Privacy Policy

1. Who We Are

Doskiiey Connect is a South African real-time public transport tracking, trip planning, and ride-booking platform for commuters across South Africa. Doskiiey Connect is its own entity and is solely responsible for this platform and all related services offered to users.

The software and technical infrastructure powering Doskiiey Connect are built and maintained by DiKarabo Technologies (Pty) Ltd — a Pretoria-based technology company acting purely as a development and infrastructure partner. DiKarabo Technologies does not independently operate the Doskiiey Connect platform, does not make decisions about how your personal information is used, and acts only on Doskiiey Connect's instructions.

For the purposes of POPIA, Doskiiey Connect is the Responsible Party in respect of all personal information processed through the Doskiiey Connect website, mobile application, and related services.

2. Information We Collect

We collect information you give us directly and information generated automatically when you use our services.

2.1 Information you provide

• Launch registration (coming-soon form): full name, email address, and optionally a phone number and your detected city, submitted when you sign up for launch notifications.
• Account creation (when available): name, email address, phone number, and a password (stored as a salted hash — never in plain text).
• Ride bookings: pick-up and drop-off locations, trip date/time preferences, and any special instructions you provide.
• Payment information: when you pay for a ride we collect only the minimum required details. Card numbers are processed and tokenised by our PCI-DSS-compliant payment partner — we never store raw card data on our servers.
• Support communications: messages, feedback, or complaints you send to us via email or WhatsApp.

2.2 Information collected automatically

• Location data: with your explicit permission, we use your device's GPS to detect your area for trip planning, real-time route tracking, and service-availability checks. You may deny or revoke location access at any time in your device settings.
• Device and technical data: IP address, browser type and version, operating system, device identifiers, referring URLs, and pages visited — collected automatically via server logs and analytics tools.
• Usage data: routes searched, trips planned, services viewed, interactions with the app, and feature usage patterns — used to improve the platform.
• Cookies and similar technologies: see Cookie Policy for full details.

2.3 Authentication and account data

Doskiiey Connect uses Google Firebase Authentication as the identity provider for the mobile application. The following sign-in methods are available:

• Email and password
• Google Sign-In (via Google OAuth 2.0)
• Apple Sign-In (via Apple OAuth, iOS only)

When you sign up or sign in, Firebase Authentication processes the following personal information on behalf of Doskiiey Connect:

• Email address
• Password (stored only as a salted hash — Doskiiey Connect cannot see or recover plaintext passwords)
• Display name (where provided by you or the SSO provider)
• Profile photo URL (where provided by the SSO provider)
• Firebase user identifier (UID)
• Sign-in timestamps and last-active IP address
• For Google/Apple Sign-In: the OAuth identifier issued by the provider

3. Why We Process Your Information

We only process your personal information for the purposes described below and on a lawful basis as required by POPIA.

4. How We Share Your Information

We do not sell, rent, or trade your personal information. We share it only with the following categories of recipients, and only to the extent necessary:

• Service providers and sub-processors: we engage the following sub-processors to deliver our service. All are bound by data-processing agreements and may not use your data for their own purposes.

  Sub-processor	Purpose	Privacy information
  Google LLC — Firebase Authentication	Identity and access management for the mobile application	Google Privacy Policy  ·  Firebase Privacy
  Google LLC — Cloud Run	API hosting and backend compute in africa-south1 (Johannesburg)	Google Privacy Policy
  Neon (AWS eu-west-2, Ireland)	Relational database hosting	Neon Privacy Policy

• Transport operators and drivers: when you book a ride, we share your name, contact number, pick-up location, and destination with the relevant operator solely to fulfil your trip.
• Legal and regulatory authorities: where required by law, court order, or to protect the safety of our users or the public.
• Business transfers: if Doskiiey Connect is acquired or merges with another entity, your information may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.

5. Cross-Border Transfers

Firebase Authentication (Google LLC)

Firebase Authentication is a Google product. User authentication records — including email addresses, Firebase UIDs, sign-in timestamps, and OAuth identifiers — are stored on Google infrastructure outside the Republic of South Africa. Google LLC, acting as processor, is bound by its Data Processing and Security Terms, which provide safeguards substantially similar to those required under POPIA.

By creating an account or signing in to Doskiiey Connect, you consent to the cross-border transfer and processing of your authentication data by Google LLC for the purpose of authenticating you to the Doskiiey Connect service. This consent is provided in terms of section 72(1)(b) of POPIA.

All other personal information

Trip records, location traces, booking history, scholar profiles, corporate account data, and payment records are stored exclusively within the Republic of South Africa on Google Cloud Platform infrastructure in the africa-south1 (Johannesburg) region, in compliance with our POPIA data residency commitments.

Our database provider, Neon, operates infrastructure in the European Union (AWS eu-west-2, Ireland). Where personal information is transferred outside the Republic for this purpose, we take steps to ensure that the recipient organisation offers an adequate level of protection equivalent to POPIA, including the use of standard contractual clauses.

6. Data Retention

• Launch registration records: retained until we launch in your area and fulfil the notification, after which records are archived for 12 months and then securely deleted.
• Account data: retained for as long as your account is active. If you close your account, your personal data is deleted within 30 days, except where retention is required by law.
• Trip and booking records: retained for 5 years for financial, audit, and dispute resolution purposes, in line with South African tax and consumer protection legislation.
• Server logs and analytics: retained for 90 days in rolling logs.

7. Your Rights Under POPIA

As a data subject under POPIA, you have the following rights. To exercise any of them, contact our Information Officer at privacy@doskiieyconnect.co.za.

• Right of access: request a copy of the personal information we hold about you.
• Right to correction: request that inaccurate or outdated information be corrected.
• Right to deletion: request that your personal information be deleted, subject to applicable legal obligations.
• Right to object: object to the processing of your personal information, in particular for direct marketing purposes.
• Right to withdraw consent: where processing is based on consent, withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
• Right to complain: lodge a complaint with the Information Regulator of South Africa if you believe we have violated your rights.

8. Location Data

Doskiiey Connect is a location-based service. We request access to your device's GPS to power real-time tracking, suggest nearby stops, and show whether our service operates in your area.

• Location access is optional — the app functions without it, with reduced personalisation.
• Precise location is used only during an active session and is not stored beyond what is needed to process your request.
• We use OpenStreetMap / Nominatim to reverse-geocode coordinates into a city name for display purposes. No personally identifying information is sent to Nominatim beyond the coordinates.
• You can revoke location permission at any time in your browser or device settings.

9. Security

We implement industry-standard technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These include:

• TLS encryption for all data in transit.
• Encrypted storage at rest for sensitive fields.
• Database access restricted to authenticated services over encrypted channels (SSL required).
• Passwords hashed using bcrypt with per-user salts — never stored in plain text.
• Role-based access controls limiting which staff can access personal data.

Despite these measures, no system is 100% secure. If you suspect your account has been compromised, contact us immediately at privacy@doskiieyconnect.co.za.

10. Children's Privacy

Doskiiey Connect is not directed at children under the age of 18. We do not knowingly collect personal information from minors. If you are a parent or guardian and believe your child has submitted personal information to us, please contact us and we will delete it promptly.

11. Third-Party Links

Our platform may contain links to third-party websites (e.g. app stores, social media, payment providers). This privacy policy does not apply to those sites. We encourage you to review the privacy practices of any third-party site you visit.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we do, we will revise the Last updated date at the top of this page and, where the changes are material, notify registered users by email or an in-app notice at least 14 days before the changes take effect.

13. Contact Us

Questions, requests, or complaints regarding this Privacy Policy should be directed to our Information Officer:

Back to home