1. INTRODUCTION

1.1 SendMiza respects the privacy of its users and processes personal information lawfully, reasonably and transparently.

1.2 This Privacy Policy explains how SendMiza collects, uses, stores, shares, secures and otherwise processes personal information through the Platform.

2. RESPONSIBLE PARTY

2.1 SendMiza is the responsible party in respect of personal information processed through its Platform and business operations, except where another party acts as a separate responsible party in law.

2.2 The contact details of SendMiza and its Information Officer shall be published on the Platform and in relevant compliance documents.

3. PERSONAL INFORMATION WE COLLECT

3.1 SendMiza may collect and process the following categories of personal information:

3.1.1 Identity information, including names, surnames, company names, identity or registration details where required, and date of birth where necessary for lawful service provision.

3.1.2 Contact information, including phone numbers, email addresses and physical or delivery addresses.

3.1.3 Account information, including usernames, passwords, authentication credentials and profile information.

3.1.4 Order information, including purchase history, delivery instructions, receipts, support tickets, complaints and ratings.

3.1.5 Payment-related information, including payment tokens, transaction references, billing data and refund information.

3.1.6 Device and technical information, including IP addresses, operating systems, device identifiers, cookies, log data and usage analytics.

3.1.7 Location information, including GPS data, live location, delivery locations, pickup points and route-related information where enabled by the user or required by the service.

3.1.8 Communications content, including messages sent through in-app chat, support correspondence, emails, WhatsApp messages, calls or recordings where lawfully made.

3.1.9 Driver and Merchant onboarding information, including licence details, vehicle details, bank details, insurance records, proof of address, profile photographs and verification records.

3.1.10 Any other information voluntarily provided by a data subject or lawfully obtained from third parties.

4. LAWFUL BASIS FOR PROCESSING

4.1 SendMiza processes personal information on one or more lawful bases recognised by the Protection of Personal Information Act 4 of 2013, including where processing is necessary to conclude or perform a contract, comply with a legal obligation, protect a legitimate interest, pursue SendMiza's legitimate interests or the legitimate interests of a third party, or where consent is required and has been obtained.

5. PURPOSES OF PROCESSING

5.1 SendMiza processes personal information for purposes including:

5.1.1 Creating and managing accounts.

5.1.2 Verifying users, Delivery Partners and Merchants.

5.1.3 Receiving, processing and fulfilling Orders.

5.1.4 Coordinating pickups, delivery routing and proof of delivery.

5.1.5 Processing payments, refunds and reversals.

5.1.6 Communicating with users and responding to support requests.

5.1.7 Preventing fraud, chargeback abuse, theft, tampering and misuse of the Platform.

5.1.8 Maintaining service safety and platform integrity.

5.1.9 Performing analytics, improving system performance and developing services.

5.1.10 Complying with legal, tax, regulatory, insurance and record-keeping duties.

5.1.11 Enforcing contracts, policies and rights.

6. SHARING OF PERSONAL INFORMATION

6.1 SendMiza may share personal information, to the extent reasonably necessary, with:

6.1.1 Merchants, so that Orders can be prepared and fulfilled.

6.1.2 Delivery Partners, so that Goods can be collected and delivered.

6.1.3 Payment service providers, banks and payment gateways.

6.1.4 Cloud hosting, software development, analytics, customer support, messaging and technical service providers.

6.1.5 Insurers, auditors, attorneys, accountants and professional advisers.

6.1.6 Regulators, law enforcement authorities, courts, tribunals and statutory bodies where required or authorised by law.

6.1.7 Other parties where the data subject has consented or where sharing is otherwise lawful.

7. CROSS-BORDER TRANSFERS

7.1 SendMiza may store or process personal information on systems hosted outside South Africa or may use service providers located in other jurisdictions.

7.2 Where personal information is transferred outside South Africa, SendMiza shall implement adequate safeguards or rely on another lawful basis for transfer recognised by applicable law.

8. SECURITY SAFEGUARDS

8.1 SendMiza takes reasonable technical and organisational measures to secure the integrity and confidentiality of personal information in its possession or under its control.

8.2 Such measures may include access controls, password policies, encryption, tokenisation, audit logs, role-based access, secure hosting, incident monitoring, staff confidentiality obligations and operator due diligence.

9. RETENTION OF PERSONAL INFORMATION

9.1 SendMiza retains personal information only for so long as is reasonably necessary for the purpose for which it was collected, unless a longer retention period is required or permitted by law.

9.2 When personal information is no longer required, SendMiza shall delete, destroy, de-identify or anonymise it in accordance with its retention policy and applicable law.

10. DATA SUBJECT RIGHTS

10.1 Subject to applicable law, a data subject may request:

10.1.1 Confirmation whether SendMiza holds personal information about that person.

10.1.2 Access to such personal information.

10.1.3 Correction or updating of inaccurate, incomplete, misleading or outdated information.

10.1.4 Deletion of information where lawful and appropriate.

10.1.5 Objection to certain processing.

10.1.6 Withdrawal of consent where processing is based on consent, provided that withdrawal does not affect earlier lawful processing.

11. SECURITY COMPROMISES

11.1 If SendMiza has reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, SendMiza shall take such steps as are required by applicable law, including investigation, containment and notification where required.

12. DIRECT MARKETING

12.1 SendMiza may send operational communications as part of the service.

12.2 SendMiza shall only send direct marketing communications in a manner permitted by law and subject to the data subject's consent choices and unsubscribe rights where applicable.

13. CONTACT AND COMPLAINTS

13.1 Questions, complaints and requests concerning privacy may be directed to the Information Officer of SendMiza using the contact details published on the Platform.