Privacy Policy

1. Introduction

FleetXchange ShortHaul (trading as Fleetxchange (Pty) Ltd) ("FleetXchange", "we", "our", "us") respects the privacy of everyone who uses the FleetXchange platform, including clients, transporters, drivers, website visitors, and mobile application users.

This Privacy Policy explains how we collect, use, disclose, store, and protect personal information, and is aligned with our internal Data Protection & Information Security Policy. It is issued in compliance with:

• The Botswana Data Protection Act, 2024 ("DPA 2024") — effective 14 January 2025
• The Transfer of Personal Data Order, 2022 — designating approved recipient countries
• The Botswana Electronic Records (Evidence) Act
• The Financial Intelligence Act (anti-money laundering obligations)
• PCI DSS Level 1 standards (payment card data security)

By registering for or using FleetXchange services, you acknowledge that you have read and understood this Privacy Policy. Where our processing is based on your consent, you may withdraw that consent at any time without detriment (see Section 9).

2. Information We Collect

FleetXchange collects only personal information that is adequate, relevant, and limited to what is necessary for the purposes described in this Policy (the principle of data minimisation under DPA 2024, Section 7).

2.1 Client Information

• Company name and registration number (where applicable)
• Full name and identity/passport number (mandatory for individual clients operating without a registered company)
• Contact person name, designation, phone number, and email address
• Physical and postal address
• Tax Identification Number (TIN) / VAT registration, where relevant
• Load descriptions, cargo value, and route information
• Payment token references (we never receive or store raw card data)

2.2 Transporter Information

• Company registration documents (where applicable)
• Full name and identity/passport number (mandatory for individual/owner-operator transporters)
• Director / beneficial owner information
• Physical and postal address, and contact details
• Driver details, licence numbers, and PrDP classifications
• Vehicle registration and roadworthiness certificates
• Insurance certificates and cross-border permits
• Real-time and historical GPS location data collected during Trips

2.3 Transaction Information

• Load details, weight, and commodity type
• Origin and destination route information
• Delivery confirmations and proof of delivery (POD)
• Payment records (token and status only — never raw card data)
• Dispute and incident records

2.4 Sensitive Personal Information

In limited circumstances, we may collect information that constitutes sensitive personal information under Section 26 of the DPA 2024, such as identity document numbers and biometric references embedded in driver licences. This information is collected only where strictly necessary, processed under explicit consent or legal obligation, and subject to enhanced access controls and encryption.

3. How We Use Your Information

We only process personal information where a valid lawful basis exists, in accordance with Section 14 of the DPA 2024:

Specifically, we use your information to:

• Create and manage your FleetXchange account
• Match Clients with vetted Transporters and coordinate Loads
• Process payments and recover commissions
• Provide tracking, visibility, and status updates during a Trip
• Facilitate GIT insurance where opted into
• Communicate with you about bookings, disputes, and account matters
• Comply with tax, AML, and transport regulatory obligations
• Improve and secure the FleetXchange platform

4. How We Share Your Information

We do not sell personal information. We share personal information only where necessary to provide our services, comply with the law, or as set out below:

• With Transporters or Clients as necessary to execute a confirmed Load (e.g. contact details, pickup/delivery information)
• With payment processors (CyberSource, PCI DSS Level 1 certified) to process card payments — we never receive raw card data
• With our insurer (Botswana Insurance Company (Pty) Ltd) where GIT insurance has been opted into, for premium declaration and claims handling
• With Asset Track (The Telematics Group (Pty) Ltd), our appointed tracking provider, for GPS and telematics services
• With cloud infrastructure and document storage providers who process data on our behalf under a signed Data Processing Agreement
• With regulators, tax authorities, or law enforcement where required by law
• With professional advisers (legal, audit) under confidentiality obligations
• In connection with a business transaction (e.g. merger or sale), subject to equivalent privacy protections

Every third party that processes personal data on our behalf is bound by a signed Data Processing Agreement requiring appropriate technical and organisational safeguards, in accordance with Sections 38–42 of the DPA 2024.

5. Cross-Border Data Transfers

FleetXchange operates across Southern African corridors and relies on cloud infrastructure. Section 74 of the DPA 2024 governs the transfer of personal data outside Botswana.

5.1 Approved Countries

Your personal data may be transferred freely to any country designated as approved under the Transfer of Personal Data Order, 2022, without additional safeguards or Commission authorisation. Our primary hosting region is South Africa (AWS Cape Town), which is on the approved list. A copy of all personal data transferred outside Botswana is retained within Botswana in accordance with the DPA 2024 soft localisation requirement.

5.2 Countries Not on the Approved List

For transfers to countries not on the approved list (for example DRC, Zambia, or Zimbabwe, relevant to FleetXchange Long Haul cross-border operations), we only transfer your data where the Commissioner has made an adequacy assessment, appropriate contractual safeguards are in place, you have given explicit informed consent, the transfer is necessary to perform our contract with you, or the transfer is necessary to protect your vital interests or establish a legal claim.

6. Data Storage & Security

We implement technical and organisational measures appropriate to the sensitivity of the data we hold, in accordance with Section 43 of the DPA 2024, including:

• Encryption of data in transit (TLS 1.2 or higher) and at rest (AES-256)
• Role-based access control, limiting access to personal data on a need-to-know basis
• Multi-factor authentication for all administrator accounts
• Continuous intrusion detection monitoring and regular vulnerability scanning
• Annual penetration testing and critical security patching within 72 hours of release
• Immutable audit logging of logins, data exports, and administrative changes

We do not store, process, or transmit primary account numbers (PAN), CVV data, or cardholder authentication data. All card payments are processed directly by CyberSource, an independently certified PCI DSS Level 1 payment processor; FleetXchange receives only a tokenised reference.

7. Data Retention

We retain personal data only for as long as necessary for the purposes it was collected, or as required by law. Our retention periods are:

Once the applicable retention period expires, your personal data is securely destroyed — digital records through cryptographic erasure or certified deletion, and physical records through cross-cut shredding.

8. Your Rights

Under Sections 47–57 of the DPA 2024, you have the following rights in relation to your personal data. We will honour valid requests within the timeframes below:

To exercise any of these rights, submit a request in writing to our Data Protection Representative using the contact details in Section 13. We will acknowledge your request within 5 business days and resolve it within 30 days; complex requests may be extended by a further 30 days with written notice to you.

You also have the right to lodge a complaint with the Information and Data Protection Commission (IDPC), Botswana's data protection regulator, if you believe we have not handled your personal data in accordance with the DPA 2024.

9. Consent & Withdrawal

Where we rely on your consent to process personal data — for example, for marketing communications or optional analytics — you may withdraw that consent at any time without detriment. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal, and will be actioned at our next processing cycle following your request.

Withdrawing consent for optional processing does not affect data we process on other lawful bases, such as contractual necessity or legal obligation, which remains necessary to provide you with FleetXchange services.

10. Children's Privacy

FleetXchange services are intended for use by businesses and individuals over the age of 18. We do not knowingly collect personal information from minors. If we become aware that we have collected personal data from a minor without appropriate consent, we will delete it promptly. If you believe a minor has provided us with personal information, please contact us using the details in Section 13.

11. Cookies & Tracking Technologies

FleetXchange uses cookies and similar technologies on its web platform and mobile applications. Under the DPA 2024 and applicable electronic communications regulations, non-essential cookies require your consent.

You may withdraw cookie consent at any time by adjusting your browser settings or using the cookie preference centre on our website. Disabling strictly necessary cookies will impair platform functionality.

12. Policy Updates

We may update this Privacy Policy from time to time to reflect changes in legislation, our practices, or our services. We will notify you of material changes by email to the address registered on your account, by prominent notice on the FleetXchange platform, or by any other method required by applicable law.

The updated Policy will state its effective date. Continued use of FleetXchange services after that date constitutes acceptance of the revised Policy where processing is based on legitimate interests or contract. Where processing is based on consent, we will seek fresh consent before processing under the revised terms.

13. Contact Us

For any questions about this Privacy Policy, to exercise your data subject rights, or to report a suspected data breach, please contact our Data Protection Representative:

If you are not satisfied with our response, you may lodge a complaint with the Information and Data Protection Commission (IDPC), Botswana's data protection regulator.