← Back to Previous Page

Privacy Policy

Last Updated: 25 August 2025

1. Introduction and Scope

Welcome to BusServices24, the digital platform for accessing bus service information through our mobile application and website.

At BusServices24 ("we," "us," or "our"), we are committed to protecting your privacy and handling your personal information in compliance with:

• Protection of Personal Information Act 4 of 2013 (POPIA) - South Africa
• General Data Protection Regulation (GDPR) - European Union
• Other applicable data protection laws

This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our services.

2. Data Controller Information

Responsible Party (POPIA) / Data Controller (GDPR):

• Organization: BusServices24 (Pty) Ltd
• Registration Number: [Your Company Registration]
• Information Officer: [Name of Information Officer]
• Email: info@busservices.co.za
• Address: Centurion, Pretoria, Gauteng, 0157

3. Definitions

Personal Information (POPIA) / Personal Data (GDPR): Any information relating to an identified or identifiable natural person, including but not limited to:

• Identity data (name, surname, ID number)
• Contact data (email, phone number, address)
• Location data (GPS coordinates, IP address)
• Technical data (device information, browsing data)
• Usage data (features used, timestamps)

4. Information We Collect

4.1 Information You Provide Directly

• Account registration details (name, email, mobile number)
• Contact information when you communicate with us
• Feedback, queries, or support requests
• Preferences and settings

4.2 Information Collected Automatically

Data Type	Purpose	Legal Basis
Location data (with consent)	Show nearby stops, route planning, real-time tracking	Consent (GDPR Art. 6(1)(a)) / Necessity (POPIA)
Device information	Service optimization, troubleshooting	Legitimate interests (GDPR Art. 6(1)(f))
Usage analytics	Improve services, understand user behavior	Legitimate interests (anonymized where possible)
Cookies and similar technologies	Website functionality, analytics, advertising	Consent (for non-essential cookies)

5. Legal Basis for Processing (GDPR)

We process your personal data based on the following legal grounds:

• Consent: For location services and marketing communications
• Contractual necessity: To provide our core services
• Legitimate interests: For service improvement and security
• Legal obligations: To comply with applicable laws

6. How We Use Your Information

We use your personal information for the following purposes:

• Provide and maintain our services (routes, schedules, real-time updates)
• Personalize your experience and improve service quality
• Communicate important service updates and notifications
• Ensure security and prevent fraudulent activities
• Comply with legal obligations and respond to legal requests
• Conduct research and analysis (using anonymized data)

7. Data Sharing and Disclosure

We do not sell your personal information. We may share it only in the following circumstances:

7.1 Service Providers

With trusted third-party providers who assist in delivering our services:

• Cloud hosting providers
• Analytics and monitoring services
• Customer support platforms
• Payment processors (if applicable)

All service providers are bound by data processing agreements ensuring POPIA and GDPR compliance.

7.2 Legal Requirements

When required by law, court order, or governmental authority.

7.3 Anonymized Data

We may share aggregated, anonymized data with transport authorities and research partners for urban planning purposes.

8. International Data Transfers

Your data may be transferred to and processed in countries outside South Africa or the European Economic Area. When we transfer data, we ensure appropriate safeguards are in place:

• Adequacy decisions by the European Commission
• Standard Contractual Clauses (GDPR Article 46)
• Binding Corporate Rules
• POPIA-compliant transfer mechanisms

9. Data Security

We implement appropriate technical and organizational measures to protect your personal information:

• Encryption of data in transit and at rest
• Access controls and authentication mechanisms
• Regular security assessments and monitoring
• Employee training on data protection
• Secure development practices

10. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required or permitted by law.

Data Category	Retention Period
Account data	3 years after last activity
Location data	24 months (anonymized after 6 months)
Communication data	3 years
Technical logs	12 months

11. Your Rights

11.1 POPIA Rights

• Right to be notified that personal information is being collected
• Right to access your personal information
• Right to request correction or deletion
• Right to object to processing
• Right to lodge a complaint with the Information Regulator

11.2 GDPR Rights

• Right to access and data portability
• Right to rectification
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to object to processing
• Right to withdraw consent
• Right to lodge a complaint with a supervisory authority

To exercise your rights, contact us at info@busservices.co.za. We will respond within 30 days and may request identity verification.

12. Cookies and Tracking Technologies

We use cookies and similar technologies on our website. For detailed information, please see our Cookie Policy.

13. Children's Privacy

Our services are not directed to children under 18. We do not knowingly collect personal information from children without parental consent. If we become aware of such collection, we will take steps to delete the information.

14. Direct Marketing

We will only send you direct marketing communications with your consent or as permitted by law. You can opt-out at any time using the unsubscribe link in our communications or by contacting us.

15. Data Breach Notification

In the event of a data breach that may risk your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours (GDPR)
• Notify the Information Regulator as required by POPIA
• Notify affected individuals without undue delay

16. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify you of material changes through our services or by email.

17. Contact Information