Table of Contents
SafePass is designed with privacy at its core. We collect only what we need, store it securely, and never sell your personal information.
1. Who We Are
SafePass is a child pickup safety and access management platform for South African schools and residential communities, operated from South Africa. We act as a responsible party under the Protection of Personal Information Act, 2013 (POPIA) in respect of the personal information we process on our own behalf, and as an operator in respect of personal information processed on behalf of our school clients.
Contact: hello@mysafepass.co.za
2. Information We Collect
2.1 Information you provide directly
| Category | Examples | Who provides it |
|---|---|---|
| Identity data | Full name, date of birth | Parents, drivers, school admins |
| Contact data | Phone number, email address | Parents, drivers, school admins |
| Authentication data | Password hash, OTP verification records | All users |
| Student roster data | Student names, DOB, student numbers | School administrators (CSV upload) |
| Vehicle data | Vehicle details entered by drivers | Drivers, parents |
| Location data | Home address (drivers), school address | Schools, drivers (optional) |
2.2 Information generated by use of the Service
- Pickup events: timestamp, method, actor identity, student identity — stored in an append-only audit trail
- GPS coordinates: driver location during active transport runs only; geofence detection when parent app is open
- Push notification tokens: device tokens for iOS and Android notification delivery
- Access codes: hashed delegate codes, 6-digit gate codes
- Visitor logs: visitor name, phone, purpose, time in/out
- Acknowledgement records: timestamps of legal document acceptance
2.3 Information we do NOT collect
- Raw biometric data or fingerprints
- Photos or video footage (photo_url references only — files hosted externally)
- Payment or financial information (billing is handled outside the platform)
- Location data outside of active transport runs or foreground app sessions
3. How We Use Your Information
| Purpose | Information used |
|---|---|
| Verifying identity of persons collecting children | Parent/driver identity, gate codes, QR tokens |
| Sending pickup and drop-off notifications | Push tokens, child names, event data |
| Maintaining the 24-month audit trail (POPIA compliance) | Pickup events — all fields |
| School administration and access management | Roster data, authorised contacts, dismissal windows |
| Transport run management and live tracking | Driver GPS, run data, student assignments |
| Visitor access management | Visitor name, phone, access codes |
| Platform security and fraud prevention | IP addresses, login timestamps |
| Service improvement (aggregate analytics only) | Anonymised usage patterns |
| Communication about the Service | Email address |
4. Legal Basis for Processing
We process personal information on the following grounds under POPIA:
- Contractual necessity: processing required to deliver the SafePass Service you have subscribed to
- Legitimate interests: platform security, fraud prevention, service improvement
- Legal obligation: 24-month audit trail retention required by applicable regulations
- Consent: location access (foreground only), push notifications — you may withdraw consent at any time through device settings
5. Sharing of Information
We do not sell, rent, or trade personal information. We share information only as follows:
- Within the school: School administrators can see all pickup events, parent contact data, and roster information for their school only. Data is strictly school-scoped at the database level via Row-Level Security.
- Between parents: When a child is collected, other approved parents linked to the same child receive a notification. This sharing is integral to the safety purpose of the platform.
- Service providers: We use the following sub-processors to deliver the Service — all operate under data processing agreements:
- Railway (database and API hosting — cloud infrastructure)
- Expo / Apple / Google (push notification delivery)
- Mapbox (driver app navigation maps)
- Resend (transactional email delivery)
- Nominatim / OpenStreetMap (address geocoding)
- Legal requirements: We may disclose information where required by law, court order, or regulatory authority.
Our super administrator (platform operator) sees aggregate data only — no parent names, student names, or any personally identifiable information is visible at the platform level. This is enforced technically, not just by policy.
6. Data Retention
| Data type | Retention period | Reason |
|---|---|---|
| Pickup events (audit trail) | 24 months | POPIA and school safety regulations |
| Visitor logs | 30 days | Operational need only |
| Account data (active users) | Duration of account + 12 months | Contractual |
| Archived students | 24 months from archiving | POPIA |
| School application records | Duration of school account | Contractual |
| Legal acknowledgement records | Duration of account + 7 years | Legal compliance |
7. Security
We implement appropriate technical and organisational measures to protect personal information against unauthorised access, loss, destruction, or alteration, including:
- Encryption in transit (HTTPS/TLS for all API communication)
- Password hashing using bcrypt with salt rounds
- Row-Level Security (RLS) in the database — each school's data is isolated
- JWT-based authentication with short-lived tokens
- Append-only audit trail (pickup events cannot be deleted or modified)
- Rate limiting on all authentication and submission endpoints
- Two-factor authentication for the platform operator account
No method of electronic transmission or storage is 100% secure. If you discover a security vulnerability, please contact hello@mysafepass.co.za promptly.
8. Your Rights under POPIA
As a data subject under POPIA, you have the following rights:
- Right of access: Request confirmation of whether we hold your personal information and obtain a copy
- Right to correction: Request correction of inaccurate or incomplete personal information
- Right to deletion: Request deletion of your personal information, subject to legal retention obligations
- Right to object: Object to processing of your personal information in certain circumstances
- Right to lodge a complaint: Lodge a complaint with the Information Regulator of South Africa
To exercise these rights, contact us at hello@mysafepass.co.za. We will respond within 30 days.
Information Regulator of South Africa:
Website: inforegulator.org.za
Email: inforeg@justice.gov.za
9. Children's Privacy
SafePass processes personal information about children (learners) as a core part of its service — specifically names, dates of birth, student numbers, and pickup event records. This processing is conducted on behalf of schools, who are responsible for obtaining appropriate authorisation from parents or guardians as required by applicable law.
SafePass does not directly collect personal information from children. All child-related data is entered by school administrators or authorised parents.
Children's personal information is subject to the same security and access controls as all other data and is never exposed to the platform operator in identifiable form.
10. Cookies and Tracking
The SafePass website (mysafepass.co.za) uses minimal cookies for essential functionality only. We do not use advertising cookies or cross-site tracking.
The SafePass admin portal uses a session cookie (httpOnly, secure, SameSite=Strict) for authentication only. No analytics or tracking cookies are used.
Mobile applications do not use cookies. They use device storage (AsyncStorage) for session persistence.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated through the app and/or by email. The effective date at the top of this page indicates when the current version took effect.
The current version of this Policy is always available at mysafepass.co.za/privacy.
12. Contact and Complaints
For questions, requests, or complaints related to this Privacy Policy:
- Email: hello@mysafepass.co.za
- Website: mysafepass.co.za
If you are not satisfied with our response, you may lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za.