Mzansi Lift

Privacy notice

Version 2026-10-v5 · effective 25 October 2026

This notice explains, in plain language, what personal information Mzansi Lift holds about you and your children, why, who can see it, how long we keep it, and what you can do about it. It follows South Africa's Protection of Personal Information Act, 2013 (POPIA).

1. The short version

Mzansi Lift is an app that school-transport businesses (we call them operators) use to run their lifts, and that parents use to see their children's trips and tell the operator about changes.
Your operator decides why your family's details are used: to transport your children. We run the app for them.
We collect only what the lifts need: who your children are, where they are picked up and dropped off, who may collect them, and the day-to-day changes and pick-up ticks.
No photos of children. No tracking cookies, no advertising, no analytics. We never sell your information.
You can download your data, correct it, withdraw consent for a child, and delete your account, all from the app.

2. Who we are

Mzansi Lift (mzansilift.co.za) is the responsible party for the personal information described in this notice that it decides about itself (see section 3).

Email: info@mzansilift.co.za
Information Officer: The Information Officer, Mzansi Lift. Contact them at info@mzansilift.co.za.

3. Who is responsible for what

POPIA gives two roles: the responsible party decides why and how personal information is used; an operator (in other laws, a "processor") processes it on the responsible party's behalf. To avoid confusion with transport operators, this notice calls a POPIA operator a processor.

Information	Responsible party	Mzansi Lift's role
Parents and children at a transport operator: profiles, children's details, updates, ticks, notices	That transport operator	Processor: we hold and process it only to run the app for them, under our terms with them
Operators' billing: invoices, statements, payments, card tokens	Mzansi Lift	Responsible party
Login accounts (email, password), two-step login, security records, push subscriptions	Mzansi Lift	Responsible party

Our terms make this split binding on every operator. If you have a question about how your operator uses your family's details, you can ask them or us; we will help either way.

4. What we collect

About parents

Your email address and password. The password is stored only as a one-way Argon2 hash; nobody can read it, not even us.
Your name, mobile number and home address, as you give them to your operator.

About your children

First name and surname, school and grade.
Their lift schedule: which vehicle, morning and afternoon trips, school days, approximate times and stop order.
Pick-up and drop-off addresses.
Authorised collectors (people allowed to collect your child), stored encrypted.
Your consent record: the version of this notice you agreed to and when (see section 6).
Status history: when the child was added, approved, paused, resumed or removed, by whom and why. The reason is a short free-text note; it should hold no names, and operators are asked not to put names or contact details in it.

About trips

Updates you send (not riding, late pick-up, someone else collecting, different address, a message), with any note, and the operator's reply. The new collector's name and phone number and a different address are stored encrypted.
Picked up and Dropped off ticks the driver taps, with the time.
Notices the operator sends to parents.
Push subscriptions: if you turn on notifications, the address your browser gives us to deliver them to this device.

Security and evidence

The IP address (your internet connection's address) recorded with a consent and with each status change of a child. These records are hash-chained: each one is sealed with a fingerprint of the one before, so any change to them is detected.
Failed login attempts (the email typed, IP address and browser type), used to lock out password guessing for 15 minutes.
Server access logs: for every request, the IP address, the page requested (secret links are logged as ***, and nothing after a "?" is logged), the response code and the time taken. They are kept for 14 days.
Two-step login devices and recovery codes, if you turn on two-step login. The secret key is stored encrypted; recovery codes only as hashes.

About operators (the transport business)

The owner's name, email, mobile and password; the business name, contact number and area; vehicles (name, registration, seats, driver's name).
Billing: invoices, statements, credit notes and payments. Card payments are made on PayFast's pages: we never see or store card numbers, only the token PayFast gives us (stored encrypted) to charge the monthly invoice, and the card's last four digits. PayFast's payment notices, which we store encrypted, include the payer's name, email address and cell number as entered on PayFast's page.

What we do not collect

No photos of children, no live location tracking (GPS), no ID numbers, no medical information.
No tracking cookies, advertising or analytics tools. The app loads no third-party scripts or fonts.

5. Why we use it, and on what basis

What for	Legal basis (POPIA section 11)
Running your children's lifts: the Today list, the driver's list, updates, notices, pick-up and drop-off alerts	Your consent as the child's parent or guardian (section 35 for children), and the transport arrangement between you and your operator
Your login, password resets, two-step login	Providing the service you signed up for
Security: lockouts, rate limits, the hash-chained history	Legitimate interest in keeping the service and your children's details safe
Billing operators fairly: each invoice lists every billed child	Our contract with the operator; tax and accounting laws for keeping billing records
Emails and push notifications about trips, updates and your account	Providing the service. We send no marketing.

We use your information only for these purposes. We make no automated decisions about you, and we never sell or rent personal information.

When you add a child, you confirm that you are the child's parent or legal guardian and agree that your operator may use the child's details to transport them. We record the version of this notice (now 2026-10-v5) and the time. If your operator adds your child for you, the operator confirms that you agreed, and the same record is kept.

You can withdraw consent for a child at any time: on your Home page, choose Remove under the child's name. The child is then taken off the operator's Today board and the driver's list straight away, and no more updates or alerts are sent for them. Withdrawing does not undo what was done before, and a child cannot be brought back under an old consent: to add them again, you add them again and consent again.

If this notice changes in a way that matters, we change its version and tell you by email.

Your operator sees the parents and children who joined them: your profile, your children's details, your updates and the trip history. They never see another operator's data, and other parents never see yours.
The driver (through the vehicle's secret link and PIN) sees only today's list for their one vehicle: the children's names, stop order, addresses and the day's flags (for example "someone else collecting"). Tapping an address opens it in Google Maps. To work without signal, the driver's phone keeps a copy of the day's list (in the browser's offline storage); an older day's copy is never shown and is replaced by the next day's list, and every copy is deleted when the link or PIN is changed or the driver's session ends.
Mzansi Lift staff (the platform administrator) can see records only to support operators, run billing and keep the service working. Actions taken in the admin console are logged.

We use these service providers (sub-processors):

Hosting: the server that runs the app and its database (see section 8).
Email: emails are sent from info@mzansilift.co.za through our mail server, mail.mzansilift.co.za. They then reach you through your own email provider.
Push notifications travel through your browser maker's push service: Google (Chrome, Edge, Android), Apple (Safari, iPhone) or Mozilla (Firefox). The message itself is encrypted so that only your device can read it; the push service sees the delivery address and the time.
PayFast processes operators' card payments. Parents pay nothing through Mzansi Lift.
Google Maps receives a child's address only when the driver taps it to open directions; nothing is sent to Google otherwise.

We share information with anyone else only when the law requires it (for example a court order), and only what is required.

8. Where it is stored

The app, its database and its backups run on a virtual private server (IP address 69.62.123.78) rented from a hosting provider in the European Union.

So your information is stored outside South Africa, in the European Union. POPIA (section 72) allows this kind of transfer where the receiving country has a law that protects personal information substantially as well as POPIA does. The European Union's General Data Protection Regulation (the GDPR) is such a law, and the hosting provider is bound by it. Any other service provider above that is outside South Africa is used only where section 72 allows it in the same way: a law, binding rules or a written agreement that give that protection. The push services (Google, Apple, Mozilla) operate worldwide; they receive only an encrypted message and a delivery address.

9. How long we keep it

Information	How long
A removed or declined child's details	The operator can see them for 90 days. After that they are erased: the child's name, school, addresses and authorised collectors are emptied, and so are the notes, details and replies of the updates sent for that child. The operator then sees only a billing reference (such as "Child #1a2b3c4d"). What stays is what the billing records need: the status history, the dates and the grade (see below). Invoices already issued keep the child's name as it was on the invoice, as billing evidence, and the operator's statements show the reference instead. A child still on an invoice that has not been issued yet is erased once that invoice is issued.
Ticks and updates	18 months. After that each child's ticks and updates are reduced to monthly counts (for example "12 picked up in March"), and the details are deleted.
The operator's activity log (who did what in the app)	18 months
Billing records: invoices, statements, payments (including the payer's name, email and cell number in PayFast's payment notices) and the counts they are based on	At least 5 years, as tax and accounting laws require
The hash-chained status history of each child (times, actions, reasons, IP addresses)	Kept as long as the billing records it supports, because invoices are worked out from it
Server access logs (IP address and page requested)	14 days
Failed login attempts (the email typed, IP address and browser type)	30 days
Your data download	The link and the file expire after 24 hours, then the file is deleted
Backups	Nightly copies, kept for about two months, then overwritten. Something deleted in the app can stay in a backup until that backup is overwritten.

When you delete your account, your children are removed and their names, school, addresses and collectors are emptied; your profile is deleted; your login is anonymised and can no longer be used. Your children's names on the operator's invoices are replaced with a reference, so the invoices still add up but no longer say who the child was. Your update notes, details and the replies to them are emptied. The status history keeps its times, reasons and IP addresses, because it is the evidence behind the invoices and cannot be changed; it should hold no names, and operators are asked not to put names in reasons.

10. How we protect it

All traffic is encrypted in transit (HTTPS/TLS).
Authorised collectors, changed collector and address details in updates, two-step login keys and card tokens are encrypted in the database, with the key kept outside the database.
Strict separation between operators: besides the app's own checks, the database itself (forced row-level security) refuses to show one operator's rows to another.
Passwords are hashed with Argon2; logins lock after repeated failures; two-step login is available to everyone and required for the platform administrator.
Driver links are long random secrets protected by a PIN; a driver's session ends after 16 hours, repeated wrong PINs lock the link, and the operator can change the link or PIN at any time.
Our logs record ids only, never names, addresses or phone numbers.
Regular backups, with access limited to the server's administrator, and a tested restore.

If a security breach puts your information at risk, we (and your operator) will tell you and the Information Regulator as soon as reasonably possible, as POPIA section 22 requires.

11. Cookies

We use only two cookies, both needed for the app to work:

a session cookie that keeps you logged in (for parents up to 90 days on your phone, for operators 30 days);
a CSRF cookie that protects forms against forgery.

No tracking, advertising or analytics cookies. The driver page also keeps unsent ticks, and a copy of the day's list, on the driver's phone (see section 7).

12. Your rights and how to use them

See and download your data: open My data in the app and choose Email me a download link. We email you a link to a ZIP file with everything we hold about you and your children at every operator you belong to: your account and notification devices, profile, children, consent records, status history (with your own IP address on the changes you made), updates, ticks, older monthly counts and notices. Short-lived security records (server access logs and failed login attempts) are not included; ask us if you want them. The link works for 24 hours.
Correct it: change your details on your profile, and your child's details by editing the child. Ask your operator, or us, to correct anything you cannot change yourself.
Withdraw consent for a child: on your Home page, choose Remove under the child's name (see section 6).
Delete your account: open My data and choose Delete my account (see section 9 for what is kept). Operators close their account by emailing info@mzansilift.co.za.
Object to a use of your information, or ask us to stop: email us. We will reply within 30 days.

For anything else, email info@mzansilift.co.za. We may ask you to confirm who you are before acting on a request. Using these rights is free.

13. Complaints

Please tell us first, so we can put it right: info@mzansilift.co.za. You also have the right to complain to the Information Regulator at any time:

The Information Regulator (South Africa), Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
POPIA complaints: POPIAComplaints@inforegulator.org.za
General enquiries: enquiries@inforegulator.org.za
Phone: 010 023 5200 · toll free 0800 017 160
Website: inforegulator.org.za

14. Changes to this notice

When we change this notice we publish the new version here with a new version number and effective date. If a change affects how your children's details are used, we tell you by email before it applies.

15. Contact us

Email info@mzansilift.co.za. Requests about your information, and complaints, go to the same address, for the Information Officer.