Privacy Policy

Effective Date: 17 June 2025

1. Introduction

Welcome to CrabaRide!

Crab a Ride South Africa PTY LTD ("the company", "we", "our", or "us"), operating through our platform at crabaride.co.za (the "Website"), values your privacy and is committed to protecting your personal data. This Privacy Policy outlines how we collect, use, store, and protect your personal information in accordance with the South African Protection of Personal Information Act (POPIA), General Data Protection Regulation (GDPR) and other applicable regulations.

By accessing or using the Website, you agree to the collection and use of your information in accordance with this Privacy Policy.

2. Entity Information and Data Controller

Primary Operating Entity: Crab a Ride PTY LTD

Registration Number: 2024/236152/07

Address: 74 Queen Victoria Street, Cape Town, 8001, South Africa

Related Entity: Crab a Ride South Africa PTY LTD

Crab a Ride PTY LTD acts as the primary data controller for all personal information processing activities related to the carpooling platform services. Where services involve both entities, we will clearly specify the responsible entity for each data processing activity.

3. Information Officer Details

Email: privacy@crabaride.co.za

Phone: +27 74 421 98 07

Address: 74 Queen Victoria Street, Cape Town, 8001, South Africa

Our Information Officer is registered with the Information Regulator of South Africa and is responsible for ensuring compliance with POPIA and handling all data protection inquiries and requests.

4. Data We Collect

We collect the following types of personal data:

  • Personal Identification Data: First and last name, photograph of user's face and body, ID number, picture of national ID, passport or driver's license, country of issuing document, phone number, WhatsApp-registered phone number, and IP address.
  • Driver-Specific Data: Pictures of driver's licence, car registration documents, proof of insurance and insurance company details, car photographs, car model and brand, licence plate number, date of first registration, and vehicle age.
  • Trip Data: Departure and arrival points (via Google Maps API), current location, route taken during the trip, pricing per seat, trip dates and times, booking information, and travel patterns.
  • Usage Data: Registration data, platform interaction data, search queries, trip uploads, and functionality usage patterns.
  • Payment Data: Bank details and credit card number when required for payment or disbursement.
  • WhatsApp Data: Profile status and picture verification data for identity confirmation purposes.
  • Ratings and Feedback: User ratings, driver and passenger feedback, and platform improvement suggestions.
  • AI-Related Data: Trip matching preferences, behavioral patterns for algorithm optimization, messages, and anonymized data for machine learning model training.

5. How We Use Your Data

We process your personal data for the following purposes:

  • Core Services: Facilitating trip bookings and connecting drivers with riders
  • Identity Verification: Confirming user identity and platform eligibility
  • Account Management: Processing and managing accounts and trip arrangements
  • Communication: Account notifications, trip confirmations, and service updates
  • AI-Powered Matching: Using machine learning algorithms to optimize driver-passenger connections
  • Safety and Security: Ensuring user safety through verification and monitoring
  • Service Improvement: Analyzing usage patterns and personalizing user experiences
  • Legal Compliance: Meeting regulatory requirements including transport legislation
  • Partner Offers: Providing relevant discounts from verified partners based on usage patterns

AI Decision-Making: Our platform uses artificial intelligence to match drivers and passengers, suggest optimal routes, and personalize user experiences. You have the right to request human review of any automated decisions that significantly affect you.

6. Legal Basis for Processing

We process your personal data based on the following legal grounds:

  • Consent: For WhatsApp communications and marketing preferences
  • Contract Performance: For trip facilitation and account management
  • Legal Obligation: For driver verification and transport regulation compliance
  • Legitimate Interest: For safety, security, and service improvement purposes

7. Data Storage and Security

Your personal data is stored on:

  • Google Cloud: Johannesburg, South Africa data center
  • MongoDB Atlas: AWS server, Cape Town, South Africa
  • WhatsApp Servers: For communication data
  • Twilio Servers: For communication data
  • Chatwoot servers: For communication data
  • AI Training Infrastructure: Secure, anonymized data processing environments

Data Retention: Personal data is retained only as long as necessary for the purposes outlined above, with specific retention periods varying by data type and legal requirements. AI training data is anonymized and subject to separate retention policies.

Implementation Measures: We implement comprehensive technical and organizational measures including encryption, access controls, regular security assessments, and staff training to protect your data from unauthorized access, use, disclosure, alteration, or destruction.

8. Cross-Border Data Transfers

Some data processing may involve transfers outside South Africa for:

  • AI Model Training: Secure processing for machine learning improvements
  • WhatsApp Communications: International messaging infrastructure
  • Cloud Services: Backup and redundancy purposes

All international transfers comply with POPIA requirements and include appropriate safeguards such as adequacy decisions or standard contractual clauses.

9. Your Rights Under POPIA and GDPR

You have the following rights regarding your personal data:

  • Right to Access: Request copies of your personal data
  • Right to Rectification: Correct inaccurate or incomplete information
  • Right to Erasure: Request deletion under certain conditions
  • Right to Restrict Processing: Limit processing under specific circumstances
  • Right to Data Portability: Transfer your data to another service provider
  • Right to Object: Object to processing for specific purposes
  • Right to Withdraw Consent: Revoke consent for consent-based processing
  • Right to Human Review: Challenge automated decision-making processes

To exercise these rights, contact our Information Officer at privacy@crabaride.co.za.

10. SMS and WhatsApp Communications

Upon registration, users can opt-in to receive WhatsApp messages for account management and trip notifications. Alternative SMS authentication is available with local network charges applying. We use these channels for:

  • Authentication: Secure login verification
  • Trip Management: Booking confirmations and updates
  • Safety Communications: Emergency contact and verification
  • Community Features: Trip-specific group communications

Communication preferences: Users can modify communication preferences by contacting contact@crabaride.co.za.

WhatsApp Business Compliance: Our WhatsApp communications comply with enhanced security requirements including data backup policies, employee device management, and cross-border data flow protections.

11. Data Sharing and Third Parties

We do not sell or trade your personal data. Limited sharing occurs only for:

  • Service Providers: Essential platform functionality and security
  • Legal Requirements: Compliance with court orders or regulatory demands
  • Safety Purposes: Emergency situations requiring user protection
  • Transport Authorities: Driver verification and licensing compliance

All third parties are contractually bound to maintain data confidentiality and security standards equivalent to our own.

12. Breach Notification

In the event of a data breach that poses significant risk to your rights and freedoms, we will:

  • Notify the Information Regulator within 72 hours of discovery
  • Inform affected users without undue delay
  • Provide clear information about the breach and protective measures
  • Implement immediate remedial actions

13. Children's Privacy

Our services are not intended for users under 18 years of age. We do not knowingly collect personal information from minors and will delete such data if discovered.

14. Updates to This Privacy Policy

We may update this Privacy Policy to reflect legal changes, service improvements, or regulatory requirements. Significant changes will be communicated through:

  • Website notifications
  • Email or WhatsApp messages to registered users
  • Direct notification for material changes affecting your rights

Continued use of our services after updates constitutes acceptance of revised terms.

15. Contact Information

Data Protection Inquiries:

Email: privacy@crabaride.co.za

Address: Crab a Ride South Africa PTY LTD, 74 Queen Victoria Street, Cape Town, 8001, South Africa

Information Regulator: For complaints or concerns about our data practices, contact the Information Regulator of South Africa at inforeg@justice.gov.za.

SHARE VIA