This Privacy Policy describes how Finkash (Pty) Ltd ("Finkash", "we", "us", or "our") collects, uses, shares, retains, and protects Personal Information when you use the ActiveBoarder service ("Platform"). It also explains your rights under the POPI Act and, where applicable, the GDPR.

1. Introduction and Scope

This policy applies to all Personal Information processed by Finkash in connection with the Platform, including data relating to authorised users and other individuals whose information is entered into the Platform by our clients.

The Platform is a business-to-business service. Individual users access the Platform through their employing organisation (the "Client"). Where Finkash acts on behalf of a Client, the Client's own privacy notice may apply in addition to this policy.

This policy does not apply to third-party websites or services that may be linked from the Platform.

2. Who We Are

For the purposes of the POPI Act, Finkash (Pty) Ltd is the Responsible Party in respect of Personal Information that we collect for our own business purposes (e.g. account administration, billing, marketing).

For the purposes of the GDPR (where applicable), Finkash acts as the Data Controller for account and billing data, and may act as a Data Processor for content processed on behalf of our Clients.

Finkash (Pty) Ltd Reg No. 2018/333167/07, Gauteng, South Africa Information Officer: info@finkash.co.za Phone: +27 (12) 880 3121

3. What Personal Information We Collect

We collect the following categories of Personal Information through the Platform:

Identity Data: Full name, employee or driver identification number, driver's licence number and category, licence expiry date, ID number or passport number (where required for driver licence verification).

Contact Data: Email address, telephone number, job title, department, and organisational unit.

Operational Data: Record entries, supporting documents, status updates, and related metadata entered into the Platform.

Location Data: GPS co-ordinates and similar location-related information where the Platform is used with location features enabled.

Usage Data: Login timestamps, pages visited, features used, API requests, form submissions, and activity logs.

Device Data: Device type, operating system version, notification tokens, and IP address.

Financial Data: Billing contact name, invoice address, subscription details, and payment reference numbers. We do not store full payment card numbers.

Communications: The content of support requests, contact form submissions, and in-app feedback you submit to us.

4. How We Collect Personal Information

4.1 Directly from you: when you register an account, complete profile forms, submit contact or demo request forms, or communicate with our support team.

4.2 Automatically: when you use the Platform, we collect usage data, device data, and IP addresses through server logs, error monitoring tools, and application analytics. Location data may be collected where enabled by the Client.

4.3 From third parties: in limited cases, information may be received from your employing organisation (the Client) when user accounts are created on your behalf, or from third-party identity verification services where applicable.

5. Why We Process Your Information (Legal Bases)

We process Personal Information on the following legal bases:

Contract Performance: Processing is necessary to provide the Platform services under our subscription agreement.

Legitimate Interest: We process usage logs, error reports, and security events to maintain the security, stability, and improvement of the Platform.

Legal Obligation: We retain billing records, logbook data, and other records to comply with applicable tax, accounting, and recordkeeping laws.

Consent: Where required by law (e.g. certain marketing communications or processing of special categories of data), we will seek your explicit consent. Consent may be withdrawn at any time without affecting the lawfulness of processing prior to withdrawal.

6. How Long We Retain Your Information

We retain Personal Information only for as long as necessary for the purposes described in this policy or as required by law. The table below summarises our standard retention periods:

Category	Examples	Retention Period	Legal Basis
Account Data	Name, email address, role, tenant assignment, login timestamps	5 years after account closure	Legal obligation; legitimate interest
Authentication Logs	Sign-in events, password changes, session tokens	90 days	Legitimate interest (security)
Location Data	Location-related information where enabled	12 months	Contract performance; legitimate interest
Operational Records	Record entries and supporting documents	5 years	Contract performance; legal obligation
Usage Logs	Error logs, API request logs, performance traces	90 days	Legitimate interest (service stability)
Notification Records	Delivery status and related message metadata	12 months	Legitimate interest
Billing Records	Invoice history, payment references, subscription changes	7 years	Legal obligation (tax/accounting)
Support Communications	Email threads, contact form submissions	3 years	Legitimate interest; contract performance

After the applicable retention period expires, Personal Information is securely deleted or anonymised in accordance with our data disposal procedures.

We do not sell Personal Information to third parties. We may share information with the Client organisation, authorised users within that organisation, service providers that help us host and operate the Platform, advisers, regulators, law enforcement, and payment or communications providers where needed.

8. International Data Transfers

Some service providers may process data outside South Africa. Where this happens, we use appropriate legal safeguards.

9. Your Rights

Subject to applicable law, you may have rights to access, correct, delete, restrict, or object to certain processing of your Personal Information, and to lodge a complaint with the relevant regulator. To exercise those rights, contact info@finkash.co.za.

10. Cookies and Tracking

The ActiveBoarder web portal uses essential cookies and similar technologies for session management, security, and preferences. We do not use advertising cookies.

11. Security Measures

Finkash implements technical and organisational measures such as encryption in transit, access controls, logging, monitoring, tenant isolation, backups, and ongoing security maintenance. No system is completely secure.

12. Children's Data

The Platform is designed for use by organisations and their authorised adult employees. We do not knowingly collect Personal Information from minors.

13. How to Contact Us / Lodge Complaints

For any questions, concerns, or requests relating to this Privacy Policy, please contact info@finkash.co.za. Where applicable, you may also lodge a complaint with the Information Regulator of South Africa.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Platform, or applicable law. When we make material changes, we will update the "Effective date" at the top of this page and provide notice where practicable.

We encourage you to review this Privacy Policy periodically. Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the revised policy.

Privacy Policy