Privacy & POPIA Policy

1. Introduction

At OneFreight, operated by OneFreight (Pty) Ltd, we take your privacy seriously. This Policy explains how we collect, use, store, and protect your personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and all associated regulations.

POPIA is South Africa's primary data protection law. It grants individuals meaningful rights over their personal information and places clear obligations on organisations that process that information. Our commitment is to process personal information lawfully, fairly, transparently, and only for the purposes described in this Policy.

2. Who We Are / Information Officer

The responsible party (as defined under POPIA) for your personal information is:

• Organisation: OneFreight (Pty) Ltd
• Platform: OneFreight (live.onefreight.co.za)
• Information Officer: The designated Information Officer can be contacted at legal@onefreight.co.za

Our Information Officer is responsible for ensuring the Platform's compliance with POPIA and for handling any access requests, complaints, or data-related queries from data subjects.

3. Personal Information We Collect

We collect personal information that is necessary to operate the Platform and facilitate freight bookings. This includes:

For all users:

• Full name and surname;
• Email address and mobile number;
• Business name and registration number (CIPC or equivalent);
• VAT registration number (where applicable); and
• Physical and postal business address.

For Transporters, additionally:

• South African ID number or passport number of account holders and drivers;
• Professional driving permit (PrDP) details;
• Vehicle registration numbers, make, model, and roadworthiness certificate details;
• Operating licence numbers and coverage details;
• Insurance policy details and insurer contact information; and
• Bank account details for payment settlements.

For Consignors, additionally:

• Bank details used for Platform payments;
• Delivery address and Receiver contact information; and
• Load details including commodity descriptions and value declarations.

Usage and technical data:

• Device type, browser, and operating system;
• IP address and approximate geolocation;
• Pages visited, features used, and session duration; and
• Real-time or near-real-time vehicle location data during active load deliveries (Transporters).

4. How We Collect It

We collect personal information in the following ways:

• Directly from you, when you register, complete your profile, post a load, accept a booking, submit documents for vetting, or contact our support team;
• Automatically, through cookies, analytics tools, and server logs when you use the Platform (see clause 10);
• From third parties, such as credit bureaux, the Companies and Intellectual Property Commission (CIPC), the National Traffic Information System (NaTIS), or identity verification service providers, for the purpose of verifying credentials; and
• From other users, for example when a Consignor provides Receiver contact details as part of a Load posting.

5. Purpose of Processing

We process your personal information only for specific, legitimate, and clearly defined purposes, including:

• Creating and managing your account on the Platform;
• Verifying your identity, credentials, and eligibility to use the Platform;
• Matching Consignors with suitable Transporters for specific Loads;
• Processing payments and facilitating payment settlements;
• Communicating with you about bookings, service updates, and support requests;
• Monitoring Platform activity to detect and prevent fraud or policy violations;
• Complying with our legal obligations under South African law; and
• Improving the Platform through anonymised usage analytics.

We will not use your personal information for purposes that are incompatible with those listed above without first obtaining your explicit consent.

6. Sharing of Information

We share personal information only where necessary and with appropriate safeguards in place. Recipients may include:

• Other Platform users: Consignors receive limited Transporter profile information (name, ratings, verified credentials) when browsing matches. Transporters receive Consignor contact details and delivery instructions upon Booking confirmation;
• Payment processors: Secure third-party payment gateway providers who process card transactions and bank transfers on our behalf, under strict data processing agreements;
• Verification service providers: Third-party identity and credential verification partners used during the Transporter onboarding process;
• Regulators and law enforcement: Where required to comply with a legal obligation, court order, or lawful request from a South African regulatory or enforcement authority; and
• Professional advisors: Auditors, legal counsel, or insurers, under strict confidentiality obligations.

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

7. Data Retention

We retain your personal information for as long as necessary to fulfil the purposes described in this Policy and to comply with our legal and regulatory obligations. Specifically:

• Account information is retained for the duration of your active account plus 5 years after account closure, in line with general commercial document retention requirements;
• Booking and transaction records are retained for 5 years to satisfy tax, audit, and legal compliance requirements;
• Identity and vetting documents are retained for 3 years after the last active booking under a Transporter's account; and
• Website usage logs and analytics are retained for up to 24 months.

When retention periods expire, personal information is securely deleted or anonymised so that it can no longer be attributed to an identifiable individual.

8. Your Rights under POPIA

As a data subject under POPIA, you have the following rights with respect to your personal information held by OneFreight (Pty) Ltd:

To exercise any of these rights, please contact our Information Officer at legal@onefreight.co.za. We will respond within a reasonable time, and in any event within 30 days as required by POPIA.

9. Security Measures

OneFreight (Pty) Ltd implements reasonable and appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, alteration, disclosure, or destruction. These measures include:

• TLS/HTTPS encryption for all data transmitted to and from the Platform;
• Encrypted storage for sensitive data including identity documents and banking details;
• Role-based access controls ensuring that staff can only access personal information required for their specific duties;
• Regular security assessments and penetration testing of Platform infrastructure; and
• Incident response procedures to detect, contain, and report data breaches in line with POPIA requirements.

In the event of a data breach that is likely to prejudice a data subject, we will notify the Information Regulator and affected individuals as required by POPIA Section 22.

10. Cookies and Tracking

The Platform uses cookies and similar tracking technologies to enhance your experience and gather usage analytics. Cookies we use include:

• Essential cookies: Required for the Platform to function, including session authentication and security tokens. These cannot be disabled.
• Analytics cookies: Used to understand how users interact with the Platform, which features are used most, and where friction occurs. Data is aggregated and anonymised.
• Preference cookies: Used to remember your display preferences and settings between sessions.

You can manage or disable non-essential cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the Platform.

11. Third-Party Services

The Platform may integrate with or link to third-party services such as mapping providers, payment gateways, and communication tools. These third parties have their own privacy policies, and we encourage you to review them. OneFreight (Pty) Ltd is not responsible for the privacy practices of third-party services.

Where we use third-party data processors on your behalf, we ensure that appropriate data processing agreements are in place to protect your personal information.

12. How to Exercise Your Rights / Complaints

To exercise any of your POPIA rights, or to raise a concern about how we handle your personal information, please contact us:

• Email: legal@onefreight.co.za
• Subject line: "POPIA Rights Request" or "Privacy Complaint"

If you are not satisfied with our response, or believe we are processing your personal information unlawfully, you have the right to lodge a complaint with the Information Regulator of South Africa:

• Website: www.justice.gov.za/inforeg
• Email: inforeg@justice.gov.za

13. Changes to This Policy

We may update this Privacy & POPIA Policy from time to time to reflect changes in the law, our services, or our data practices. We will notify registered users of material changes by email and by displaying a notice on the Platform. The revised Policy will show a new effective date at the top of the page.

We encourage you to review this Policy periodically to stay informed about how we protect your information.

14. Contact

For all privacy-related queries, requests, or complaints, please contact our Information Officer:

• Email: legal@onefreight.co.za
• Operator: OneFreight (Pty) Ltd
• Platform: live.onefreight.co.za