Privacy Notice

Last updated 12 October 2026

1. Who we are

FreightProof SA (Pty) Ltd, registration number [Company registration number], of [Registered physical address], Cape Town, Western Cape, South Africa. Our Information Officer is [Name of Information Officer], reachable at freightproof@gmail.com.

2. Two roles: this website, and the platform

On this website we decide what information is collected and why, so we are the responsible party.

On the FreightProof platform, we process trip information on behalf of the transport operator that uses it. That operator is the responsible party for its drivers’ and trips’ information, and we act as its operator under section 21 of POPIA, bound by a written agreement to process that information only on its instructions and to keep it secure. Questions about that information can also go to the operator directly.

3. What we collect

When you visit this website

• No analytics, advertising or tracking tools. See the Cookie Notice.
• Our hosting provider keeps standard server logs (IP address, browser type, time of request) to keep the service secure and working.
• If you request access, the details you choose to put in your email: name, work email, company, role, fleet size and any note.

When the platform is used

• Dispatcher accounts: name, work email, role and organisation.
• Drivers: name, identity-verification result, licence details and the position of the company-issued device while a trip is in progress.
• Trip records: vehicles, consignment references, precincts, seal numbers, unit counts, photos of trip documents, timestamps and locations of each handover, and any exceptions raised.
• Receivers: the contact detail used to send a one-time PIN, and the confirmation itself.

4. Why we use it

We process personal information only for these purposes, on the lawful grounds in section 11 of POPIA:

• to provide the platform under our agreement with the operator (performing a contract);
• to create a reliable evidence record that helps prevent cargo crime and resolve disputed deliveries (the legitimate interests of the operator, its customers and the people involved);
• to keep the service secure, and to comply with the law or a lawful request;
• to reply to you when you contact us or request access.

5. What goes on the public ledger, and what never does

To make records tamper-evident, we write a SHA-256 fingerprint of each record to the Hedera Consensus Service, a public ledger. A fingerprint is a fixed-length string calculated from the record. It cannot be reversed to reveal the record and contains no personal information. Names, identity details, locations and photos are never written to the ledger. Fingerprints on a public ledger are permanent, but they only become meaningful when compared with the original record, which we hold and can delete.

6. Where your information is kept

Platform data, including photos, is stored in South Africa, in Amazon Web Services’ Cape Town region (af-south-1), through our database and storage provider.

Some information may leave South Africa. Emails you send us are handled by our email provider (Google), whose servers may be outside South Africa. Map images inside the dashboard are loaded from OpenStreetMap and Esri, which see the viewer’s IP address. We transfer information across borders only where section 72 of POPIA allows it, for example where the recipient is bound by protections substantially similar to POPIA or the transfer is needed to perform a contract.

7. How long we keep it

Trip records are kept for [retention period] after a trip closes, because claims and disputes can arise long after delivery. They are kept longer only if a claim, an investigation or the law requires it. Access-request emails that don’t lead to a working relationship are deleted within [12 months]. When information is no longer needed, we delete it or de-identify it.

8. How we protect it

As section 19 of POPIA requires, we use reasonable technical and organisational measures: encryption in transit, role-based access limited to each operator’s own organisation, an audit trail of changes, and tamper-evident fingerprints on every record. If we believe personal information has been accessed without authorisation, we will notify the Information Regulator and the people affected, as section 22 requires.

9. Automated flags

The platform automatically flags events that need attention, such as a device that isn’t where the trip says it should be. A flag is a record for a person to review. We do not make decisions with legal consequences about anyone solely by automated means.

10. Your rights

You have the right to:

• ask whether we hold personal information about you, and request a copy (section 23);
• ask us to correct or delete information that is inaccurate, out of date or unlawfully held (section 24);
• object to processing based on legitimate interests (section 11(3));
• withdraw consent where processing relies on it;
• not receive direct marketing you haven’t agreed to. We don’t send unsolicited marketing.

Email freightproof@gmail.com to exercise any of these rights. Formal access requests follow our PAIA information. We may need to verify your identity first, and where the operator is the responsible party, we will pass your request to them.

11. Complaints

Please contact us first and we’ll try to resolve your concern. You may also complain to the Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001. POPIAComplaints@inforegulator.org.za · inforegulator.org.za.

12. Changes

We will update this notice when our practices change, and the date at the top will show when it last changed.