DRIVE SA Privacy Policy - POPIA Compliance Gauteng

DRIVE SA POPIA

This Privacy Policy explains how DRIVE SA collects, uses, shares and protects your personal information when you engage with us through our Facebook page, WhatsApp, web forms, landing pages, advertising funnels and call-back requests. It is issued in compliance with the Protection of Personal Information Act, 4 of 2013 (POPIA).

1. WHO IS THE RESPONSIBLE PARTY?

DRIVE SA is the "responsible party" (data controller) for personal information you submit through our enquiry channels. We act as an automotive sales, marketing and Rent-To-Buy agent on behalf of partner dealerships and finance providers, and we share information with those partners strictly to process your enquiry.

2. INFORMATION WE COLLECT

The categories of personal information we may collect, depending on the nature of your enquiry, are summarised below:

Category	Examples	Why we collect it
Identity	Name, ID number, date of birth, contact details	Verify identity, complete FICA / RICA / NCA checks
Financial	Income, employer, payslips, bank statements, affordability	Pre-qualify for HP finance or Rent-To-Buy
Vehicle	Vehicle of interest, trade-in details, deposit, term	Match you to stock and quote a deal
Driving	Driver's licence number, code, restrictions	Confirm legal capacity to drive the vehicle
Marketing	Source (Facebook lead form, web form, referral), consent flags	Send you relevant offers and follow-ups
Technical	IP address, device, page interaction, ad click ID	Optimise our funnels and prevent fraud

We do not knowingly collect information from children under 18. If you are a parent or guardian and believe a minor has submitted information to us, please contact us so we can delete it.

3. HOW WE COLLECT IT

Directly from you when you complete a Facebook lead form, web form, application, or message us on WhatsApp / phone / email;
From our partner dealerships when they refer an enquiry to us, or vice versa;
From accredited credit bureaux and verification services (where required for finance applications, with your consent);
From advertising platforms (Facebook, Google, TikTok) using their standard analytics and lead-form tools;
Automatically via cookies and similar technologies on our landing pages - see clause 8.

4. WHY WE PROCESS YOUR INFORMATION (LAWFUL BASIS)

We only process your personal information where a lawful basis exists under POPIA, namely:

Consent - you have given clear consent (e.g. by submitting a lead form or ticking a marketing box);
Contract - processing is necessary to take steps before, or perform under, a contract you are entering into (e.g. a Rent-To-Buy or finance application);
Legal obligation - to comply with FICA, the NCA, tax law, or a lawful instruction from a regulator or court;
Legitimate interest - to pursue our legitimate interests as a marketing agent (such as fraud prevention, deal reconciliation with dealerships, and improving our funnels), where these do not override your rights.

5. WHO WE SHARE IT WITH

We share your personal information only with parties who have a clear role in your enquiry or transaction:

Partner dealerships - to confirm vehicle availability, prepare offers and arrange test drives or delivery;
Accredited credit and Rent-To-Buy providers - to assess affordability and approve your application;
Verification, FICA, RICA and credit bureau service providers - to verify identity, address and bank details;
Insurance and tracking providers - where required as a condition of finance or Rent-To-Buy;
Marketing and IT operators - including hosting providers, CRM platforms, WhatsApp Business and Meta (Facebook), bound by appropriate confidentiality and processing obligations;
Auditors, legal advisors, and law-enforcement or regulatory authorities - where lawfully required.

We do not sell your personal information to third parties for unrelated marketing.

6. CROSS-BORDER TRANSFERS

Some of our service providers (for example, cloud hosting and messaging platforms) may store data outside South Africa. Where this is the case, we take reasonable steps under section 72 of POPIA to ensure that the receiving country provides an adequate level of protection, or that contractual safeguards are in place.

7. HOW LONG WE KEEP IT

Active enquiries: for the duration of the engagement, plus 24 (twenty-four) months for follow-up;
Concluded transactions: 5 (five) years from the date of the contract, in line with FICA and NCA recordkeeping requirements;
Marketing data: until you opt out, after which we retain only a suppression record so we don't contact you again;
Backups and audit logs: typically 6 (six) to 12 (twelve) months on rolling rotation.

8. COOKIES AND ANALYTICS

Our landing pages and funnels may use cookies, pixels and similar technologies (including the Meta Pixel and Google Analytics) to measure ad performance, attribute leads, and prevent fraud. You can control cookies through your browser settings. Disabling cookies may affect the functionality of our pages.

9. YOUR RIGHTS UNDER POPIA

You have the right to:

Request access to the personal information we hold about you;
Request correction or deletion of inaccurate, irrelevant, excessive or unlawfully obtained information;
Withdraw consent for any processing based solely on consent (without affecting prior lawful processing);
Object to direct marketing at any time, free of charge;
Object to processing on grounds of legitimate interest, in your specific situation;
Lodge a complaint with the Information Regulator of South Africa.

To exercise any of these rights, contact us using the details in clause 12. We may need to verify your identity before acting on a request.

10. DIRECT MARKETING

We may send you marketing about vehicles, deals and services we believe are relevant to your enquiry. You can opt out at any time by:

Replying "STOP" to a WhatsApp or SMS;
Clicking the unsubscribe link in any marketing email;
Emailing us with the subject line "OPT OUT".

Operational messages relating to an active application or signed contract are not marketing and will continue regardless of opt-out.

11. SECURITY

We apply reasonable, appropriate technical and organisational measures to protect your personal information, including access controls, encrypted transport (HTTPS), restricted-access CRM systems, and staff confidentiality obligations. No method of transmission or storage is perfectly secure. In the event of a security compromise that creates a real risk of harm, we will notify the Information Regulator and affected data subjects as required by section 22 of POPIA.