1. Introduction
TOPDOWN CAR RENTALS (PTY) LTD ("TopDown", "we", "us", or "our") is committed to protecting your personal information in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA") and all other applicable South African privacy legislation.
This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website (www.topdown.co.za), use our client portal, or enter into a rental agreement with us.
By using our services, you consent to the data practices described in this policy. If you do not agree with the terms of this Privacy Policy, please do not use our services.
Information Officer
Our Information Officer is responsible for ensuring compliance with POPIA. You may contact our Information Officer at info@topdown.co.za or by telephone at 073 738 4821.
2. Information We Collect
We collect information in the following ways:
2.1 Information You Provide Directly
- Full name, email address, phone number and physical address
- South African ID number or passport number
- Driver's licence number and expiry date
- Payment card details (processed securely via Yoco — we do not store card data)
- Booking preferences, special requests, and rental agreement information
- Photographs and documents uploaded to our client portal (driver's licence, ID, experience photos)
- Communications you send us via email, WhatsApp, or our contact forms
2.2 Information Collected Automatically
- IP address, browser type, operating system, and device identifiers
- Pages visited, time spent on pages, and navigation paths on our website
- Referring URLs and search terms used to find our website
- Cookies and similar tracking technologies (see Section 6)
2.3 Information from Third Parties
- Vehicle tracking data from any tracking device installed in our vehicles
- Traffic fine and e-toll information from SANRAL and relevant authorities
- Payment verification information from our payment service providers
3. How We Use Your Information
We use your personal information for the following legitimate purposes:
3.1Rental Services: To process your booking request, manage your rental agreement, communicate about your rental, and handle payments and deposits.
3.2Client Portal: To create and manage your account, provide access to booking history, invoices, and documents, and enable secure communications.
3.3Safety and Security: To verify your identity and driver's licence, ensure compliance with our Terms and Conditions, and protect our vehicles and business interests.
3.4Legal Compliance: To comply with South African law, respond to lawful requests from authorities, and assist with traffic fine administration and e-toll recovery.
3.5Communication: To send you booking confirmations, invoices, payment receipts, and important service updates.
3.6Marketing (with consent): To send you promotional offers, newsletters, and targeted advertisements. You may opt out at any time.
3.7Service Improvement: To analyse usage patterns, improve our website functionality, and enhance our rental services.
4. Sharing Your Information
We do not sell your personal information. We may share your information in the following circumstances:
4.1Service Providers: We share information with trusted third-party service providers who assist us in operating our business, including Supabase (database hosting), Yoco (payment processing), Brevo (email delivery), and Vercel (website hosting). These providers are contractually bound to protect your information.
4.2Legal Requirements: We may disclose your information when required by South African law, court order, or government authority, including disclosing your details to SANRAL for e-toll recovery as authorised under our Terms and Conditions.
4.3Advertising Platforms: With your consent as set out in Section 12 of our Terms and Conditions, we may share your name, email address, and contact details with third-party advertising platforms (such as Meta and Google) for the purpose of delivering targeted marketing. You may withdraw this consent at any time by contacting our Information Officer.
4.4Business Transfers: In the event of a merger, acquisition, or sale of our business, your information may be transferred to the successor entity, subject to this Privacy Policy.
4.5Insurance: We may share relevant information with our insurers in connection with claims arising from rental incidents.
5. Data Security
5.1We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, disclosure, alteration, or destruction. These measures include encrypted data transmission (HTTPS/TLS), secure database hosting with row-level security, and access controls limiting who can view your information.
5.2Payment card information is processed exclusively through Yoco's PCI DSS compliant payment infrastructure. We do not store, transmit, or have access to your full card details.
5.3Despite our best efforts, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security of your information and encourage you to use strong, unique passwords for your portal account.
5.4In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the Information Regulator in accordance with POPIA requirements.
6. Cookies and Tracking Technologies
6.1Our website uses cookies and similar technologies to enhance your browsing experience, analyse website traffic, and deliver targeted advertisements.
6.2Essential Cookies: Required for the website and client portal to function correctly. These cannot be disabled.
6.3Analytics Cookies: Help us understand how visitors interact with our website so we can improve our services.
6.4Marketing Cookies: Used to deliver relevant advertisements and measure the effectiveness of our marketing campaigns. These are only set with your consent.
6.5You can control cookie preferences through our cookie consent banner when you first visit our site, or by adjusting your browser settings. Note that disabling certain cookies may affect the functionality of our website.
7. Your Rights Under POPIA
As a data subject under the Protection of Personal Information Act, you have the following rights:
7.1Right of Access: You have the right to request a copy of the personal information we hold about you.
7.2Right to Correction: You have the right to request correction of inaccurate or incomplete personal information. You can update your profile information directly through your client portal.
7.3Right to Deletion: You have the right to request deletion of your personal information where we no longer have a lawful basis to retain it, subject to legal retention obligations.
7.4Right to Object: You have the right to object to the processing of your personal information for direct marketing purposes at any time.
7.5Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time by contacting our Information Officer. Withdrawal does not affect the lawfulness of processing before withdrawal.
7.6Right to Complain: You have the right to lodge a complaint with the Information Regulator if you believe we have violated your privacy rights. The Information Regulator can be contacted at inforeg@justice.gov.za.
To exercise any of these rights, please contact our Information Officer at info@topdown.co.za. We will respond within 30 days.
8. Data Retention
8.1We retain your personal information for as long as necessary to fulfil the purposes set out in this Privacy Policy, unless a longer retention period is required or permitted by law.
8.2Rental records and associated personal information are retained for a minimum of 5 years after the rental period ends, in accordance with South African financial record-keeping requirements.
8.3Client portal accounts that are inactive for more than 3 years may be deactivated. You will be notified before any deactivation.
8.4Documents uploaded to the portal (driver's licence, ID documents) are retained for the duration of your account and for a reasonable period after account closure to support any outstanding claims.
9. Third-Party Services
Our services integrate with the following third-party platforms. Each has its own privacy policy:
Supabase
Database and authentication infrastructure. Your account data and rental records are stored on Supabase servers in the EU region.
Yoco
Payment processing. Yoco processes your card payments in accordance with PCI DSS standards. We do not store your card details.
Brevo (Sendinblue)
Transactional email delivery for booking confirmations, invoices, and system notifications.
Vercel
Website hosting and content delivery. May collect basic access logs including IP addresses.
WhatsApp (Meta)
Optional direct communication channel. Governed by Meta's privacy policy.
10. Children's Privacy
Our services are not directed at children under the age of 18. We do not knowingly collect personal information from minors. As our rental services require drivers to be over the age of 25, the use of our services by minors is not applicable. If we become aware that we have collected personal information from a child under 18 without parental consent, we will take steps to delete that information promptly.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will update the "Last updated" date at the top of this policy and, where appropriate, notify registered portal users by email.
Your continued use of our services after any changes to this Privacy Policy constitutes your acceptance of the updated policy. We encourage you to review this policy periodically.
12. Contact Us
For any questions, concerns, or requests relating to this Privacy Policy or our handling of your personal information, please contact:
Company
TopDown Car Rentals (Pty) Ltd
Location
George Airport, Western Cape, South Africa
This Privacy Policy is governed by the laws of the Republic of South Africa. Any disputes arising from this policy will be subject to the jurisdiction of the South African courts.