Privacy policy

DriveSync is booking, scheduling and management software for driving schools in South Africa. It is operated by Antony Maposa, a sole proprietor trading as DriveSync, based in Cape Town, South Africa (“we”, “us”). This policy covers the DriveSync website and app at drivesync.co.za.

Antony Maposa is the responsible party for the personal information described in this policy that DriveSync handles for its own purposes (see section 2), and is also our Information Officer.

It applies to everyone whose information passes through DriveSync: visitors to the website, school owners and staff, instructors, learners with an account, and learners a school records without one.

POPIA separates the party that decides why information is collected (the responsible party) from a party that processes it on their behalf (an operator).

• Your driving school is the responsible party for the learner and instructor records it keeps in DriveSync: bookings, lesson notes, progress, packages and payments. We store and process those records for the school, only on its instructions and under our agreement with it, and we keep them secure as POPIA requires of an operator. We do not use them for our own purposes.
• We are the responsible party for our own relationship with you: your login, the school’s subscription and billing, support requests, and the emails we send about DriveSync itself.

If you are a learner or instructor and want to see, change or remove what your school holds about you, it is usually quickest to ask the school. You can also ask us and we will pass the request on.

Account details: name, email address, mobile number, password (stored only as a one-way hash), profile photo if you add one, your role at the school, and, if you sign in with Google, your Google account ID and email.

Learner details a school records: gender, home and pickup address, licence code being trained for, preferred instructor, transmission and lesson time, lesson history and progress, test bookings and results, packages and hours, notes added by staff, and feedback on lessons. A school can also record a walk-in learner who has no DriveSync account yet, with a name, phone number, email and lesson address. The school is responsible for telling that learner it has done so.

DriveSync is not built to hold health or medical information, and we ask schools not to record it in notes or feedback.

Location: addresses entered for lessons and learners are converted to map coordinates so we can work out which instructor is nearest. We do not track your device’s live location.

Payments: amounts, methods (cash, EFT or card) and dates recorded by the school. For subscription payments, card details are entered on and held by Paystack. We keep only the reference codes Paystack gives us to charge the saved card. We never see or store the card number.

Messages to us: what you send through the contact form or a support ticket, and any reviews you post.

Technical information: sign-in times, which parts of DriveSync are used and when (for example which screens are opened, which features are used, errors you run into, and whether you use the installed app or a browser). This is linked to your account. We also keep the basic request data (such as IP address and browser type) that our servers and hosting providers log in order to run and secure the service.

• To run the service your school signed up for: bookings, schedules, instructor allocation, progress tracking and records of payment.
• To create and secure your account, including sign-in, email verification and password resets.
• To bill the school for its subscription.
• To send service emails such as invitations, booking confirmations and billing notices.
• To send school owners and admins occasional emails about new DriveSync features. Learners and instructors do not receive these. Every one carries an unsubscribe link, and you can opt out at any time.
• To answer support requests and fix problems.
• To understand how DriveSync is used so we can improve it and help schools that are stuck. This stays in DriveSync’s own database, is never sold, never used for advertising, and never shared with analytics companies.
• To prevent fraud and misuse, and to meet our legal and tax obligations.

We rely on the contract with your school (or with you), our legitimate interest in running and securing DriveSync, our legitimate interest in improving DriveSync, and legal obligations. You can object to usage analytics at any time (section 10). Product emails to school owners and admins rely on our existing relationship with them, and stop as soon as they unsubscribe. We do not sell personal information, and we do not use it for advertising profiles.

When a school books a lesson, DriveSync can suggest an instructor based on distance, availability and the learner’s preferences. It is only a suggestion: school staff make the final choice.

We set two cookies, both needed to keep you signed in: auth-token and auth-refresh-token. DriveSync’s own support staff get one more, x-school-id, which remembers the school they are working in. Your browser also remembers a few interface choices, such as which dashboard view you last used, in local storage on your device.

We use Vercel Web Analytics to count page visits. It does not use cookies and does not identify individual visitors.

We do not use tracking cookies. Apart from Vercel Web Analytics (described above), we do not use outside analytics services: DriveSync records which features are used in its own database, linked to your account through your sign-in.

Within your school. Staff at your school see the records they need for their role. What instructors and learners can see depends on settings the school controls.

Service providers that process information for us under contract, only for the purpose of running DriveSync:

• Hetzner and Neon: servers and database hosting.
• Vercel: website hosting and page-visit analytics.
• Cloudflare: storage for profile photos.
• Resend and Zoho: sending and receiving email.
• Paystack: card payments for subscriptions.
• Google: sign-in with Google, and turning addresses into map coordinates.
• Axiom: storing server logs, which can include request details such as IP address, used to fix faults and investigate misuse.

DriveSync support staff can open a school’s records when it is needed to provide support or fix a problem. That access is limited to a small number of named people.

When the law requires it, for example a valid court order, or to protect someone’s safety.

If a staff member sends you a WhatsApp message about a lesson, they send it from their own phone and WhatsApp account. That message is covered by WhatsApp’s privacy terms, not ours.

DriveSync’s servers are outside South Africa, so your information is transferred to and stored in these countries:

• United States: our servers and database (Hetzner, Neon), website hosting (Vercel), mailboxes (Zoho), server logs (Axiom) and Google services.
• Ireland: outgoing email (Resend).
• Cloudflare stores profile photos on its global network.
• Paystack processes card payments in South Africa and the other countries where it operates.

We transfer information only to providers that are bound by data protection laws or contract terms giving protection substantially similar to POPIA, as section 72 of the Act requires.

All traffic to DriveSync is encrypted (HTTPS). Passwords are hashed, never stored in readable form. A school’s records are visible only to that school’s accounts, by role, and to DriveSync support staff as described in section 6.

No system is perfectly secure. If we have reason to believe someone has gained unauthorised access to personal information, we will tell the affected school straight away. The Information Regulator and the people affected will be notified as soon as reasonably possible, as section 22 of POPIA requires, unless we cannot identify who they are.

We keep information for as long as the school’s account is active and it is needed for the purposes above. When a person or account is removed, their record is removed from the school’s lists straight away, and kept in our database only for as long as we need it to resolve disputes, keep accurate financial records, or meet a legal obligation.

Usage records (which screens and features you use, and when) are deleted after 13 months. If we ask you a product survey question, your answer is kept for 24 months, then the comment and the link to your account are removed.

You can ask us to permanently delete information we no longer need to keep (see section 10).

Under POPIA you can:

• ask whether we hold personal information about you, and for a copy of it (section 23);
• ask us to correct information that is wrong or out of date, or delete information we no longer have a reason to keep (section 24);
• object to us using your information, including for direct marketing and usage analytics (section 11(3)). To object to usage analytics, email us and we will stop recording your use and delete the usage records we hold about you;
• complain to the Information Regulator (section 74, and see section 13 below).

Email support@drivesync.co.za to make a request. We may need to confirm who you are first, and for records your school controls we will work through the school.

Some learners are 17, and POPIA treats anyone under 18 as a child. Before adding a learner under 18 to DriveSync, the driving school must have the consent of a parent or guardian. A parent or guardian can make any of the requests in section 10 on the learner’s behalf.

That consent covers the usage records described in section 3, which we keep for every account. We do not show product surveys to learners we know are under 18. A parent or guardian can ask us to stop recording a learner’s use at any time.

If we change how we handle personal information, we will update this page and the date at the top. For significant changes we will also tell account holders by email.

Privacy questions and requests go to our Information Officer, Antony Maposa, at support@drivesync.co.za. How to request records we hold is set out in our PAIA manual. For anything else, the support page is the better route.

If you are not happy with how we have handled your information, you can complain to the Information Regulator (South Africa):

• Website: inforegulator.org.za
• Email: enquiries@inforegulator.org.za
• Phone: 010 023 5200, or toll-free 0800 017 160
• Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191