Lift is a ride-hailing service for QwaQwa, built and operated by Prism Technologies (Pty) Ltd ("Lift", "we", "us", "our"). This policy covers the Lift rider app, the Lift Driver app, and Lift's web app (together, the "apps"). Under POPIA, Prism Technologies is the responsible party for the personal information described here — the party that decides why and how it's processed.
This policy applies to anyone who creates a Lift account, whether as a rider or a driver, and to anyone who uses the marketing website you're reading right now. It doesn't cover third-party services we link to or rely on (Paystack, PayFast, OpenStreetMap/Nominatim, or Google Play/the App Store once Lift is listed there) — each of those has its own privacy policy governing what it does with your information.
Account information. Name, phone number, email address, and a password (stored as a salted hash, never in plain text).
Rider profile. A 4-digit pickup PIN (stored so it can be read back to confirm your identity to a driver — this is the one deliberate exception to hashing, since the PIN is a pickup safeguard, not an account credential), your rating, and optionally saved Home/Work addresses.
Driver profile. Your driver's license number and expiry, vehicle details (make, model, year, color, plate), uploaded license/ID/vehicle documents, verification status, your rating, and your payout bank details (bank name, account holder, account number, branch code).
Location data. While you're actively using the app: your pickup point and destination as a rider, or your current position as a driver who's online (sent periodically so nearby riders can find you and so your active trip can be tracked). Lift does not track your location when the app isn't in use or a driver isn't online.
Ride & trip data. Pickup/destination, route, fare, status history, ratings and rating comments, and cancellation reasons for every ride you take or drive.
Payment data. Lift never stores your full card number. Card and EFT payments are handled by Paystack and PayFast; Lift stores only a payment reference/authorization token those providers give us, plus which provider you used.
Device & crash data. If the app crashes or hits an unexpected error, a report (error message, stack trace, and basic device info) is sent to Lift so we can fix it — this is off by default from any third-party crash service; it goes straight to Lift's own backend.
Notification & verification codes. One-time codes sent to verify your email or reset your password, valid for a short time and then discarded.
POPIA treats a handful of categories — including a person's criminal behaviour — as special personal information, which section 26 says may not be processed at all unless one of the section 27 exceptions applies (most relevantly here, that you've consented, or that processing is necessary to establish or defend a legal right).
Lift's driver onboarding today collects license and vehicle details but does not yet collect criminal record checks, sex offender register checks, or an e-hailing-specific Professional Driving Permit (PrDP). South Africa's National Land Transport Amendment Act e-hailing regulations, in force since March 2026, require e-hailing drivers to hold an e-hailing operating licence and PrDP, and to pass an annual criminal record check and a National Sex Offender Register check administered through the relevant Provincial Regulatory Entity. If and when Lift starts capturing or verifying this information — directly, or by relying on a check already performed by the licensing authority — it will be treated as special personal information under sections 26–27: collected only with your explicit consent, used strictly to confirm your eligibility to drive, and not shared beyond what verification requires. This section will be updated first if that changes.
POPIA's eight conditions for lawful processing (accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards, and data subject participation) shape everything below. In practice, each category of information above is processed on one of these grounds:
| Ground | When it applies |
|---|---|
| Necessary to perform our contract with you | Account, rider/driver profile, location during a trip, ride & trip data, payment references — without these, Lift can't actually provide a ride. |
| Your consent | Optional data like saved Home/Work addresses, and any future special personal information described in section 4. |
| Our legitimate interest, balanced against your privacy | Crash/error reports (to keep the apps working), ratings (to keep the service trustworthy), fraud and safety investigations. |
| A legal obligation | Retaining certain financial records for tax purposes (section 9), and responding to a lawful request from a regulator or law enforcement. |
One thing we deliberately don't do: Lift's driver matching (the first available driver to accept a request gets it) and fare calculation are plain, transparent rule-based logic, not profiling or automated decision-making about you within the meaning of POPIA section 71 — no algorithm scores you or makes a legal or similarly significant decision about you without a person able to review it.
POPIA section 72 restricts sending personal information to a third party outside South Africa unless the receiving party is subject to a comparable law or binding agreement, you've given informed consent to the transfer, or the transfer is necessary to perform our contract with you. Nominatim's geocoding service is operated by the OpenStreetMap Foundation outside South Africa, so a destination search you run is sent there on the basis that it's necessary to perform the ride-request part of our contract with you (there's no other way to look up an address). Paystack and PayFast may also process or store data using infrastructure outside South Africa as part of running their own payment services — see their policies for specifics.
You can delete your account at any time from Account settings in either app. Deleting your account scrubs your name, email, and phone number to a placeholder and disables sign-in immediately — it does not delete your past rides outright, since those rides are also part of the other party's (driver's or rider's) trip history; instead they show as taken by a "Deleted User." Once deleted, your original email address is free to be used again for a new account.
Some records are kept longer than an active account, because we're required to or because it's reasonable to: financial records tied to a ride (fare, payment reference) may be retained for up to five years to meet South African tax recordkeeping obligations under the Tax Administration Act, and records of a specific ride may be kept longer if there's an open dispute, safety report, or legal claim involving it.
Under POPIA, you have the right to:
Most of this you can already do yourself in-app (edit your profile, delete your account); for anything else, contact us using the details in section 18. We'll respond to a request within a reasonable time, and may need to verify your identity first so we don't hand your information to the wrong person.
Lift is not intended for anyone under 18, and POPIA sections 34–35 generally prohibit processing a child's personal information without the consent of a "competent person" (typically a parent or legal guardian). We don't knowingly collect information from children, and account creation requires confirming you're 18 or older. If we learn that an account belongs to someone under 18, we'll suspend it and delete the personal information associated with it, unless we're required to keep something by law.
POPIA's security safeguards condition requires us to prevent loss, damage, or unauthorised access to your personal information. In practice: passwords are salted and hashed, not stored in plain text; sessions expire and are revoked immediately if your account is deleted; login is rate-limited against brute-force attempts; and access to driver documents and payout details is restricted to what the service needs to verify and pay drivers. No system is perfectly secure, and we can't guarantee that information you send us will never be intercepted or accessed without authorisation — but we treat a security incident as something to prevent, not something to shrug off.
POPIA section 22 requires us to notify both the Information Regulator and affected data subjects as soon as reasonably possible if we have reasonable grounds to believe your personal information has been accessed or acquired by an unauthorised person — after taking any time genuinely needed to assess the scope of the incident or to support a law enforcement investigation. If that ever happens, we'll tell you what happened, what information was involved, and what we're doing about it, through the app or the contact details you've given us.
This marketing website doesn't set its own cookies or run any analytics or advertising trackers. It does load an icon font from a third-party CDN (cdnjs, operated by Cloudflare) purely to render icons on the page — that request may log your IP address the same way any web request does, per Cloudflare's own privacy policy, but Lift doesn't receive or use that data. Within the apps themselves, a few preferences (like your chosen theme and distance unit) are stored only on your own device and are never sent to Lift's servers.
POPIA section 55 requires every responsible party to have a registered Information Officer — the person accountable for POPIA compliance and the point of contact for data subject requests and regulator communication. [TODO: name the Information Officer and register them with the Information Regulator before this policy goes live]; until then, direct any request under this policy to the contact details in section 18.
If you're unhappy with how we've handled your personal information or a request about it, you can complain directly to South Africa's data protection authority:
The Information Regulator (South Africa)
Email: POPIAComplaints@inforegulator.org.za
Phone: +27 10 023 5200
Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Website: inforegulator.org.za
If this policy changes in a way that matters to how your data is used, we'll update this page and change the "last updated" date above. Where a change is significant, we'll also try to let you know in-app.
Questions about this policy or your data: support@prismtech.online.
