Privacy Policy

SignedOff ("we", "us") is used by South African road-freight operators to capture and keep proof of delivery. This policy explains what personal information we process, why, and the rights you have under the Protection of Personal Information Act, 2013 (POPIA).

1. Who we are

SignedOff is operated by Providus Labs (Pty) Ltd, a company registered in South Africa (CIPC reg 2026/142873/07). Our Information Officer can be reached at gareth@providuslabs.co.za.

2. Information we collect

Account information — name, email, phone number, organisation name, role (owner / dispatcher / driver). Provided by you at sign-up or by your fleet operator when you are invited as a driver.

Driver compliance documents— driver's licence number and expiry, PrDP, medical certificate, ID document copies. Used to demonstrate fitness-to-drive to your employer.

Job & proof-of-delivery records — pickup and dropoff addresses, cargo description, photos and signatures captured at delivery, GPS coordinates of key events.

GPS location (drivers only) — recorded only while a driver is on shift on an assigned job, at roughly 30-second intervals. We never collect location off-shift or between jobs.

Device and usage data — IP address, browser/device identifier, pages viewed. Used to keep the service secure and diagnose faults.

3. Why we process it (lawful basis)

We rely on the following grounds under POPIA Section 11:

• Consent — for GPS tracking, captured explicitly in the driver app before any location is recorded.
• Contract performance — to deliver the service to your fleet operator and to you.
• Legal obligation — to retain delivery and tax records as required by South African law.
• Legitimate interest — security monitoring, fraud prevention, and product improvement.

4. Who we share with

Your fleet operator— drivers' jobs, locations, documents, and PODs are visible to dispatchers and owners of the organisation you belong to.

Your clients — when an owner shares a tracking link, a limited public view (driver first name, pickup/dropoff addresses, live GPS while in transit, POD on delivery) is available to anyone with that link until it expires.

Service providers — Amazon Web Services (hosting, storage, email delivery, in Cape Town and Ireland), Mapbox (maps), Google / Apple (push notifications). Each is bound by data-processing agreements that meet POPIA standards.

We do not sell personal information. We do not share it with marketers.

5. How long we keep it

GPS coordinates are retained against the job for seven days, then anonymised (job ID and timestamp retained, exact coordinates dropped).

POD photos, signatures, and delivery records are retained for seven years in line with SARS tax-record requirements.

Account data is retained for the life of your account plus one year after deletion, after which it is permanently removed.

6. Where it is stored

Primary storage is in AWS region af-south-1 (Cape Town). Email delivery and a small set of operational backups may transit eu-west-1 (Ireland). All transfers are within AWS's POPIA-compliant infrastructure.

7. Your rights

Under POPIA you may at any time:

• Request a copy of the personal information we hold about you.
• Ask us to correct anything that is inaccurate.
• Withdraw consent for GPS tracking (toggle "Off shift" in the driver app — your fleet boss is told tracking is paused but not where you are).
• Request deletion of your account. Where we are legally required to retain certain records (tax, audit) we will tell you what stays.
• Lodge a complaint with the Information Regulator of South Africa (POPIA), website inforegulator.org.za.

To exercise these rights, email gareth@providuslabs.co.zaor use the "Export my data" button in your account settings.

8. Security

We use TLS for all traffic, encrypted-at-rest storage, role-based access on the database (row-level security so a driver only sees their own jobs, an owner only sees their org), MFA-capable sign-in, and short-lived signed URLs for any file download. No system is perfectly secure; if a breach affects you we will notify you and the Information Regulator within a reasonable period.

9. Changes to this policy

We may update this policy. Material changes will be announced in-app and by email at least 14 days before they take effect.