Privacy Policy

1. Who we are

APPMANSION (Pty) Ltd is the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA) for personal information we process as the main decision-maker through our products and services.

Where the UK GDPR or EU GDPR applies to our processing of your personal data, we are also the data controller for that data, to the extent those laws apply. Where you use our products only on behalf of a business and we process personal information about your clients or staff strictly on your instructions, we act as an operator or processor for that information, as described in section 2 and in any Data Processing Agreement between us.

For privacy questions and data subject requests, use the contact details in section 13. Our PAIA manual (available on request) identifies our designated privacy contact point and describes the records we hold.

When this policy says “APPMANSION”, “we”, “us”, or “our”, it means APPMANSION (Pty) Ltd unless we say otherwise.

2. What this policy covers

This is a single, umbrella privacy policy that governs all personal information processed by APPMANSION across our products. This currently includes:

This policy applies to: the Driver53 website at driver53.app (this website); all current APPMANSION mobile apps on iOS and Android; and all future products and services released under the APPMANSION name.

Where a specific product collects information in a materially different way, that product may display supplementary notices at the point of collection. Those notices are read together with this policy, not instead of it.

Some APPMANSION products are designed for use by businesses (for example, companies that use our software to manage their own operations and clients). Where you access an APPMANSION product in a business capacity, you are acting as a responsible party in respect of any personal information you input about your own clients, employees, or other third parties. In those cases, APPMANSION acts as an operator processing that information on your behalf, and a separate Data Processing Agreement governs that relationship. This policy applies to your own account and contact information; it does not govern the personal information of your clients or employees that you choose to process through our platform.

This policy does not cover third-party websites, services, or apps that we may link to. Once you leave our products, their own privacy policies apply.

3. What we collect

3.1 When you visit driver53.app

• Contact form. If you send us a message, we collect your name, email address, and the content of your message.
• Server logs. When you visit the site, we automatically record basic connection details such as your IP address, browser type, and pages viewed. We use these logs to keep the site running and to identify abuse. We do not use them to profile individual visitors.
• Analytics. We use privacy-friendly analytics that count page views in aggregate. We do not use these tools to profile you for marketing or to show you third-party advertising.
• Cookies. We use cookies to run the site, keep it secure, and understand traffic in aggregate. Service providers who help us host and protect the site may set short-lived cookies for security. The contact form may use cookies to reduce spam. We do not use advertising or cross-site tracking cookies. You can change cookie settings in your browser, but some parts of the site may not work as expected.

3.2 When you join the Driver53 waitlist on driver53.app

• Email address. If you join the waitlist, we collect your email address to send you one email when Driver53 launches on iOS and Android. We do not use it for a newsletter.
• Form processing. The form is submitted through Web3Forms, which receives your email address and delivers it to us.
• Spam protection. The form uses hCaptcha to tell people from bots. hCaptcha may process technical information from your device, under its own privacy policy.
• Local storage. After you join, we store a timestamp in your browser's local storage so the form can pause for 24 hours. It stays on your device and holds no personal information.

3.3 When you create an account in a product

Accounts are created inside each app or product, not as one shared APPMANSION login. Data from one product is generally kept separate from another unless we say otherwise in that product or in a supplementary notice.

• Account information. Your name and email address. Passwords are stored securely; we cannot see or recover your password.
• In-app progress and activity. Your progress through lessons or chapters, assessment and test scores, streaks, and any product-specific settings you configure. This data is what makes our apps work. Without it we cannot show you where you stand or personalise your experience.
• Product-specific preferences. Any choices you make within an app that determine which content we serve you (for example, a licence type or study category). The specific data collected will vary by product and will be described in the supplementary notice shown when you first use that product.
• Device and session information. Device model, operating system version, app version, and crash reports. This information helps us fix bugs and ensure the app works correctly across devices.
• In-app usage signals. Aggregate patterns such as which sections you use most and how long sessions last. Used to improve the product. Not sold or shared with third-party advertisers.

3.4 When you purchase access

• Payment information. APPMANSION never processes or stores your payment card details directly. All purchases are completed through the Apple App Store or Google Play Store and are governed by those platforms’ payment systems. We receive only a confirmation that a purchase was made, the product purchased, and the duration of access granted. We do not receive your card number, billing address, or any other financial information.
• Purchase records. We record which access tier was purchased, when it was purchased, and when it expires. This is necessary to unlock premium content and resolve support queries.

3.5 Information we do not collect

We do not collect your race, ethnicity, religious beliefs, health information, biometric data, trade union membership, sexual orientation, or criminal record. Our current apps do not require location access, camera access, or microphone access. Any future product that requires such access will request your explicit permission at the time of installation or first use, and will explain why that access is needed.

4. How we use your information

• To provide the service. Authenticating your product account, syncing your progress across devices where you use the same product account, unlocking access you have purchased in that product, and showing you the content relevant to your settings in that app.
• To communicate with you. Responding to messages sent through the contact form; sending you transactional emails such as purchase confirmations or password resets. We do not send marketing emails without your explicit consent.
• To improve our products. Analysing aggregate usage patterns and crash reports to fix bugs, improve performance, and decide what to build next. This analysis is done on aggregated or anonymised data where possible.
• To keep our services secure. Detecting and preventing fraud, abuse, and unauthorised access. Monitoring for technical errors.
• To comply with legal obligations. Maintaining records as required by applicable law (including POPIA and other law where it applies) and responding to valid legal requests.

We do not use your personal information to serve you third-party advertising. We do not build advertising profiles. We do not sell, rent, or trade your data.

5. Legal basis for processing

Under POPIA section 11, we may only process personal information if at least one lawful ground applies. The grounds we rely on are:

• Contract. Processing your account details and learning progress is necessary to provide the service you signed up for.
• Legitimate interest. Server logs, analytics, and crash reports serve our legitimate interest in running a secure, functional product. For each activity relying on this ground, we maintain a legitimate interests assessment confirming that our interest is not overridden by your right to privacy; these assessments are available on request at the contact details in section 13. You have the right to object to processing based on legitimate interest at any time by contacting us at the details in section 13; we will cease that processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Consent. Where we send any optional communications (such as product update emails), we will ask for your explicit consent through an opt-in step within our apps or website before sending them. You may withdraw consent at any time by using the unsubscribe link in any such communication or by contacting us at the details in section 13. Withdrawal does not affect the lawfulness of processing before withdrawal.
• Legal obligation. Where we are required by law to retain or disclose certain records.
• Grace period continuity. Where we allow a short grace period after your paid access expires (see our Terms of Use), continued processing of your account and access data during that period is based on our legitimate interest in providing service continuity and preventing abrupt disruption to access you have paid for.

6. Who we share data with

We do not sell personal information. We share it only in the following limited circumstances:

• App stores (Apple / Google). Your purchase is processed by the App Store or Google Play. Each platform has its own privacy policy. APPMANSION receives only confirmation that a purchase was made and how long access lasts; we do not receive your payment card details.
• Service providers. We use trusted companies to host our website and apps, deliver content, protect against abuse, and run our systems. They process data on our behalf under contract and may not use it for their own marketing.
• Crash reports and analytics. We use tools that help us fix problems and understand how products are used in aggregate. These providers process data only as we direct.
• In-app purchases. We use a specialist provider to confirm purchases made through the App Store or Google Play and to keep your paid access in sync across your devices. They receive a purchase confirmation and your account identifier. They process this only on our instructions.
• Shared operations. APPMANSION may run more than one product using the same underlying services. We do not link product accounts into one sign-in unless we tell you otherwise in that product. We may use aggregated or de-identified data (de-identified in a manner designed to make re-identification using reasonable means unlikely) across products to improve our services. If we ever introduce cross-product sign-in or data linking, we will explain it before you use it.
• Legal requirements. We may disclose information if required to do so by a court order, subpoena, or other valid legal process, or to protect the rights, property, or safety of APPMANSION, our users, or the public.
• Business transfers. If APPMANSION is acquired, merges with another entity, or sells a product line, personal information may be transferred as part of that transaction. You will be notified via this policy or a direct communication before any such transfer occurs.

7. International transfers

When UK/EU GDPR applies to you. The UK GDPR applies to our processing of your personal data if you are located in the United Kingdom and our processing relates to the offering of products or services to you, or to monitoring your behaviour in the UK. The EU GDPR applies on the same basis for individuals located in the European Economic Area. Where either law applies, APPMANSION acts as your data controller for the purposes of that law, in addition to being the responsible party under POPIA. Nothing in our Terms of Use (including the South African governing law and jurisdiction clause) limits your right to lodge a complaint with, or bring proceedings before, the supervisory authority or courts in your country of residence in relation to the processing of your personal data.

Some of our service providers are located in other countries. When we transfer personal information to another country, we rely on one or more of the following safeguards, consistent with POPIA Chapter 9 and, where applicable, GDPR Chapter V:

• Standard contractual clauses. We enter into data processing agreements that contractually bind the recipient to handle personal information in a manner equivalent to the protections required under POPIA and applicable international law.
• Adequacy. Where a recipient country has been recognised as providing an adequate level of protection by the relevant supervisory authority, we may rely on that determination.
• Binding corporate rules or equivalent mechanisms where a provider operates under an approved cross-border data governance framework.

We do not transfer personal information to recipients who are not bound by enforceable privacy obligations. Our primary systems are hosted by providers who have signed data processing agreements with APPMANSION. A list of our key service providers is available on request by contacting us at the details in section 13.

8. How long we keep data

• Active accounts. We retain your account and learning data for as long as your account is active. When you delete your account, you are signed out and it is scheduled for deletion 60 days later. Until then your data is kept as it is, and if you sign back in you can choose to keep your account, which cancels the deletion. After 60 days, your account and personal information are permanently deleted, except where we are required by law to keep certain records.
• Account termination by APPMANSION. If we suspend or terminate your account for breach of our Terms of Use, we delete your personal information within 30 days of termination. Exceptions apply where we are required by law to retain certain records, or where we need to retain limited data to enforce our terms or defend against a claim arising from your use of our products.
• Purchase records. We retain records of purchases for 5 years in line with applicable tax and commercial record-keeping requirements.
• Contact form messages. Retained for up to 24 months to maintain context for ongoing conversations, then deleted.
• Server logs. Rotated and deleted within 30 days.
• Crash reports. Retained for up to 90 days.

Where retention is based on a legal obligation, data is deleted as soon as that obligation expires.

9. How we protect your data

We apply industry-standard security measures appropriate to the sensitivity and volume of personal information we process, including:

• Secure connections when your data is sent over the internet.
• Protected storage for personal information on our systems.
• Passwords are never stored in a form we can read back.
• Access limited to APPMANSION personnel who need it to operate our products and support you.
• Regular security reviews and updates.

No system is perfectly secure. If you discover a security issue, please report it responsibly to [email protected].

9.1 Data breach notification

In the event of a security incident involving personal information that is likely to result in harm to affected individuals, we will notify the Information Regulator and affected data subjects as required by POPIA section 22 and, where applicable, UK/EU GDPR Articles 33 and 34. We aim to notify the relevant authority within 72 hours of becoming aware of the breach where that timeframe is required by applicable law, and to notify affected individuals without undue delay. Our notification will describe: what happened, what personal information was involved, steps we have taken or are taking to address the incident, and what you can do to protect yourself.

10. Your rights

As a data subject under POPIA, you have the following rights. To exercise any of them, contact us at the details in section 13. We will respond within a reasonable time, and within 30 days where POPIA applies, unless the law that applies to you permits or requires a different timeframe.

• Right to access (section 23). You may request a description of the personal information we hold about you and how it is used.
• Right to correction or deletion (section 24). You may ask us to correct inaccurate information or delete information that we are no longer entitled to process.
• Right to object (section 11(3)). You may object to our processing of your personal information where we rely on legitimate interest as our legal basis.
• Right to withdraw consent. Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
• Right to complain. If you believe we have violated your rights, you may lodge a complaint with the Information Regulator under POPIA (see section 13).
• Right to data portability (UK GDPR and EU GDPR). Where the UK GDPR or EU GDPR applies to you, you may have the right to receive the personal data you provided to us in a structured, commonly used, machine-readable format, and to request that we transmit it to another controller where technically feasible. To exercise this right, contact us at the details in section 13.
• Additional rights (UK GDPR and EU GDPR). Where the UK GDPR or EU GDPR applies to you, you may also have rights to restrict certain processing, to object to processing (including for direct marketing), and to lodge a complaint with a competent supervisory authority. For details, see section 13. We do not make decisions based solely on automated processing that produce legal or similarly significant effects about you. If that changes, we will tell you in advance in this policy or at the point of use.

Exercising these rights is usually free of charge. We may charge a reasonable fee or refuse manifestly unfounded or excessive requests where POPIA, the UK GDPR, or the EU GDPR allows.

Deleting your account: In Driver53, go to Settings and tap Delete account. Your account is scheduled for deletion 60 days later. If you sign back in before then, you can choose to keep your account, which cancels the deletion. After 60 days it is permanently deleted, as described in section 8. If you can't use the app, email [email protected] and tell us which product your account is in; we schedule the deletion the same way. DriverPlus access is a one-time purchase that never renews, so there is nothing to cancel. Any DriverPlus time you have left ends when your account is deleted. Deleting an account in one product does not delete accounts you may have in other APPMANSION products.

11. Children and minors

Our products are intended for users who are at least 13 years old, or older if your local law requires a higher minimum. We do not knowingly allow children under 13 to create accounts.

Under POPIA in South Africa, a child is anyone under 18. If you are under 18, we require consent from your parent or legal guardian before we process your personal information. By creating an account, a user under 18 confirms that their parent or legal guardian has given this consent. We encourage parents and guardians to supervise their children’s use of our products. If we become aware, through any means, that a user under 18 has provided inaccurate age information to bypass this requirement, we will suspend the account pending verification of parental consent.

Where the law in your country sets a higher minimum age for creating an account or for certain processing without parental consent, that higher age or stricter rule applies for users located there.

If we become aware that we have collected personal information from a child under 13 without verifiable parental consent, we will delete it promptly. Parents or guardians who believe a child under 13 has created an account should contact us at [email protected].

12. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the date at the top of this page. For significant changes that affect your rights, we will notify registered users by email or through an in-app notice at least 14 days before the change takes effect, consistent with our Terms of Use.

For material changes, continued use of our products after the effective date constitutes acceptance. Where a material change requires your explicit acknowledgment, we will ask you to confirm acceptance in the app or at sign-in before continued use is permitted. If you do not agree with a change, you may request account deletion before the effective date (see section 10).

13. Contact and complaints

APPMANSION (Pty) Ltd · Johannesburg, Republic of South Africa. For privacy questions and data access requests, email [email protected]. Include enough detail for us to verify and respond.

General enquiries: [email protected]. Security disclosures: [email protected].

In terms of the Promotion of Access to Information Act 2 of 2000 (PAIA), our PAIA manual is available on request by emailing [email protected]. The manual describes the records we hold and how to formally request access to them.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Regulator appointed under POPIA:

Where the UK GDPR or EU GDPR applies to you and you believe our processing of your personal data infringes applicable data protection law, you may lodge a complaint with the supervisory authority for your situation. We encourage you to contact us first at [email protected] so we can try to resolve the issue.