Privacy Policy

This notice explains how we obtain, use and disclose your Personal Information, in accordance with the requirements of the Protection of Personal Information Act (“POPIA”), together with the Promotion of Access to Information Act (“PAIA”).

Your privacy is important to us. It is SHIMI’s policy to respect your privacy regarding any information we may collect from you across our website, https://www.shimi.co.za, our mobile applications, and other sites and services we own and operate.

At SHIMI, we are committed to protecting your privacy and ensuring that your Personal Information is collected and used properly, lawfully and transparently.

We only ask for Personal Information when we truly need it to provide a service to you. We collect it by fair and lawful means, with your knowledge and consent. We also let you know why we’re collecting it and how it will be used.

1. Objective

The objective of this notice is to give effect to the POPI Act and to provide clarity on the following:

1.1. What Personal Information SHIMI collects about a Data Subject and the basis thereof;

1.2. How SHIMI uses and protects the Personal Information of a Data Subject;

1.3. How long SHIMI keeps the Personal Information of a Data Subject; and

1.4. The rights of a Data Subject regarding their Personal Information.

2. Personal Information

2.1. Personal information includes:

• certain information that we collect automatically when you visit our website;
• certain information collected on registration;
• certain information collected on submission;
• and optional information that you provide to us voluntarily;

but excludes:

• information that has been made anonymous so that it does not identify a specific person;
• permanently de-identified information that does not relate or cannot be traced back to you specifically;
• non-personal statistical information collected and compiled by us; and
• information that you have provided voluntarily in an open, public environment or forum including any blog, chat room, community, classifieds, or discussion board (because the information has been disclosed in a public forum, it is no longer confidential and does not constitute personal information subject to protection under this policy).

2.2. Common examples

Common examples of the types of personal information which we may collect and process include your:

• identifying information – such as your name, date of birth, or identification number of any kind;
• contact information – such as your phone number or email address;
• address information – such as your physical or postal address;
• location information – such as the addresses you send goods to and from, and your device’s location where you have permitted us to use it (see clause 4); or
• demographic information – such as your gender or marital status.

2.3. Sensitive Personal Information

Depending on the goods or services that you require, we may also collect sensitive personal information including your:

• financial information – such as your bank account details;
• sensitive demographic information – such as your race or ethnicity;
• criminal information – such as information about your commission or alleged commission of any offense or about any related legal proceedings;
• employment information – including your membership of a trade union; and
• beliefs – including your political or religious beliefs.

3. Collection

Only information that is adequate, necessary, and relevant to enable SHIMI to effectively render a service or assist in any manner required is collected.

3.1. On Registration

Once you register on our website, you will no longer be anonymous to us. You will provide us with certain personal information when you register on our website.

This personal information will include:

• your name and surname;
• your email address;
• your telephone number;
• your company name, company registration number, and VAT number;
• your postal address or street address; and
• your username and password.

We will use this personal information to fulfill your account, provide additional services and information to you as we reasonably think appropriate, and for any other purposes set out in this policy.

3.2. On Order or Request

When you order our goods or request our services from us, you will be asked to provide us with additional information. This personal information will include:

• your clients’ name and surname;
• your clients’ email address;
• your clients’ telephone number;
• your clients’ company name, company registration number, and VAT number; and
• your clients’ postal address or street address.

We will use this personal information to fulfill your account, provide additional services and information to you as we reasonably think appropriate, and for any other purposes set out in this policy.

3.3. Sensitive Personal Information

We automatically receive and record internet usage information on our server logs from your browser, such as your Internet Protocol address (IP address), browsing habits, click patterns, version of software installed, system type, screen resolutions, colour capabilities, plug-ins, language settings, cookie preferences, search engine keywords, JavaScript enablement, the content and pages that you access on the website, and the dates and times that you visit the website, paths taken, and time spent on sites and pages within the website (usage information).

3.4. Electronic Communications sent to SHIMI

Electronic communications such as emails, text messages, website posts or any other direct communications are stored by SHIMI.

4. Location Information

SHIMI is a courier and delivery service, so location is central to what we do. This clause sets out exactly what location information we access and collect on our website and in our mobile applications, why we need it, who we share it with, how long we keep it, and how you can switch it off.

4.1. Location we access and collect from customers

• Addresses you give us. The collection and delivery addresses you type or choose from our address suggestions, together with the geographic coordinates (latitude and longitude) of those addresses. We need these to work out the road distance and the price of your trip, to dispatch a vehicle, and to give the driver directions.
• Your device’s location, when you ask us to use it. If you choose “Use my current location”, we ask your device or browser for its current location and use it once, at that moment, to fill in that address field for you. We access this only after you have granted the location permission, and only while you are actively using the app or website – we do not collect a customer’s location in the background or when the app is closed. If you decline the permission, everything still works; you simply type the address in yourself.
• Approximate location derived from your IP address. The internet usage information described in clause 3.3 includes your IP address, which indicates an approximate, city-level location. We use this for security, fraud prevention and aggregated analytics, not to pinpoint you.

4.2. Location we access and collect from drivers and carriers

If you use SHIMI as a driver or carrier, we and our dispatch provider collect your device’s precise location while you are signed in and on duty, including while the application is running in the background or your screen is off. We need this in order to:

• offer you jobs that are near you, and route you between stops;
• show the customer where their goods are and give them an accurate estimated arrival time;
• confirm that a collection or delivery took place at the correct address, and record proof of collection and delivery; and
• investigate incidents, disputes and safety concerns.

Location collection stops when you go off duty or sign out of the driver application. We do not collect a driver’s location while they are off duty.

4.3. Who we share location information with

• Google (Google Maps Platform) – to suggest addresses, convert addresses and coordinates into one another, and calculate routes and distances.
• Our fleet dispatch and tracking provider (Tookan, operated by Click Labs) – to allocate and track jobs, navigate drivers, and generate the live tracking view for a delivery in progress.
• The customer of a job that is in progress – while a job is active, the customer can see the approximate live position of the vehicle and its estimated arrival time. We do not share a driver’s home base or off-duty location with customers.
• Other service providers under contract, as described in clause 7, and any disclosure required of us by law.

4.4. How long we keep location information

Addresses and coordinates attached to an order form part of that order record and are kept in line with clause 8. Driver location records are kept for as long as we or our dispatch provider need them for operational, billing, proof-of-delivery, dispute and safety purposes, and for any period the law requires, after which they are deleted or reduced to statistics that no longer identify anyone.

4.5. How to switch location off or withdraw your permission

You can grant or withdraw the location permission at any time in your device or browser settings:

• Android – Settings → Apps → SHIMI → Permissions → Location.
• iOS – Settings → SHIMI → Location.
• Web browsers – through the site permissions or padlock icon in the address bar.

Withdrawing your permission does not affect processing we lawfully carried out before you withdrew it. As a customer you can continue to use SHIMI with location switched off by entering addresses yourself. As a driver, location is necessary to receive and complete jobs, so if you switch it off we will not be able to dispatch work to you.

4.6. What we do not do with location information

• We do not sell your location information.
• We do not use location information for advertising or ad targeting, and we do not share it with data brokers or advertising networks.
• We do not collect a customer’s device location in the background or while the app is closed.

5. Protecting The Data Subject’s Personal Information

It is a requirement of POPI to adequately protect Personal Information. SHIMI will continuously review its security controls and processes to ensure that Personal Information is secure. The following procedures are in place in order to protect Personal Information:

5.1. THE SHIMI GROUP INFORMATION OFFICER is Tony Foss whose details are available below and who is responsible for the compliance with the conditions of the lawful processing of Personal Information and other provisions of POPI.

5.2. This Policy has been put in place and training on this policy and the POPI Act will be conducted on an ad hoc basis;

5.3. Each new employee will be required to sign an employment contract containing relevant consent clauses for the use and storage of employee information, or any other action so required, in terms of POPI;

5.4. SHIMI product suppliers, insurers, and other third-party service providers will be required to guarantee their commitment to the protection of Personal Information;

5.5. From time to time, SHIMI may provide links to websites or mobile applications that it does not own or control. This Notice does not apply to those websites. If a Data Subject chooses to use those websites, he must check the legal and privacy policies or statements posted on each website or mobile application he accesses to understand their privacy practices.

6. How SHIMI Uses The Information of A Data Subject

6.1. The purposes we process for

We may use or process any goods or services information, or optional information that you provide to us for the purposes that you indicated when you agreed to provide it to us. Processing includes gathering your personal information, disclosing it, and combining it with other personal information. We generally collect and process your personal information for various purposes, including:

• goods or services purposes – such as collecting orders or requests for and providing our goods or services;
• marketing purposes – such as pursuing lawful related marketing activities;
• business purposes – such as internal audit, accounting, business planning, and joint ventures, disposals of business, or other proposed and actual transactions; and
• legal purposes – such as handling claims, complying with regulations, or pursuing good governance.

We may use your usage information for the purposes described above and to:

• remember your information so that you will not have to re-enter it during your visit or the next time you access the website;
• monitor website usage metrics such as total number of visitors and pages accessed; and
• track your entries, submissions, and status in any promotions or other activities in connection with your usage of the website.

6.2. The information we hold, and what each kind is used for

Set out below is the information we actually collect through our website and mobile applications, and what we use each kind of it for. Location information is dealt with separately in clause 4.

• Your name, mobile number and email address – to create and secure your account, to send you a one-time code when you sign in, to confirm a booking, to let your driver and our support team reach you about a job that is in progress, and to issue your invoice and receipt.
• The collection and delivery details of a trip – the addresses, the contact person you nominate at each stop, and any access instructions you give us – to price the trip, dispatch a vehicle, direct the driver, and let the person at each stop be contacted on arrival. Where you nominate somebody else as a contact, you are asking us to contact them on your behalf.
• A description and photographs of what you are sending, together with any weight or dimensions you tell us – to work out which vehicle and how much crew your load needs, to price it, and to tell the driver what to expect. See clause 6.3 for how photographs and descriptions are processed.
• Your booking and payment history – to take payment, apply any promotion code, provide support, handle cancellations, refunds and disputes, and to meet our accounting and tax obligations.
• Your payment details – card payments are made on our payment provider’s own secure checkout. SHIMI does not receive or store your full card number. We keep a record of the amount, the outcome and the reference of each payment attempt so that we can reconcile, refund and support your order.
• Driver and carrier application information – your identity number, your driving licence, photographs of your vehicle and of its licence disc and number plates, your residential address, your operating base, and your banking details and tax number where you give them to us – to check that you are entitled to drive, that the vehicle is licensed and matches what you have told us, to allocate work to you, and to pay you.
• Records of a completed job – timestamps, the signature or photograph captured as proof of collection and delivery, and any incident noted – to prove that a job was performed, to resolve disputes and claims, and to measure the quality of a carrier’s service.
• Messages you exchange with us, including WhatsApp messages and emails, and notes our team records about a conversation – to answer you, follow up on a quote you asked for, and keep a record of what was agreed.
• Device and usage information as described in clause 3.3 – to keep the service secure, detect and prevent fraud and abuse, diagnose faults, and understand in aggregate how our website and applications are used.

6.3. Automated processing and artificial intelligence

We use automated tools, including third-party artificial intelligence services, in two places. We tell you this plainly because it means information you give us is sent to a service provider outside SHIMI in order to produce the result:

• Working out what your load needs. When you describe what you are sending, or photograph it using the camera button, that description and those photographs are sent to an artificial intelligence provider on our behalf. It reads them and returns a suggested vehicle size and crew, which we use to price your trip. The result is a suggestion: you can change the vehicle yourself before you book, and nothing about your booking is decided solely by that tool.
• Reading a driver’s vehicle documents. When you apply to drive with us, the photographs you take of your vehicle, its licence disc and its number plates are sent to the same kind of service to read the printed details, so that you do not have to type them in and so that we can check that the disc and the plates agree with each other. You are shown what was read and can correct it. A member of our team reviews and decides on every application; an application is never approved or rejected by an automated process alone.

We only send what the tool needs to do that job. We do not use these tools to make decisions about you that have a legal effect or a similarly significant effect on you, and you may ask us to review any suggestion a tool has made.

6.4. What we do not do with your information

• We do not sell your personal information.
• We do not share your personal information with data brokers or advertising networks, and we do not use the details of what you send or where you send it for advertising or ad targeting.
• We do not use the contents of a driver’s identity or banking information for any purpose other than checking entitlement to drive, allocating work and paying that driver.

7. Disclosure

7.1. Who we may share information with

We may share your personal information with:

• other divisions or companies within the group of companies to which we belong so as to provide joint content and services like registration, for transactions and customer support, to help detect and prevent potentially illegal acts and violations of our policies, and to guide decisions about our products, services, and communications.
• an affiliate, in which case we will require the affiliates to honour this privacy policy;
• our goods or services providers under contract who help provide certain goods or services or help with parts of our business operations, including fraud prevention, bill collection, marketing, technology services (our contracts dictate that these goods or services providers only use your information in connection with the goods or services they supply or services they perform for us and not for their own benefit);
• credit bureaus to report account information, as permitted by law;
• banking partners as required by credit card association rules for inclusion on their list of terminated merchants (in the event that you utilise the services to receive payments and you meet their criteria); and
• other third parties who provide us with relevant services where appropriate.

7.2. The service providers we rely on

SHIMI is a small operation and we run on third-party infrastructure. The providers below process personal information on our behalf, under contract, and only for the purpose described. Some of them are outside South Africa, which means your information may be processed in another country; where that happens we rely on the transfer grounds permitted by section 72 of POPIA.

• Supabase – hosts our database and our sign-in system, and so holds your account, address book and order records.
• Vercel – hosts and serves our website and application.
• Google (Maps Platform) – address suggestions, converting addresses and coordinates into one another, and route distances.
• Tookan, operated by Click Labs – our fleet dispatch and tracking system. It receives the trip, the stop addresses, the contact name and number at each stop, and the driver’s location while on duty.
• Peach Payments – processes card payments and holds your card details on its own systems.
• FlowIQ, and WhatsApp (Meta Platforms) – deliver your one-time sign-in codes and service messages to your mobile number over WhatsApp.
• OpenRouter and the artificial intelligence model providers it routes to – receive the cargo descriptions, cargo photographs and driver vehicle-document photographs described in clause 6.3.
• Xero – our accounting system, which receives your name, contact details and invoice lines so that we can invoice you and keep our books.
• Sentry – error monitoring, so that we can find and fix faults. We remove personal identifiers from these reports before they are sent.
• Google Analytics – aggregate website and application usage statistics, as described in clause 3.3.

We may add or change providers as our service changes. Where we do, we will keep this clause up to date and continue to require the same standard of protection.

8. How Long SHIMI Will Keep Personal Information of A Data Subject

SHIMI will always keep the Personal Information of a Data Subject for the period required by law and where it needs to do so in connection with legal action or an investigation in which it is involved. Otherwise, SHIMI will keep Personal Information of a Data Subject:

8.1. For as long as needed to provide the Data Subject with access to services he has requested; or

8.2. Where the Data Subject has contacted SHIMI with a question or request, for as long as necessary to allow SHIMI to respond to the question or request and as required by law.

9. The Data Subject’s Right Regarding Their Personal Information

9.1. The Data Subject is entitled to:

9.1.1. Request SHIMI for access to Personal Information SHIMI holds about him;

9.1.2. Request the correction and/or deletion of his Personal Information on reasonable grounds;

9.1.3. Request the restriction of the processing of his Personal Information, or object to that processing;

9.1.4. Withdraw his consent to the processing of his Personal Information (where SHIMI is processing his Personal Information based on his consent);

9.1.5. Withdraw his consent to receive marketing messages;

9.1.6. Complain to his local data protection authority if his privacy rights are violated, or if he has suffered as a result of unlawful processing of his Personal Information.

9.2. Deleting your account and your information

You can delete your SHIMI account yourself at any time. Sign in, open your Account page, and choose to delete your account. You do not have to ask us, and you do not have to give a reason.

When you delete your account:

• your profile, your saved addresses, your saved contacts and your sign-in credentials are deleted, and you are signed out immediately;
• the records of orders you have already placed are kept, but are no longer linked to your account. We keep them because a completed delivery is a transaction we are required to be able to account for – see clause 8 – and because the person who received the goods may still need us to answer for the job. Note that an order record still holds the details of that job, including the name, telephone number and email address given for the contact at each stop, which may be yours. Those are part of the transaction record and are kept and disposed of under clause 8. If you want them removed too, ask our Information Officer and we will tell you what we can remove and what we are obliged to keep; and
• information already passed to a service provider under clause 7.2 in order to carry out a job – for example the delivery record held by our dispatch provider, or the invoice held in our accounting system – is kept and deleted on that system’s own retention terms.

If you have applied to drive with us, read this first. Your driver application is attached to the same account, so deleting the account also deletes your application, the vehicles on it, and the documents and photographs you uploaded – including an application that has already been submitted or approved. That cannot be undone, and you would have to apply again from the beginning. If you want one of the two removed and not the other, write to our Information Officer instead of using the button.

For anything else – information not attached to an account, or a request to delete something we have kept – write to our Information Officer at the address in clause 9.3 and we will action it. We will tell you what we have deleted and what we are obliged to keep, and why.

9.3. The details of SHIMI’s Information Officer and Head Office are as follows:

10. Amendments To This Policy

Amendments to, or a review of this Policy, will take place on an ad hoc basis or at least once a year. Clients are advised to access SHIMI’s website periodically to keep abreast of any changes. Where material changes take place, clients will be notified directly or changes will be stipulated on the SHIMI website.