1.Who we are & how to contact us
Mylz Auto (Pty) Ltd (registration number [to be confirmed]), trading as Mylz Rentals, is the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA) for the personal information described in this policy. We provide premium vehicle rental, chauffeur and related services in Cape Town and the Western Cape, and operate the website mylzrentals.co.za and the Mylz Rentals app.
- Information Officer: [to be confirmed]
- Deputy Information Officer: [to be confirmed]
- E-mail: bookings@mylzrentals.co.za (subject line “POPIA request”)
- Phone: +27 69 644 1767
- Address: Tokai, Cape Town, South Africa. Our registered address is available on request and in our PAIA & POPIA Manual.
2.Personal information we collect
We collect only what we need for the purposes below. Depending on how you use our services, this includes:
- Identity and contact details: full name, ID or passport number, nationality, date of birth, e-mail, mobile number, residential or delivery address and, for corporate bookings, your employer and job title.
- Driver details: driver's licence number, codes, issue and expiry dates, International Driving Permit and licence history; details of additional drivers you add (you must tell them that you are sharing their information with us).
- Verification images and results: photographs or scans of your ID or passport and licence, a selfie and liveness capture, the result of comparing your selfie with your document photo, and the outcome of identity, document, blacklist and fraud checks.
- Booking and rental records: dates, vehicles, flight numbers for airport meet & greet, delivery addresses, protection plans, extras, condition reports and photographs, signatures, odometer and fuel readings, damage, claims, traffic fines and correspondence.
- Payment information: transaction references, card type and last four digits, payment-gateway tokens and deposit holds. We do not store full card numbers or CVV codes. For EFT refunds, your bank account details.
- Vehicle telematics: location, speed, distance and driving-event data from tracking devices in our vehicles.
- Account and technical data: login details (passwords are stored only as secure hashes), two-factor authentication settings, IP address, device and browser type, push-notification subscriptions, and cookies (see our Cookie Policy).
- Communications and preferences: messages by e-mail, WhatsApp, SMS and phone, reviews you submit, marketing preferences and loyalty points.
Special personal information. We do not ask for information about your religion, race, health, sex life, political persuasion or trade-union membership. A facial comparison between your selfie and your ID photograph may produce biometric information, which POPIA treats as special personal information; we process it only with your express consent (section 27(1)(a)), only for identity verification, and do not use it for any other purpose. We do not request criminal records. If a fraud-prevention check reveals information about alleged offences, we process it only as permitted by sections 27 and 33 of POPIA.
3.Why we use it & our lawful bases
We process personal information only for specific, explicitly defined purposes and on a lawful basis under section 11 of POPIA:
| Purpose | Lawful basis (POPIA s11) |
|---|---|
| Taking and managing bookings, payments, handover, return, invoices and customer support | Necessary to conclude or perform our contract with you |
| Verifying identity, age and licence of drivers before releasing a vehicle | Contract; our legitimate interest in preventing fraud and theft; consent for biometric data |
| Fraud prevention, blacklist checks and protecting our fleet and Owner Partners' vehicles | Legitimate interests of Mylz and our Owner Partners |
| Vehicle tracking for theft recovery, emergencies, kilometre and return verification | Contract and legitimate interest |
| Damage assessment, claims, recovering amounts owed and legal claims | Contract and legitimate interest |
| Nominating drivers for traffic fines (AARTO / Criminal Procedure Act) and tax and accounting records | Compliance with a legal obligation; legitimate interest |
| Responding to lawful requests from SAPS, courts and regulators | Compliance with a legal obligation |
| Security of our systems: login, two-factor authentication, audit logs | Legitimate interest; contract |
| Service messages and push notifications about your booking | Contract |
| Direct marketing and loyalty programme | Consent, or existing-customer exception in section 69(3) |
| Improving our website, app and services (aggregated statistics) | Legitimate interest |
Providing the information needed to verify drivers and conclude the rental is mandatory: without it we cannot rent you a vehicle. Other information (such as marketing preferences and reviews) is voluntary. Where we rely on consent, you may withdraw it at any time, without affecting processing that took place before withdrawal. Where we rely on legitimate interests, you may object under section 11(3).
We collect information directly from you wherever possible. We may also receive it from your employer or travel agent (for bookings they make for you), additional drivers, our verification and fraud-prevention providers, payment providers, traffic authorities, insurers and assessors, and public sources, as permitted by section 12 of POPIA.
5.Transfers outside South Africa
Some operators (for example cloud hosting, e-mail delivery, identity verification and web-push services run by browser and phone makers) may store or process information on servers outside South Africa. Under section 72 of POPIA we transfer personal information across borders only where the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection substantially similar to POPIA; where the transfer is necessary to perform our contract with you; or with your consent. Information about which countries are involved is available from the Information Officer.
6.How we protect your information
As section 19 of POPIA requires, we take appropriate, reasonable technical and organisational measures, including:
- encryption in transit (HTTPS/TLS) and encryption at rest of ID and licence numbers, with keyed hashing for look-ups;
- storage of identity documents and selfies in private, access-controlled storage that is never publicly accessible;
- role-based access controls so staff see only what their job requires, with two-factor authentication for staff accounts;
- audit logging of staff access to and changes of customer records;
- password hashing, rate limiting and session controls on customer accounts;
- written operator agreements, staff confidentiality undertakings and regular review of our safeguards.
If we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible, as section 22 of POPIA requires.
7.How long we keep it
We keep personal information only as long as needed for the purpose for which it was collected, or as required or permitted by law (section 14 of POPIA), and then delete, destroy or de-identify it.
| Record | Retention period |
|---|---|
| Bookings, rental agreements, invoices, payment and accounting records | 5 years from the end of the tax year concerned (Tax Administration Act 28 of 2011 and VAT Act), or longer if a dispute or audit is open |
| Verification documents, selfies and check results | While your account is active, plus 12 months (verification is reused for up to 12 months), unless needed longer for a claim, fraud investigation or legal obligation |
| Condition reports, damage photos, claims and fines records | 5 years after the rental ends, or until the claim or matter is finally resolved, if later |
| Vehicle telematics data | Up to 12 months, unless needed for an incident, claim or legal process |
| Fraud-prevention / do-not-rent records | For as long as justified by the risk, reviewed at least every 3 years |
| Marketing preferences | Until you opt out; your opt-out is kept so we do not contact you again |
| Account and security logs | Up to 24 months |
8.Direct marketing & opt-out
We send direct marketing by e-mail, SMS, WhatsApp or push notification only if you have opted in, or, if you are an existing customer, about our own similar services, as section 69 of POPIA permits. Every marketing message identifies us and tells you how to opt out, free of charge. You can opt out at any time using the link in the message, by replying STOP to an SMS, in your account settings, or by e-mailing bookings@mylzrentals.co.za. Service messages about an active booking are not marketing and will still be sent. We do not share your details with third parties for their own marketing.
9.Your rights & how to exercise them
Under POPIA you have the right to:
- be told that your personal information is being collected, and if it has been compromised;
- ask whether we hold your information and request access to it (section 23);
- ask us to correct, update, destroy or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (section 24);
- object, on reasonable grounds, to processing based on legitimate interests, and object at any time to direct marketing (section 11(3));
- withdraw your consent where processing relies on consent;
- not be subject to a decision based solely on automated processing that has legal consequences for you (section 71) — any automated verification flag is reviewed by a person before a booking is refused;
- lodge a complaint with the Information Regulator and institute civil proceedings.
How: signed-in customers can download a copy of their data and request account deletion on the account privacy page. You can also e-mail bookings@mylzrentals.co.za. We may ask you to verify your identity before acting, and will respond within a reasonable time (normally 30 days). Access requests are free for information in your account; formal requests for records may be made under our PAIA & POPIA Manual. Some information must be kept even after an account is deleted, for example invoices for tax purposes or records needed for an open claim; we will tell you if this applies.
10.Children
Our services are not directed at children and only adults who meet our driver-age requirements may hold an account or rent a vehicle. We may process limited information about children only where a parent or guardian gives it to us (for example a child's age to supply the right child seat or a passenger name for a chauffeur booking), with that parent's or guardian's consent as section 35 of POPIA permits.
11.Complaints to the Information Regulator
Please contact our Information Officer first so we can try to resolve your concern. You also have the right to lodge a complaint with the Information Regulator (South Africa):
- Website: inforeg.org.za
- Complaints: complaints.IR@inforeg.org.za
13.Changes to this policy
We may update this policy to reflect changes in our services or the law. The “last updated” date and version at the top of this page show when it last changed. We will notify you of material changes by e-mail or in the app before they take effect.
Related documents
This document is provided for general information and should be reviewed by a qualified South African attorney before use.