Privacy & POPIA

ZamaSU Privacy Policy

This Privacy Policy explains how ZamaSU collects, uses, stores and protects your personal information. By using ZamaSU, you consent to the practices described in this policy. Your privacy is important to us and we are committed to compliance with the Protection of Personal Information Act 4 of 2013 (POPIA).

K2026398003 (South Africa) (Pty) Ltd

CIPC: 2026/398003/07

Updated: 30 September 2026

Republic of South Africa

POPIA Compliant Personal information is processed in accordance with South African data-protection requirements.

No Sale of Personal Data ZamaSU does not sell your personal information.

No Fund Custody Underlying payments are executed by enabled third-party payment providers.

Your Rights You may request access, correction, deletion and exercise other POPIA rights.

Who We Are

K2026398003 (South Africa) (Pty) Ltd (CIPC registration number 2026/398003/07), trading as ZamaSU ("ZamaSU", "we", "us", "our"), is a South African company registered and operating in the Republic of South Africa.

We operate the ZamaSU platform at zamasu.co.za: a jobs marketplace with a directory of service providers and their reviews, a platform wallet and transaction ledger funded only through payment methods made available by an enabled third-party payment gateway, a voucher and merchant network, an online shop with delivery, ZamaSwap (a second-hand marketplace), and a taxi payments and rank-queue service.

Payment Model

ZamaSU does not accept manual EFT payments or direct bank deposits for platform transactions and does not hold user funds.

POPIA Responsible Party

ZamaSU is the Responsible Party as defined under POPIA for all personal information collected through its platform.

Information Officer: info@zamasu.co.za

Information We Collect

2.1 Customer & Provider Accounts

When you register as a customer or service provider, we collect:

Full name.
Phone number and/or email address.
Profile photo (optional).
Physical address or general location, used for job matching and service delivery.
Government-issued ID number for identity verification.
Date of birth.
Bank account details for wallet withdrawals and payouts.
Skills, service categories and portfolio items for Providers.

2.2 Merchant (Retailer) Accounts

When you register as a ZamaSU Merchant, we additionally collect:

Business name, trading name and legal status.
Business registration number or company registration number.
Business physical address and operating hours.
Business bank account details for settlement.
Business logo and shop photo, where supplied.
Merchant Portal credentials and API credentials where issued.
Voucher redemption history, shop orders, delivery records, settlement records and accounting ledger data.
Identity documentation of the account representative, such as ID or passport.
Staff accounts created for cashiers and records of which staff member performed particular actions.

2.3 Taxi Driver Accounts

If you register as a taxi driver, we additionally collect:

Vehicle registration and, where required, operating licence or permit details.
Routes and fares you publish and ranks you nominate as your home ranks.
Your device location while you are marked online as a driver.
Fares taken through the platform and change offers made to commuters.

2.4 Taxi Rank Marshall Applications

If you apply to be a rank marshall, we collect your application, any rank you name in it, the reviewing administrator's decision and the ranks you are subsequently assigned to.

2.5 Transaction & Wallet Data

Job postings, bids and accepted offers.
Payment amounts, platform wallet or ledger balances and transaction records.
Payment-gateway transaction references and status information.
Voucher issuance, redemption status and settlement records.
Shop orders, delivery records and delivery confirmations.
Taxi fare payments, change offers and cash-out instructions.
Withdrawal requests and payout details.
Top-up amount, selected payment method, provider reference and payment-provider transaction status.
Refund, reversal and payout records received from the payment provider.
ZamaSwap listings, photos, offers, orders and buyer-seller chat.
Platform fee records.

2.6 Queue & Rank Data

Which queue you joined, at which rank, for which destination, when you joined and how many people were travelling with you.
Whether you boarded, left the queue or the queue expired.
For drivers: queues accepted and recorded arrival, loading and departure times.
Aggregated daily statistics per rank and route used to estimate waiting times.

2.7 Security Data

Your payment PIN, stored only as a one-way cryptographic hash. ZamaSU never stores or sees the PIN itself.
Failed PIN attempt counts and lockout timestamps.
Device credentials registered for fingerprint or face unlock.

ZamaSU does not receive your fingerprint or facial biometric data. These remain on your own device.

2.8 Device & Usage Data

IP address and approximate geolocation.
Device type, browser and operating system.
Pages visited, features used and session duration.
Push notification tokens where you opt in.
Error logs and crash reports.

2.9 Communications

We may process messages sent through the ZamaSU platform, including messages between a customer and a shop about an order and enquiry messages between a customer and a service provider before a job is agreed.

Phone numbers, email addresses and messaging links in enquiry messages are hidden automatically until a job is agreed.

Support enquiries and dispute correspondence.
Ratings and reviews.
Notices posted by rank marshalls and incidents they log.

2.10 Photos and Comments About Finished Work

We process photos you add to a job (before and after), a delivery or a ZamaSwap listing; the rating and written comment a customer leaves; and, for each job or delivery, whether you have chosen to show it publicly.

When a photo is shown publicly on the Reviews page, it is first re-saved so that location and camera metadata hidden in the original file is removed.

How We Use Your Information

To create and manage your account.
To verify your identity and comply with legal requirements.
To facilitate job matching between Requestors and Providers.
To facilitate payments, platform wallet transactions, top-ups, withdrawals, cash-outs, refunds, reversals, payouts and Merchant settlements through enabled third-party payment gateways.
To reconcile platform records against payment-provider transaction records.
To show service providers in the Find a pro directory.
To operate enquiry chat before a job is agreed.
To show finished work and ratings on the Reviews page.
To operate and settle the ZamaSU Merchant Network and ZamaSU Shop.
To arrange and track deliveries.
To record taxi fare payments and change offers.
To place you in a queue, calculate your queue position and estimate waiting times.
To tell drivers where demand is and notify you when a taxi has been assigned to your queue.
To investigate and resolve disputes.
To detect, prevent and investigate fraud or abuse.

Sharing Your Information

Privacy Commitment

We do not sell your personal information.

We may share your information with:

Other platform users and the public where information forms part of your public profile or Find a pro listing.
A Merchant you buy from, limited to the details required to fulfil and deliver your order.
A driver whose taxi you paid or whose queue you joined, limited to your name and the relevant transaction or queue details.
A rank marshall at the rank where you are queuing, limited to your queue position and party size.
Payment gateways, payment service providers and their banking partners.
Identity-verification providers where required for KYC compliance.
Legal and regulatory authorities where required by court order, subpoena, legal process or regulatory request.
Fraud-prevention agencies where fraudulent activity is suspected.
Hosting, email-delivery, push-notification and monitoring service providers operating under confidentiality obligations.

Payment Providers

To facilitate a payment or top-up, ZamaSU may provide the amount, transaction reference and, where required, your name and contact information to the enabled payment provider.

The provider may return whether the transaction succeeded, failed, remains pending, was cancelled or was reversed, together with limited transaction metadata required for reconciliation and fraud prevention.

To facilitate a payout, withdrawal, refund, job or sale payout or Merchant settlement, the identifying and destination-payment information required by the payment provider, amount and relevant transaction reference may be supplied.

The payment provider, not ZamaSU, executes the underlying movement of funds.

External Couriers

ZamaSU does not share your details with external couriers.

Where a shop books a named external courier such as Paxi, Uber Courier or Bolt Parcel, the shop makes that booking directly with the courier and provides the information required by that courier.

ZamaSU has no account or integration with those external courier services.

International Processing

All third parties who receive your data from ZamaSU are contractually required to handle it in accordance with POPIA and ZamaSU's instructions.

Some service providers, such as SMS-delivery or hosting providers, may process information outside South Africa. Where this occurs, ZamaSU requires those providers to protect the information to the standard required by POPIA.

6.1 What Is Shown Publicly

Find a pro

For service providers, and only where you have a profile photo, the directory may display:

Your name as an initial and surname, for example "L. Dlamini".
Your profile photo.
Your bio.
Your service categories.
Your rating and number of jobs completed.
An approximate distance band from the person searching.

Your address is never shown. Remove your profile photo or stop being a Provider to leave the directory.

Reviews & Completed Work

A finished job or delivery may be shown with its before-and-after photos, star rating and customer's comment, with names displayed as an initial and surname and images cleaned of location metadata.

You can switch this off at any time under:

Settings → Show my work in Reviews

Your jobs and deliveries, whether as customer or Provider, and their photos will then be hidden and their images will no longer be served.

This is your right to object under POPIA.

Enquiry Messages

Enquiry messages are visible only to the two people participating in the chat.

ZamaSU staff read them only where required to handle a report, dispute or abuse matter.

ZamaSwap

ZamaSwap listings, their photos and the seller's name are visible to other members.

The item's exact address is shared only with a buyer once an order is placed. The public sees the suburb only.

Location Data

ZamaSU may use your device location to show nearby jobs, find the taxi rank nearest you, calculate distances and improve job matching.

Location data is used for these functional purposes only and is never sold or shared with advertisers.

7.1 Drivers Who Are Online

If you are a taxi driver and mark yourself online, your device periodically sends its position so that commuters can see that taxis are in the area and queues can be matched to nearby drivers.

This processing is deliberately limited:

It occurs only while you are marked online and stops when you close or background the app.
Location updates slow down while you are parked.
Updates slow further when your battery is low.
A location is added to your movement trail only where you have moved a meaningful distance.
Your movement trail is deleted after 48 hours.

7.2 What Other People See

Taxis displayed to commuters on the map are anonymous and approximate.

No name, registration number or identifier is attached. The only driver identified to you is a driver who has accepted the specific queue you are in.

Drivers are never attributed to a particular rank. Being near a rank represents a position, not an allegiance.

You may disable location access in your device settings at any time, although doing so will limit features that depend on location.

Push Notifications

If you opt in to push notifications, ZamaSU may send you:

Job alerts.
Payment confirmations.
Dispute updates.
Queue and taxi-arrival alerts.
Platform announcements.

You may withdraw consent at any time using your device's notification settings or your ZamaSU account preferences.

You may also mute announcement pop-ups without switching off transactional notifications.

Community Moderation & Rank Operators

ZamaSU may appoint community moderators and rank marshalls who have limited access to platform content to assist with dispute resolution, safety and rank operations.

Their access is scoped. A moderator sees only what their moderation duties require, while a marshall sees only the ranks assigned to them.

All such persons are bound by confidentiality obligations.

Data Retention

Data Category	Retention Period
Active accounts	Retained for as long as your account remains active.
Closed accounts	Core records retained for 5 years to comply with South African financial and tax record-keeping laws.
Transaction records	Payment-provider references, wallet or ledger records, top-ups, payouts, refunds, reversals and settlement records retained for a minimum of 5 years, subject to applicable legal requirements.
Enquiry messages	Retained while your account remains open and deleted when your account is deleted, unless a dispute or legal obligation requires retention.
Identity verification	ID documents retained for the period required by applicable regulations.
Dispute records	5 years after final resolution.
Driver location trails	Deleted after 48 hours.
Queue activity events	Deleted after 90 days.
Finished queue memberships	Deleted after 180 days. A queue place currently held is never deleted while live.
Technical usage logs	Retained for up to 12 months for security and debugging.
Aggregated rank & route statistics	Aggregated data contains no individual identity and is retained to maintain accurate waiting-time estimates.

Your Rights Under POPIA

As a data subject under the Protection of Personal Information Act 4 of 2013, you have the right to:

Access Request a copy of the personal information ZamaSU holds about you.

Correction Request correction of inaccurate or outdated information.

Deletion Request deletion of your information, subject to legal retention obligations.

Objection Object to the processing of your information in certain circumstances.

Restriction Request that ZamaSU limit how your information is processed in certain circumstances.

Complain Lodge a complaint with the Information Regulator of South Africa if you believe POPIA has been violated.

To exercise any of these rights, contact the ZamaSU Information Officer:
info@zamasu.co.za

ZamaSU will respond within 30 days.

Security

ZamaSU implements technical and organisational security measures to protect your personal information, including:

AES-256 encryption for sensitive data at rest, including bank account details and credentials.
One-way hashing for passwords and payment PINs. Neither is stored in readable form.
HTTPS/TLS encryption for data in transit.
Access controls restricting staff access to personal data on a need-to-know basis.
Audit trails recording administrative actions performed on accounts and platform transaction records.
Regular security reviews and vulnerability monitoring.

Security Notice

While ZamaSU takes reasonable steps to protect your information, no internet-based system is completely secure.

You are responsible for keeping your account credentials, password and payment PIN confidential.

Cookies & Tracking

ZamaSU uses session cookies for authentication and functionality and stores a small amount of data on your device to remember preferences and maintain an unfinished cash-change calculation.

ZamaSU does not use third-party advertising cookies or tracking pixels.

You may configure your browser to decline cookies. However, doing so will prevent you from logging into the platform.

Children's Privacy

ZamaSU is not intended for users under the age of 18.

ZamaSU does not knowingly collect personal information from minors.

If you believe a minor has registered on the platform, notify ZamaSU at info@zamasu.co.za and the account will be closed and associated data deleted.

Changes to This Policy

ZamaSU may update this Privacy Policy from time to time.

Material changes will be communicated to registered users by email or in-platform notification at least 30 days before taking effect.

The effective date at the top of this document reflects the most recent update.

Continued use of the platform after a policy update constitutes your acceptance of the revised policy.

Contact & Complaints

K2026398003 (South Africa) (Pty) Ltd

Trading as ZamaSU
CIPC registration number: 2026/398003/07
Republic of South Africa

Information Officer info@zamasu.co.za

Support support@zamasu.co.za

ZamaSU zamasu.co.za

Information Regulator of South Africa justice.gov.za/inforeg

ZamaSU · K2026398003 (South Africa) (Pty) Ltd · CIPC 2026/398003/07 · Privacy Policy · Updated 30 September 2026