the revised Privacy Policy. If you do not accept the changes you must stop using the App and may request deletion of your account.

15. How to Contact Us

For any questions, requests, or concerns regarding this Privacy Policy or the processing of your personal information, please contact the OMW Information Officer: