POPIA Notice

This notice is issued by MotorX (Pty) Ltd ("MotorX", "we", "us") in compliance with the Protection of Personal Information Act 4 of 2013 (POPIA) and informs you of how we collect, use, store, and protect your personal information as the Responsible Party.

1. Who We Are (Responsible Party)

MotorX (Pty) Ltd is the Responsible Party as defined in POPIA. All personal information collected through our platform and website is processed by MotorX. Contact our Information Officer at popia@motorx.co.za.

2. What Personal Information We Collect

We may collect and process the following categories of personal information:

• Identity information: full name, South African ID number, designation, company registration details.
• Contact information: email address, mobile number, physical and postal address.
• Business information: dealership name, trading details, VAT number, branches, stock information.
• Financial information: billing contact details, invoice history (no banking details are stored).
• Platform usage data: login activity, feature usage logs (for security and support purposes).
• Lead and customer data that dealers enter into the platform on behalf of their customers.

3. Purpose of Processing

We process personal information for the following purposes:

• To provide, maintain, and improve the MotorX platform and services.
• To create and administer dealer accounts and subscriptions.
• To issue invoices and process subscription payments.
• To communicate platform updates, maintenance windows, or service notices.
• To respond to enquiries submitted via our contact or demo booking forms.
• To execute and store the digital dealer agreement submitted via the signup form.
• To comply with our legal obligations under South African law.

4. Legal Basis for Processing

We process personal information on the basis of: (a) contractual necessity — processing is required to perform our subscription agreement with you; (b) consent — where you have freely given specific consent (e.g. marketing communications); (c) legitimate interests — where processing is necessary for our legitimate business interests; and (d) legal compliance — where required by applicable law.

5. Sharing of Personal Information

We do not sell personal information. We may share personal information with: (a) service providers who assist us in delivering the platform (e.g. cloud hosting, email delivery), each bound by confidentiality and POPIA-compliant agreements; (b) third-party integrations you authorise (e.g. WhatsApp Business API, AutoTrader); (c) legal or regulatory bodies where required by law.

6. Transborder Information Flows

Some of our underlying infrastructure providers (e.g. cloud services) may process data in jurisdictions outside South Africa. Where this occurs, we ensure adequate legal safeguards are in place consistent with section 72 of POPIA, including standard contractual clauses or adequacy determinations.

7. Security Safeguards

MotorX implements appropriate technical and organisational measures to protect personal information against unauthorised access, disclosure, alteration, or destruction. These include: encrypted data transmission (HTTPS/TLS), access controls, secure password hashing, session management, and regular security assessments. In the event of a data breach that poses a risk of harm, affected parties and the Information Regulator will be notified as required by section 22 of POPIA.

8. Retention of Personal Information

We retain personal information only for as long as necessary for the purposes set out in this notice, or as required by law. Upon termination of a dealer account, data is retained in read-only format for 90 days and then securely deleted, unless retention for a longer period is required for legal or regulatory purposes.

9. Your Rights as a Data Subject

Under POPIA, you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete personal information.
• Delete personal information we are no longer lawfully entitled to process.
• Object to the processing of your personal information.
• Withdraw consent at any time (where processing is based on consent).
• Lodge a complaint with the Information Regulator of South Africa.

To exercise any of these rights, contact our Information Officer at popia@motorx.co.za. We will respond within 30 days.

10. Information Regulator

If you are not satisfied with our response to a complaint, you may lodge a complaint with the Information Regulator of South Africa:
Website: www.justice.gov.za/inforeg
Email: inforeg@justice.gov.za

11. Changes to this Notice

We may update this POPIA Notice from time to time. Material changes will be communicated via the email address associated with your account or via the Platform. The "Last updated" date at the top of this page reflects the most recent revision.