Legal
Last updated: 23 June 2026 · Version 1.0
Vya is committed to protecting your privacy in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA). This policy explains what personal information we collect, why we collect it, and what rights you have over it. Please read it carefully before using our platform.
Vya is a long-distance shuttle booking platform operated by Vya (Pty) Ltd ("Vya", "we", "us", or "our"). We connect passengers with vetted drivers for scheduled door-to-door shuttles between Gauteng and Limpopo.
We are the Responsible Party for your personal information as defined in the Protection of Personal Information Act 4 of 2013 (POPIA). Our Information Officer is registered with the Information Regulator of South Africa (Registration No. 2026-062157). Questions about this policy can be directed to our Information Officer at privacy@vya-gae.com.
We collect the following categories of personal information:
Account information — your first name, last name, email address, phone number, and password (stored as a one-way hash).
Booking information — pickup and drop-off addresses, travel dates, seat selections, and payment status.
Driver information (drivers only) — identity document, driver's licence, vehicle registration, bank account details for payouts, and profile photo.
Usage information — your IP address, device type, and how you interact with the platform (page views, search queries). This is used to improve the service and is not sold.
Location — your approximate location during active trips (shared by the driver, not collected from your device unless you grant permission).
We do not collect race, religion, health, biometric, or other special category information as defined in POPIA section 26.
We process your personal information only for the following purposes:
To provide our service — creating and managing your account, processing bookings, matching you with a driver, and sending trip confirmations.
To process payments — passing required booking details to our payment processor. We do not store full card numbers.
To pay drivers — calculating and scheduling EFT payouts using the bank details drivers provide.
To communicate with you — sending booking confirmations, OTP codes, trip status updates, and important service notices via SMS and email.
Safety — verifying driver documents, logging incidents reported through the SOS feature, and investigating disputes.
Legal compliance — retaining records as required by South African tax and consumer protection law.
The legal basis for processing is your explicit consent given at registration (POPIA section 11(1)(a)), and the performance of our contract with you (section 11(1)(b)).
We retain your personal information for as long as your account is active. If you delete your account, we anonymise your personal details within 30 days. We retain booking transaction records for 5 years as required by the South African Revenue Service (SARS).
Driver compliance documents are retained for 3 years after the driver relationship ends.
Anonymised, aggregated usage data (no names or contact details) may be kept indefinitely for business analytics.
We use the following security measures:
- Passwords are hashed using bcrypt and never stored in plain text - All data in transit is encrypted using TLS/HTTPS - Database access is restricted to application servers via SSL - Access tokens expire after 15 minutes; refresh tokens after 7 days - Role-based access control limits which data each user type can access - Sensitive driver documents are stored in a restricted Cloudinary environment
No system is perfectly secure. If you suspect your account has been compromised, contact us immediately at privacy@vya-gae.com.
As a data subject, you have the following rights:
Right to access — you can download a copy of all personal data we hold about you at any time from your account settings, or by contacting us.
Right to correction — you can update your name, phone number, and email from your profile page. Contact us for other corrections.
Right to erasure — you can delete your account from the app. We will anonymise your personal details within 30 days, subject to our legal retention obligations above.
Right to object — you may object to processing of your information for direct marketing at any time by unsubscribing from emails or contacting us.
Right to complain — if you believe we have violated your rights, you may lodge a complaint with the Information Regulator of South Africa:
Website: inforegulator.org.za Email: inforeg@justice.gov.za Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
The Vya platform is not intended for use by persons under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has registered an account, contact us at privacy@vya-gae.com and we will delete it promptly.
We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of the page and, if the changes are material, notify you by email or in-app notification. Continued use of the platform after such notice constitutes acceptance of the updated policy.
The version of this policy that applied at the time you created your account is the version you consented to. You can always find the current version at vya-gae.com/privacy-policy.
For any privacy-related queries, requests to exercise your rights, or to report a concern:
Email: privacy@vya-gae.com Website: vya-gae.com
We aim to respond to all requests within 5 business days.