Privacy Policy · Tuu Post

This privacy notice explains how Timbaktuu Post (Proprietary) Limited (“Tuu Post”, “we”, “our” or “us”), company registration number 2018 / 484330 / 07, trading as Tuu Post and registered in the Republic of South Africa, collects, uses, shares and protects personal information in line with the Protection of Personal Information Act 4 of 2013 (“POPIA”).

Our head office is at First Floor, Work Central, Bel Air Shopping Mall, Bellairs Drive and Malibongwe Drive, Northriding, Johannesburg, 2169. This notice should be read together with our PAIA Manual, which sets out the full detail of the records we hold and how to request access to them.

Introduction

Tuu Post operates a Reseller and Affiliate Infrastructure-as-a-Service (“RAIaaS”) platform on a business-to-business-to-end-customer (B2B2X) model, connecting enterprise clients to ground-level execution capacity across South Africa’s informal economy. In doing so we process personal information relating to end consumers, enterprise clients, the independent merchants, resellers (individuals or merchants providing reseller and field services), affiliates (individuals providing referrals only) and field technicians who act on our behalf, our employees, suppliers and website users.

Where we process personal information for our own purposes — for example to operate the platform, vet Resellers and Affiliates or manage client relationships — we are the Responsible Party under POPIA. Where we process personal information on behalf of an enterprise client under written instruction, we may act as an Operator, with the enterprise client being the Responsible Party. The allocation of these roles is determined by the relevant client agreement.

We are committed to protecting your privacy and the confidentiality of your personal information. We do not sell your personal information, and we share it only as described in this notice or as permitted by law.

Section 01Information Officer

We have appointed an Information Officer, registered with the Information Regulator, who is responsible for ensuring our compliance with POPIA and PAIA. If you have any questions about this notice, or wish to exercise any of your rights, please contact:

Vuyo Tofile — Co-Chief Executive Officer and Information Officer
Email: admin@tuupost.com
Telephone: +27 (0) 10 449 1467
First Floor, Work Central, Bel Air Shopping Mall, Bellairs Drive and Malibongwe Drive, Northriding, Johannesburg, 2169

Section 02Categories of data subjects and information we process

Depending on your relationship with us, we may collect, use, store and transfer the following categories of personal information:

End consumers — full names; identity or passport number; date of birth; residential and postal address; contact numbers; email address; photograph and biometric data (including selfies, proof-of-life imagery and signatures); geolocation and proof-of-presence data; identity document images; banking details where required by the client task; KYC and AML data; and records of the service rendered (for example a delivery confirmation, installation photo or verification outcome).
Enterprise clients — registered and trading name, company registration number, VAT number and B-BBEE status; physical, postal and billing address; contact details of authorised representatives and signatories; banking details; and contract, task-brief, SLA and audit records.
Resellers, Affiliates and Field Technicians — full names; identity or passport number; proof of residence and right to work; business or trading details; qualifications and certifications; contact and banking details; tax number; photographs; vetting and reference checks; training records; geolocation and proof-of-presence records; equipment issued; task allocations; and performance, payout, disciplinary and termination records.
Employees and job applicants — identity and contact details; qualifications and CV; references; employment contracts; remuneration, payroll, tax and banking information; leave, performance and disciplinary records; and equity data (race, gender, disability) where lawfully required.
Suppliers and service providers — registration and VAT details, B-BBEE status, representative contact details, banking details, due diligence records, commercial terms and payment history.
Website, app and platform users — account credentials and profile information; device and browser metadata; IP address; geolocation; cookie and tracking identifiers; session logs; and support interactions.
Visitors and correspondents — names and contact details, correspondence records, visitor-log entries and CCTV footage at our head office where applicable.

We may aggregate anonymised information for statistical or planning purposes. Aggregated data is not personal information in law because it does not reveal your identity; if we combine it with data that can identify you, we treat the combined data as personal information.

Section 03Special personal information and children

Special personal information — such as biometric data, or data about health, race or ethnicity — and the personal information of children are processed only where a lawful basis exists and in strict compliance with Sections 26 to 35 of POPIA, including, where required, prior authorisation from the Information Regulator under Section 57. We do not market to children, and if you are under 18 you may use our website only with the consent of a parent or guardian.

Section 04Why we process your personal information

We process personal information for the following lawful purposes:

to provide our RAIaaS platform services to enterprise clients, including commissioning, allocating and verifying ground-level tasks executed by Resellers, Affiliates and Field Technicians;
to onboard, vet, verify, train, manage and pay Resellers, Affiliates and Field Technicians, including collecting KYC, tax, banking and proof-of-presence information;
to perform Know-Your-Customer, proof-of-life, identity verification and related checks on end consumers on behalf of enterprise clients, under those clients’ written instructions;
to manage enterprise client relationships, including contracting, invoicing, reporting, audit and dispute resolution;
to comply with legal and regulatory obligations, including POPIA, PAIA, the Companies Act, tax and labour legislation, and FICA and the National Credit Act where applicable;
to prevent, detect, investigate and prosecute fraud, crime, platform abuse and policy breaches;
to operate, secure, monitor, maintain and improve the Tuu Post Operational System, including logging, incident management and analytics;
to defend, assert or exercise our legal rights and respond to lawful requests from regulators, courts and law enforcement; and
for statistical, research and planning purposes, using anonymised or aggregated data wherever practicable.

We will not process your personal information for a secondary purpose unless that processing is compatible with the original purpose, you have consented, or another lawful basis exists under POPIA.

Section 05Lawful basis for processing

We process personal information on one or more of the lawful bases recognised by POPIA: with your consent; because it is necessary to conclude or perform a contract with you; because we have a legal obligation to do so; to protect your legitimate interests; or because processing is necessary for our (or a third party’s) legitimate interests, provided these are not overridden by your rights. Where we rely on consent, you may withdraw it at any time by contacting our Information Officer, although this may affect our ability to provide a service to you.

Section 06Who we share personal information with

We disclose personal information only to the extent lawful and necessary for the purposes above. Recipients may include:

the instructing enterprise client, where we act as Operator, and appointed verification and identity-verification bureaus;
the South African Police Service and licensed criminal-record verification bureaus, for criminal record checks;
the South African Qualifications Authority (SAQA) and licensed bureaus, for qualification verification;
registered credit bureaus, where applicable and lawful;
the South African Revenue Service (SARS), financial institutions and payroll and benefits providers, for banking, tax and payroll information;
the Department of Employment and Labour, the UIF, the Compensation Commissioner and pension and medical-aid administrators, for employment records;
legal advisors, external auditors, courts, tribunals, arbitration forums and the Information Regulator, for legal and dispute matters;
cloud infrastructure, communications, SMS/OTP and email providers processing platform data under written Operator agreements with appropriate POPIA safeguards; and
the CIPC, regulators and B-BBEE verification agencies, for corporate and statutory information.

Section 07Transfers outside South Africa

We use cloud-based infrastructure and software services that may result in personal information being stored or processed outside the Republic. Any such transfer is made only on a lawful ground permitted by Section 72 of POPIA — for example, where the recipient is subject to laws, binding corporate rules or a binding agreement providing adequate protection, where you have consented, or where the transfer is necessary to perform a contract. Transfers are limited to reputable providers whose data-protection commitments meet or exceed the POPIA standard and are governed by written Operator agreements with contractual safeguards.

Section 08How we keep your information secure

In compliance with Sections 19 to 22 of POPIA, we maintain reasonable technical and organisational measures to protect the confidentiality, integrity and availability of personal information, including:

role-based access controls, least-privilege permissions, multi-factor authentication and audit logging;
encryption of personal information in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent);
endpoint protection, anti-malware, vulnerability and patch management across devices and infrastructure;
network segmentation, firewalling and intrusion detection;
secure software development practices, including code review, dependency scanning and regular penetration testing;
data backup, tested recovery procedures and business continuity planning;
a documented incident-response plan covering containment, investigation, breach notification to the Regulator and affected data subjects, and post-incident review;
written Operator agreements with all third-party processors; and
mandatory POPIA awareness training and physical security controls at our premises.

These measures are reviewed at least annually, or whenever a material change to our processing, technology or threat environment occurs.

Section 09How long we keep your information

We keep personal information only for as long as necessary to fulfil the purposes for which it was collected, including to provide the services requested, to comply with legal, tax and regulatory obligations, and to establish, exercise or defend legal claims. Where we act as an Operator, the retention period is governed by the applicable client agreement. When information is no longer required, we securely destroy or de-identify it.

Section 10Your rights

Subject to POPIA, you have the right to:

be notified that we are collecting your personal information, and that it has been accessed by an unauthorised person;
request access to the personal information we hold about you (Section 23);
request that we correct or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (Section 24);
object, on reasonable grounds, to the processing of your personal information (Section 11(3));
withdraw consent where processing is based on consent; and
opt out of direct marketing at any time (Section 69).

Section 11How to exercise your rights

To access your personal information, or to request correction, deletion or object to processing, submit the applicable Information Regulator form — Form 2 for access, Form 3 for correction or deletion, and Form 1 for objection — to our Information Officer at admin@tuupost.com. These forms are available on the Regulator’s website, and the full procedure and any prescribed fees are set out in our PAIA Manual. We will respond within the periods required by POPIA and PAIA, ordinarily within 30 days of receiving a compliant request. Before acting on a request, we take reasonable steps to verify your identity.

Section 12Cookies and browsing information

Our website uses cookies — small text files placed on your device — to enable core functionality, keep you signed in, remember your preferences and understand how the site is used. When you first visit, we ask whether you consent to our use of non-essential cookies. Our servers also record technical information such as your IP address, approximate location, internet service provider and device and browser type, which we use in aggregate to assess and improve our website’s performance. You can control cookies through your browser settings, although disabling them may affect how the site works.

Section 13Complaints and remedies

If you are unhappy with how we have handled your personal information or an access request, please first contact our Information Officer at admin@tuupost.com so we can try to resolve the matter. PAIA does not provide for an internal appeal against a decision of a private body. If you remain aggrieved, you may, within 180 days, lodge a complaint with the Information Regulator or apply to a court of competent jurisdiction under Section 78 of PAIA.

The Information Regulator (South Africa) can be contacted at JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001; by email at POPIAComplaints@inforegulator.org.za or PAIAComplaints@inforegulator.org.za; or via inforegulator.org.za.

Section 14Changes to this notice

We may update this privacy notice from time to time to reflect changes in our processing activities or the law. The version that applies to you is the one posted here on the day you use our website. If you have any questions about this notice, please contact us.