1. Who we are
Kazi Couriers (Pty) Ltd ("Kazi", "we", "us") operates the Kazi Couriers platform, which provides parcel delivery and rides (e-hailing), across South Africa.
- CIPC registration: 2026/384369/07
- Address: Polokwane, Limpopo, South Africa
- Information Officer: Manasse Matsapola · privacy@kazicouriers.co.za
- Designated under the Protection of Personal Information Act, 2013 ("POPIA") s.55.
This policy describes what personal information we collect through the Kazi app, which carries both customer and driver mode in one install, and through the Admin dashboard, why we collect it, who we share it with, and your POPIA rights. It also covers information we hold about merchants, which we collect during onboarding and through the Admin dashboard rather than through an app of their own.
2. Information we collect
We collect only what we need to operate the service.
All app users
- Mobile number (for OTP sign-in and order communication).
- Device identifier and push token (for notifications and fraud signals).
- Crash and performance diagnostics (anonymous; opt-in, default off).
Customers
- Name; email (optional, for receipts).
- Approximate and precise location (when you set an address or track an order; can be denied).
- Saved addresses, order and trip history, and any delivery notes you write.
- The fare or delivery fee for each trip, and whether it was settled. Kazi does not accept card payments and holds no card details (see §5).
Merchants
- Business name, trading name and CIPC number; operator contact details.
- KYC documents (e.g. CIPC certificate, proof of bank account, category licences).
- Listings (items, photos, descriptions, prices); operating hours and delivery radius.
- Order and payout records.
Drivers
- Full name and SA ID or passport details.
- Driver's licence, proof of address, vehicle details and insurance, police clearance.
- Bank account for payouts; trip history, ratings and payouts.
- Precise location while set "online" (foreground and background), used for dispatch and live tracking. Tracking stops when you go offline. See §14.
Everyone
- Support correspondence (email and in-app messages).
Biometric information (special personal information)
Your profile photo is a live selfie taken in the app, and we run an automatic face check on it. For drivers we also compare it against the identity photo you supplied at sign-up. A facial image used to identify someone is special personal information under POPIA s.26, so we set this out separately.
- What we keep: one still image (your profile photo), and a mathematical representation of the face in it used only for the comparison.
- What we do NOT keep: the camera preview frames. The liveness check runs on your device and those frames are never uploaded or stored.
- Why: so a rider and a driver can trust who they are meeting, and so a driver account cannot be handed to someone who was never vetted.
- Our legal ground: your explicit consent under POPIA s.27(1)(a). We ask for it separately, in plain language, immediately before the camera opens. You can decline; you then cannot use features that require a verified photo.
- Human review: a photo that does not match is never auto-rejected into a permanent block. It is held for a person on our team to look at, and you can ask for that review.
- How long: for as long as your account is open, and then per the retention periods in §6.
- Withdrawing: in-app under Settings → Privacy & POPIA. Withdrawing removes your verified photo and the stored comparison data. You will need to give consent again to use features that require a verified photo.
Marketing website visitors
- Email address submitted to the waitlist, used to notify you about launch.
- Name, email, topic and message submitted via the contact form, used to reply.
Website form submissions are handled by a third-party form service and forwarded to a Kazi mailbox hosted in South Africa. To be removed, email privacy@kazicouriers.co.za.
3. How we use it
We process personal information under these POPIA lawful bases:
| Purpose | POPIA basis |
|---|---|
| Account authentication | Performance of contract |
| Matching customers, merchants and drivers | Performance of contract |
| Recording the fare or fee due, and whether it was settled | Performance of contract |
| Order and delivery notifications | Performance of contract |
| Responding to support requests | Performance of contract |
| Promotional messages | Consent (opt-in) |
| Compliance with SARS, POPIA and other SA law | Legal obligation |
| Investigating fraud and platform abuse | Legitimate interest |
| Anonymous analytics | Consent (opt-in) |
We do not sell your personal information.
4. Who we share it with
We share only what is necessary, and only with parties bound by their own privacy obligations:
| Party | What | Why |
|---|---|---|
| Drivers (during your order) | Name, address, phone, order details | Delivery |
| Merchants (during your order) | Name, order details, notes | Preparation |
| Google Maps Platform | Location for address resolution | Maps and dispatch |
| SMS provider | Phone number, OTP code | SMS delivery |
| Firebase / Google Cloud | Data we hold | Hosting |
| SARS / Information Regulator (on request) | What is lawfully required | Legal obligation |
Cross-border processing. Data is hosted in Google Cloud's South Africa region. We do not transfer personal information outside South Africa.
5. Payments
Kazi is cash only. You pay the driver directly, in cash, when the trip or the delivery is complete. There is no card checkout in the app.
We therefore do not collect, process or store a card number, an expiry date or a CVV, and no payment service provider receives your card details through Kazi. What we record against your account is the amount due for each trip or delivery and whether it was settled, which is what lets us show you your history and resolve a dispute.
If Kazi introduces an electronic payment method, we will update this Policy to name the provider and describe the data involved before that method goes live.
6. How long we keep it
| Data | Retention |
|---|---|
| Account data | While your account is active, then a 30-day grace period after deletion |
| Order and financial records | As required by SARS and applicable law |
| Driver and merchant KYC documents | For a period after departure, for compliance and dispute handling |
| Driver location data | A limited period, for safety review and disputes |
| Support correspondence | A limited period |
| Anonymous analytics | No personal information retained |
Once a retention period ends, data is deleted from our systems and backups in the ordinary course.
7. Your POPIA rights
You may:
- Access the information we hold, by email to privacy@kazicouriers.co.za.
- Correct inaccurate information: edit your profile in-app or email us.
- Delete your account, in-app via Settings → Privacy & POPIA → Delete my account (subject to records we must retain by law).
- Object to direct marketing, and withdraw consent for any opt-in processing, via Settings.
- Lodge a complaint with the Information Regulator (South Africa): inforegulator.org.za ·
complaints.IR@justice.gov.za· PO Box 31533, Braamfontein, 2017.
We may verify your identity before actioning a request.
7A. Automated decision-making (POPIA s.71)
Some operational processes are automated, for example driver/ride dispatch ranking, driver scoring, fraud and abuse flags, the 12-hour driver shift cap, document-expiry checks, and order price and fee calculation. These affect operational outcomes, not your legal rights under s.71(1).
You may ask for a human review of an automated decision that affected you by emailing privacy@kazicouriers.co.za with the relevant order or account reference. Account approvals, KYC decisions, refunds and disciplinary actions are reviewed by people, not automated.
8. Children
Kazi is not intended for users under 16. We do not knowingly collect their data. If you believe we hold a minor's data, email privacy@kazicouriers.co.za.
9. Security
- Data is encrypted in transit and at rest.
- KYC documents are stored with restricted, admin-only access.
- Sign-in is OTP-based; we do not store passwords.
- Staff access to data is logged.
- We aim to notify the Information Regulator and affected users of any qualifying data breach as required by POPIA s.22.
10. Cookies, storage and trackers
Kazi apps: no third-party cookies or advertising trackers.
Admin dashboard: one first-party session cookie for sign-in.
This website: one localStorage entry records your cookie-notice choice. We do not use analytics or advertising platforms. Third-party assets we load to render the site (map tiles, fonts, icon and map libraries) may set their own cookies for caching or bot-protection, which we do not control. Browser-level tracking protection can block these; the site degrades gracefully.
11. Changes
We may update this policy. Changes are posted here with a new update date; material changes may also be notified in-app.
12. Contact
- Information Officer: Manasse Matsapola
- Email: privacy@kazicouriers.co.za
- Post: Kazi Couriers (Pty) Ltd, Polokwane, Limpopo
We aim to respond to requests within the period required by POPIA s.23.
13. Android permissions
Kazi ships one Android app. Driver mode is built into it and unlocks once you are approved: there is no separate driver app, and no separate merchant app. The list below is exactly what that one app declares, and nothing more, so no row here is a permission claimed on behalf of any other Kazi app. Each is requested at the point of use, and you can deny it and continue in degraded mode.
| Permission | Why |
|---|---|
ACCESS_FINE_LOCATION / ACCESS_COARSE_LOCATION | Finding you a driver, live tracking, address suggestions and pricing. |
CAMERA | Your profile selfie, KYC document photos and QR scanning. |
POST_NOTIFICATIONS | Trip, delivery and job-offer alerts. |
FOREGROUND_SERVICE / FOREGROUND_SERVICE_LOCATION | Keeping location running while a trip is on screen and in progress, with a visible notification. See §14. |
WAKE_LOCK | Delivering a job offer while the screen is off. |
VIBRATE | Haptic feedback, and the alert when a job offer arrives. |
READ_EXTERNAL_STORAGE | Attaching a photo you already have, on Android 12 and older. Android 13 and newer use the system photo picker, which needs no permission at all. |
WRITE_EXTERNAL_STORAGE | Saving a picked image to the app’s own cache while it uploads, on Android 9 and older only (maxSdkVersion 28). Android 10 and newer never request it. |
INTERNET / ACCESS_NETWORK_STATE | API calls and connectivity checks. |
We do not request background location, contacts, call logs, SMS, microphone or calendar. If a future feature needs an additional permission, we will update this policy first and ask you at the point of use.
14. Location while driving
Location is collected only while a driver is set online or has a job in progress. It stops when the driver goes offline, the job ends, or they sign out.
We use an Android foreground service, which means a notification stays visible in the status bar the entire time location is being collected. We do not request ACCESS_BACKGROUND_LOCATION: if the app is fully backgrounded, location collection is governed by Android’s foreground-service rules and the visible notification, not by a background-location grant.
Location is used for dispatch, the customer’s live map, navigation and safety. A trip trace is retained for a limited period for safety review and disputes. We do not sell or share location data, and we never use it for advertising. See §4.
15. Document versions and your consent
This policy carries a version number (shown at the top). When you accept it in the app we record which version you accepted and when, so both you and we can tell later exactly what was agreed. If we publish a materially changed version, the app asks you to review and accept it again.
You can see what you have accepted, and withdraw any consent that is optional, under Settings → Privacy & POPIA.