Privacy Policy

1. Introduction

1.1 Commitment to Data Protection

Topdown Car Rentals (Pty) Ltd Registration Number K2026193033 (referred to herein as "TopDown", "TD", "we", "us", or "our") prioritizes the confidentiality and security of your personal data. This Privacy Policy outlines our commitment to handling your information responsibly and in compliance with the Protection of Personal Information Act 4 of 2013 ("POPIA").

1.2 Scope of Application

This policy governs all our commercial operations and explains methodologies we may use for collecting, utilizing, storing, disclosing, and protecting your data across interactions, including when you:

• Browse or use our official website: www.topdown.co.za (the "Website").
• Enter into a vehicle rental agreement with us or complete a reservation form or vehicle condition report.
• Operate any vehicle belonging to the TD rental fleet.
• Establish any other commercial, professional, or contractual relationship with TD.

1.3 Operational Framework and Business Context

Business Profile: TD operates as a specialized car rental agency based at George Airport, George, Western Cape. Our operations entail high-risk asset management, which may necessitate the processing of specialized telemetry, driver validation, and financial risk data.

Responsible Party: Under POPIA, TD acts as the "Responsible Party." This means we determine the specific purposes and means for processing your personal information.

Document Hierarchy: Where a conflict arises between our documents relating to your privacy, the following order of priority applies: (1) This Privacy Policy; (2) Website Terms of Use; (3) The Vehicle Rental Agreement (including the Terms and Conditions of Rental) and other agreements; (4) Supplementary Documentation.

2. Consent and Alternative Actions

2.1 By accessing our Website, engaging our vehicle rental services or interacting in any manner with us, you consent to the collection, processing, and distribution of your personal data as detailed in this document.

2.2 Insofar as we may have the legal right to do so, we may process your Personal Information without your knowledge or permission.

2.3 This Privacy Policy is applicable to the processing of your Personal Information regardless of the device used to access the website or engage with us, and irrespective of the reason or nature of your interaction.

2.4 This Privacy Policy does not apply to the processing of Personal Information by independent third parties or their websites linked to our Website or our business operations.

2.5 Right to Refuse and Opt-Out Protocols

If you object to this Privacy Policy, or to our use of your private information, you must immediately:

• Deny or customize your cookie preferences via our website prompt, or adjust the cookie settings on your device;
• Terminate your session and exit the Website immediately;
• Refrain from entering into any rental or booking agreements with us; and
• Cease all formal (except as may be required by law) and informal communications with TD.

2.6 Pre-Engagement Queries

Should you require clarity regarding any of these clauses, you are required to halt your use of our services and contact our Information Officer. Do not resume use of the Website or our services until your concerns are resolved.

3. Contact Information: Information Officer

We have designated a dedicated Information Officer to oversee data compliance, manage privacy inquiries, and assist you with your statutory rights under South African privacy laws.

4. Scope of Applicable Data Subjects

This policy applies to the processing of personal data by TD, or by approved third parties, belonging to:

• Active, past and future website users and visitors.
• Current, past, and prospective rental clients, including designated main drivers and authorized additional drivers, and where applicable any passengers.
• Individuals or corporate entities acting as financial guarantors.
• Corporate and/or private clients, suppliers, contractors, contract parties, and service vendors.
• Job applicants, current employees, and former staff members.
• Successors in title of the above data subjects where required by law.

This policy does not extend to the data handling practices of independent third parties or external websites linked or contracted to TD.

5. Categories of Personal Information Collected

"Personal Information" means any data that identifies a living individual or an existing corporate entity. The data we collect depends on your interaction with TD and includes:

5.1 Standard Data Categories

• Identity Profiles: Legal names, national identity numbers, passport details, dates of birth, photographic copies of identification, and driver's licences.
• Contact Information: Physical addresses, proof of residential address, billing locations, email addresses, and mobile numbers.
• Financial Records: Banking details, VAT registration data, credit card numbers, historical data regarding security deposits, damage liabilities, and payment verification information.
• Transaction Histories: Payment logs, rental reservation logs, vehicle classes rented, rental durations, pick-up/drop-off locations, and ancillary product selections.
• Technical Log Data: IP addresses, browser classifications, operating systems, cookies and similar tracking technologies, and device specifications.
• Usage Metrics: Analytical insights on how you navigate our Website, page view durations, and product preferences.
• Geographical and Fleet Telematics Data: Location data, real-time and historic vehicle tracking data, speed data, acceleration profiles, braking patterns, and impact alerts from hardware tracking units in our fleet.
• State Authorities: Traffic fine and e-toll information from SANRAL or other relevant authorities.

5.2 Aggregated and Statistical Data

We compile and utilize aggregated statistical data. If we combine anonymous aggregated data with identifiable data, we will treat the combined data set as protected Personal Information.

6. Special Personal Information

Certain interactions may require processing sensitive data classified as "Special Personal Information" under POPIA. We apply heightened security measures to this data and will only process it where mandated by law or with your informed consent.

Examples of Sensitive Data That May Be Collected

• Background Screenings: Criminal history checks, credit bureau histories, and driving record evaluations for high-value rental agreements or staff recruitment.
• Medical and Physical Data: Health disclosures, visual acuity verification, or physical mobility indicators required by South African transport laws or our risk assessments to confirm fitness to operate a motor vehicle.
• Biometric Information: Facial images or digital scans captured via identity verification software or physical security cameras to cross-reference driver identities against official state databases to mitigate identity theft and vehicle fraud.

7. Methods of Data Collection

7.1 Active and Direct Interactions

We collect data directly from you when you fill out forms, register an account, execute a rental or other agreement, or contact us via email, telephone, or WhatsApp. This may include licensing credentials, submitted photographs or scanned verifications, and payment details.

7.2 Automated and Passive Tracking

When you navigate our Website, we automatically capture metadata through system logs and tracking tools, including IP addresses, browser type, operating system, device identifiers, pages visited, time spent on pages, and navigation paths.

7.3 Cookies and Tracking Technologies

Our website uses cookies and similar technologies to enhance your browsing experience, analyse website traffic, and deliver targeted advertisements:

• Essential Cookies: Required for the website to function correctly. These cannot be disabled.
• Analytics Cookies: Help us understand how visitors interact with our website so we can improve our services.
• Marketing Cookies: Used to deliver relevant advertisements and measure the effectiveness of our marketing campaigns. These are only set with your consent.

You can control cookie preferences through our cookie consent banner or by adjusting your browser settings. Disabling certain cookies may affect website functionality.

7.4 Specialised Third-Party and Telematics Collection

We receive supplementary data from external entities including real-time vehicular tracking and diagnostics from contracted tracking companies (e.g., Netstar, Tracker), regulatory notifications from SANRAL, and fraud prevention datasets from accredited credit bureaus.

7.5 Closed-Circuit Television (CCTV)

TD may collect Personal Information and Special Personal Information through CCTV cameras installed at the George Airport, depot facilities, and the general vicinity of TD premises for security, theft prevention, and staff safety.

8. Strategic Third-Party Platform Integrations

To manage our business and deliver services, our systems integrate with third-party digital platforms. Each maintains its own privacy policy:

9. Purpose and Use of Your Information

We use your personal data to support our business operations through the following activities:

• Service Logistics: Managing car rental bookings and history, verifying driver prerequisites, allocating vehicles, processing vehicle exchanges, finalizing rental contracts, handling payments and deposits, and providing customer support.
• Risk Management and Asset Protection: Tracking rental fleet vehicles via GPS to prevent theft, unauthorized cross-border travel, or violations of rental terms; assessing liability for vehicle collisions or damage.
• Human Resources: Assessing candidate applications, managing staff files, and verifying background checks.
• System Integrity and Fraud Prevention: Preventing fraud, detecting identity cloning, verifying identities and payment validity, investigating cybersecurity breaches, and enforcing our standard terms of service.
• Analytical Profiling: Examining user behavior, click-stream paths, and geographic trends to generate demographic insights and tailored content.
• Regulatory Accountability: Complying with South African laws, responding to lawful requests by authorities, preserving administrative records, lodging tax returns, assigning responsibility for traffic infringements, and managing e-tolling fees.
• Marketing (with opt-in/consent): To send you promotional offers, newsletters, and targeted advertisements. You may opt out at any time.
• Service Improvement: To analyse usage patterns, improve our website functionality, and enhance our rental services.

10. Mandatory and Optional Information Requirements

10.1 Compulsory Data

To utilise our services the following data is legally or operationally mandatory:

• Full legal name and physical address.
• Contact information (email and phone number).
• Valid, unexpired driver's licence, identity card, or international passport.
• Corporate registration documents (CIPC and SARS credentials for juristic entities).
• Basic driver health declarations if applicable.
• A valid credit card matching the primary renter's identification document.

10.2 Consequences of Non-Disclosure of Compulsory Data

If you choose to withhold compulsory information, we will decline to provide vehicle rental services, cancel existing bookings, nullify vehicle key hand-overs, or refuse access to our fleet and digital features.

10.3 Consequences of Non-Disclosure of Optional Data

Withholding optional data (such as marketing or cookie preferences) will not cancel your core services, but may prevent a fully personalised experience.

11. Distribution and Sharing of Data

11.1 Commercial Protections

We do not sell your personal data. Your information is only shared under the specific terms detailed below.

11.2 Operational Infrastructure Disclosures

• Staff and Contractors: Data is available to our employees, contracted third parties, roadside towing operators, mechanical workshops, and independent driver agents to run daily operations.
• International Data Transfers: Because our business relies on global cloud architectures (Yoco, Supabase, Vercel), your information may be routed, backed up, or processed outside South African borders.
• Law Enforcement and Statutory Obligations: We will hand over relevant information to regulatory authorities, SAPS, insurance underwriters, legal counsel, or judicial officers if required by law.
• Industry Registries: In the event of severe payment default, material breach of rental conditions, or vehicle theft, your personal data may be shared with automotive sector database networks.
• Advertising Platforms: With your consent we may share contact details with third-party advertising platforms (Meta, Google) for targeted marketing. You may withdraw consent at any time.
• Business Sale or Transfer: In the event of a merger, acquisition, or sale of our business, your information may be transferred to the successor in title.

12. Security Protocols and Liability Limitations

12.1 We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, disclosure, alteration, or destruction. These measures include encrypted data transmission (HTTPS/TLS), secure database hosting with row-level security, and access controls limiting who can view your information.

12.2 Payment card information is processed exclusively through Yoco's PCI DSS compliant payment infrastructure. We do not store, transmit, or have access to your full card details.

12.3 Should an unauthorized data breach occur, we maintain an active response plan to isolate the issue, inform affected users, and notify the Information Regulator in line with POPIA requirements.

Limitation of Liability

While we take every reasonable precaution, no digital architecture or internet transmission is completely secure. To the maximum extent permitted by South African law, TD cannot guarantee absolute immunity from cybercrime. We do not accept liability for losses, claims, or damages resulting from unauthorised data access or malicious intercepts, provided we have met our statutory duties under POPIA.

13. Data Lifecycle and Retention Management

13.1 We retain your personal information only for as long as necessary to fulfil the purposes detailed in this policy, unless:

• South African tax, accounting, or National Road Traffic or other applicable legislation requires a longer retention period.
• The data is required for active insurance claims, vehicle accident disputes, outstanding toll disputes, or open traffic fine re-allocations.
• The data is required for active evidentiary purposes or legal defence.
• You instruct us to purge your records, provided no overarching legal obligation or unsettled rental balances override your request.

13.2 Rental records and associated personal information are retained for a minimum of 5 years after the rental period ends, in accordance with South African financial record-keeping requirements.

13.3 Documents submitted to us (driver's licence, ID documents) are retained for a reasonable period after your rental ends to support any outstanding claims.

14. Statutory Data Subject Rights

As a data subject under POPIA, you may initiate requests to exercise the following rights:

• Access: Review exactly what personal records we maintain regarding your identity or business profile.
• Correction: Demand the immediate correction of inaccurate, incomplete, or out-of-date information.
• Erasure: Request that we delete your data if there is no longer a legal justification for us to keep it.
• Objection: Object to data processing on legitimate grounds.
• Restriction: Request that we temporarily suspend processing your data while a dispute is being resolved.
• Withdrawal: Revoke any consent previously granted. Note that revoking consent cannot apply retroactively if the processing was required by law.
• Complaint: File a complaint with the South African Information Regulator regarding any alleged mishandling of your data.

Contact our Information Officer at topdowncarrental@gmail.com or 073 738 4821 to exercise any of these rights.

15. Policy Amendments

We reserve the right to adjust, update, or rewrite this Privacy Policy at our sole discretion to reflect legal changes or system adjustments. Updated versions will be published on our Website with an adjusted effective date. By continuing to use our services or website after changes are published, you accept the updated terms.

16. Protection of Minor Children

Our vehicle rental operations, commercial solutions, and digital platforms are strictly designed for individuals aged 25 (twenty-five) years and older. We do not knowingly collect personal data from minors unless explicitly required as a passenger manifest indicator, specialised medical/insurance underwriting parameter following an accident, or other legal purposes. If you suspect we have inadvertently processed data belonging to a minor child, please contact our Information Officer immediately.

17. Direct Marketing Practices

Opt-In Obligation: We only send direct electronic marketing materials (such as promotional emails, discount voucher announcements, or weekend rental rate specials) if you have explicitly opted-in to receive them.

Opt-Out Right: You maintain the right to cancel your marketing subscription at any time. You can use the "unsubscribe" links in our digital communications or contact our Information Officer to be removed from marketing lists. We will process your opt-out request promptly at no cost to you.