Privacy Policy — Vroom Valet

Effective date: [INSERT DATE BEFORE PUBLISHING]
Last updated: 2026-09-10

1. Who we are

Vroom Valet is a vehicle-wash booking marketplace operated by Yasuke Consulting ("Vroom Valet", "we", "us", "our"), a company registered in South Africa.

We connect customers with car wash operators near them. This policy explains what personal information we collect, how we use it, and your rights under the Protection of Personal Information Act, 4 of 2013 (POPIA).

Information Officer:
Kutlo Maduma (the head of the organisation is the Information Officer by default under POPIA — this is you as the founder/director)
info@yasuke.co.za
14 Kekana Street, Pretoria, South Africa

If you have questions about this policy or how we handle your data, contact our Information Officer at the details above.

2. Information we collect

2.1 Information you give us directly

| Information | When we collect it | |---|---| | Name, email address, phone number | When you create an account | | Profile photo | If you choose to upload one | | Vehicle details (make, colour, registration) | When you add a vehicle to your account | | Payment card details | Processed and stored by Paystack — we never see or store raw card numbers | | Messages or notes | When you communicate with an operator through the app | | Marketing preferences | When you opt in or out of promotional messages |

2.2 Information we collect automatically

| Information | Why | |---|---| | Device location (GPS) | To show car washes near you when you allow location access | | Address you type | To find car washes near a location you search manually | | Push notification token (device ID) | To send booking updates and, if you opt in, promotional messages | | App usage and booking history | To operate the service and improve it | | Device type, OS version, app version | For compatibility and error diagnosis | | IP address | For security and fraud prevention | | Crash reports and error logs | To identify and fix bugs |

2.3 Information from operators (if you are an operator)

In addition to the above, operators provide:

  • Business name, address, and operating hours
  • Bank account details (collected and verified by Paystack for payment processing)
  • Staff member names and contact details
  • Business logo and photos

3. How we use your information

We use your information to:

  • Operate the service — process bookings, send booking confirmations, connect you with operators.
  • Payments — route payment transactions through Paystack where you choose to pay in-app.
  • Loyalty programme — track stamps and rewards earned at participating operators.
  • Notifications — send you booking status updates (wash received, wash complete, ready for collection). These are transactional and cannot be turned off without disabling notifications entirely.
  • Marketing — send you promotions, offers, and app updates only if you have opted in. You can withdraw consent at any time in Account → Notifications.
  • Safety and security — detect fraud, investigate disputes, enforce our Terms of Service.
  • Improving the product — understand how features are used, diagnose errors, plan improvements.
  • Legal compliance — meet our obligations under South African law, including tax record-keeping.

Our lawful bases under POPIA:

  • Processing is necessary to perform the contract with you (bookings, payments, account management).
  • Processing is necessary for our legitimate interests (security, fraud prevention, product improvement), balanced against your rights.
  • Your consent, where we rely on it (marketing communications).

4. How we share your information

We do not sell your personal information. We share it only as described below.

4.1 With operators

When you make a booking, the operator receives your name, contact number, vehicle details, and booking notes — enough to perform the wash. Operators are required to handle your data in accordance with POPIA.

4.2 With service providers (data processors)

We use the following third-party services. Each receives only the data needed to perform their function:

| Provider | Purpose | Location | |---|---|---| | Paystack | Payment processing and operator payouts | South Africa / Nigeria | | SendGrid (Twilio) | Transactional and marketing email | United States | | Microsoft Azure | Cloud hosting and data storage | South Africa North (Johannesburg) | | Expo / FCM (Google) / APNs (Apple) | Push notification delivery | United States | | Google Maps Platform | Location search and map display | United States | | Sentry | Error tracking and crash reporting | United States | | [Analytics provider — TBC] | App usage analytics | [TBC] |

Where providers are located outside South Africa, we take steps to ensure adequate data protection through contractual safeguards.

4.3 Legal requirements

We may disclose your information where required by law, court order, or to protect the rights and safety of our users or the public.

4.4 Business transfers

If Vroom Valet is acquired or merges with another entity, your data may be transferred as part of that transaction. We will notify you before your data becomes subject to a materially different privacy policy.

5. Data retention

We keep your information for as long as necessary for the purposes described in this policy.

| Data type | Retention period | |---|---| | Account profile and preferences | While your account is active, plus 30 days after a verified deletion request | | Booking history | 5 years from the date of the booking (SARS record-keeping requirement) | | Payment and transaction records | 5 years (tax and financial compliance) | | Device location | Not stored — used in-session only to find nearby car washes | | Push notification tokens | While your account is active | | Marketing consent records | Retained indefinitely as proof of consent | | Error logs and crash reports | 90 days | | Staff and operator data | Duration of the operator's active subscription, plus 5 years for financial records |

After the applicable retention period, data is securely deleted or anonymised so it can no longer be linked to you.

6. Your rights under POPIA

As a data subject under POPIA, you have the right to:

  • Access — request a copy of the personal information we hold about you.
  • Correction — ask us to correct inaccurate or incomplete information.
  • Deletion — ask us to delete your personal information, subject to legal retention obligations.
  • Objection — object to the processing of your information for marketing purposes at any time.
  • Withdraw consent — where processing is based on your consent (e.g. marketing), withdraw it at any time without affecting the lawfulness of prior processing.
  • Complain — lodge a complaint with the Information Regulator of South Africa:

To exercise your rights, contact our Information Officer. We will respond within 30 days.

7. Security

We use industry-standard measures to protect your information, including:

  • Encryption in transit (HTTPS/TLS) and at rest for sensitive data.
  • Access controls — staff access is limited to what is necessary for their role.
  • Secure credential storage on your device using the device's secure enclave (not plain app storage).
  • Regular security reviews.

No system is 100% secure. If you believe your account has been compromised, contact us immediately at security@vroomvalet.co.za.

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the Information Regulator and affected users as required by POPIA.

8. Children

Vroom Valet is a general-audience service and is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

9. Push notifications and marketing

Transactional notifications (booking received, wash in progress, ready for collection) are sent as part of the service. You can disable these in your device settings, but doing so will mean you miss booking updates.

Marketing notifications and emails are only sent if you have opted in. You can opt out at any time:

  • In the app: Account → Notifications → Marketing
  • By clicking "Unsubscribe" in any marketing email
  • By contacting us directly

10. Cookies and tracking

Our mobile app does not use browser cookies. Our operator portal (portal.vroomvalet.co.za) and marketing site (www.vroomvalet.co.za) may use:

  • Strictly necessary cookies — required for the site to function (session management, security). Cannot be disabled.
  • Analytics cookies — help us understand how the portal is used. You can opt out via the cookie banner.

11. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you via email or an in-app notice at least 14 days before the changes take effect. The "last updated" date at the top of this page will always reflect the current version.

Continued use of Vroom Valet after the effective date of changes constitutes acceptance of the updated policy.

12. Contact us

Information Officer:
Kutlo Maduma
Yasuke Consulting
14 Kekana Street, Pretoria, South Africa
info@yasuke.co.za
+27 73 123 3212

For privacy-related requests: privacy@vroomvalet.co.za

This policy applies to the Vroom Valet mobile application, operator portal at portal.vroomvalet.co.za, and marketing site at www.vroomvalet.co.za.