Preamble
We, as BMW South Africa, take the protection of personal data very seriously. We, hereby, would like to explain how we protect your data and what it means for you when you use our personalized services. As a matter of course, we comply with all the legal requirements regarding data protection to ensure maximum protection of your privacy. We comply with the provisions of both the Protection of Personal Information Act, No. 4 of 2013 (“POPIA”), as well as the General Data Protection Regulation 2016/679 (“GDPR”).
This data protection statement applies to Driva’s website, which can be accessed under the domain https://www.driva-sa.co.za / and the various sub-domains (hereinafter referred to as “our website”).
1. Name and address of the person responsible
The responsible party and service provider is Pace Car Rental South Africa (Pty) Ltd, 40 14th Street, Eastgate Commercial Park, Malboro North, Sandton (hereinafter referred to as “Driva”).
2. Name and address of the Data Privacy Protection Officer
Our Data Privacy Protection Officer is, Ms Joy Alexander, 1 Bavaria Avenue, Randjespark, Ext. 17, Midrand, 1684. You can contact our Data Privacy Protection Officer at any time in relation to any matter relating to data protection. The best way to contact us is to send an e-mail to: drivasupport@pacecarrental.co.za
3. General information on data processing
We only collect and use personal data from our users which is necessary to provide a functional service for our website and for the content of our services.
3.1 Personal data
Personal data is information that can be associated with you as an individual. Examples include your name, physical address, telephone number and e-mail address. Non-personal data is information such as the number of users of a website or service.
3.2 Processing of personal data
Processing means any operation or series of operations carried out with or without the aid of automated procedures in relation to personal data, such as the collection, collation, organisation, sorting, storage, adaptation or alteration, reading, retrieval, use, disclosure by transmission, dissemination or any other form of provision, comparison or linking, restriction, erasure or destruction.
Personal data is collected either via the mobile app or via e-mail communication in which you provide it to us on your own initiative and consent, e.g. by registering, filling out forms, sending e-mails or by booking a Driva vehicle. We use this data for the purposes indicated in each case or resulting from the enquiry, thus for example the reservation enquiry for handling your reservation requests. Transmission to third parties will only take place if this is expressly permitted by law or if you have agreed to the transmission within the framework of your registration or during an active business relationship. Apart from this, you can principally use the general information on www.driva.co.za without disclosing your personal data.
3.3 Legal basis for the processing of personal data
The collection and use of the personal data of our Users takes place regularly only with the User’s consent. Insofar as we obtain the consent of the data subject for the processing of personal data.
An exception applies in those cases in which prior consent cannot be obtained for actual reasons and the processing of the data is permitted by legal regulations. For the processing of personal data necessary for the performance of a contract to which the data subject is a party. This also applies to processing operations that are necessary for carrying out pre-contractual measures.
Insofar as the processing of personal data is necessary to fulfil a legal obligation to which we are subject.
If processing is necessary to safeguard a legitimate interest of our company or a third party and if the interests, fundamental rights and freedoms of the data subject do not outweigh this first interest.
3.4 Data erasure and storage time
Your master data is kept for the duration of the contract. After you have initiated the termination of the business relationship, the data will be kept for a maximum of 5 (five) years from your last transaction. If we initiate the termination of the business relationship for security reasons, we will keep your data for a maximum of 5 (five) years after your last transaction.
3.5 Security (TLS technology)
We have taken technical and organisational measures to protect your personal data, in particular against accidental or intentional manipulation, loss, destruction or access by unauthorised persons. These security measures are continually updated in line with technological developments. The transmission of personal data between your computer or mobile device and our server is always encrypted (Transport Layer Security (“TLS”) procedure).
4. Registration
In the following we describe the processing of data within the registration process.
4.1 Registration process
Our website offers Users the option to register by entering personal data. As part of this process, the data is entered into an input screen, transmitted to us, and saved.
As a next step, identification data, driver licence information, as well as payment information is collected and vetted via a manual verification process.
We do not share data with third parties. The following personal data is collected as part of this registration process:
– Name, address, date of birth, e-mail address, mobile phone number, payment data as well as a PIN selected by you, answer to security question, and a password
In addition, the following personal data is collected:
– IP address
– Date and time of registration
Your data, will be stored for the entire period of the contract performance and not longer than 5 (five) years depending on the manner in which the business relationship was terminated as set forth in Item 3.4. After the expiration of these periods, all data relating to your person will be permanently deleted, unless there are legally mandated retention periods. During the retention period, data relating to your person that is required to meet commercial and fiscal obligations will be completely blocked and will no longer be accessible for further data processing activities.
4.2 Legal basis
The legal basis for the processing of this data is necessary for the fulfilment of a contract or for the implementation of pre-contractual measures.
5. Driver licence verification
The section below describes the data processing associated with the Administrative Adjudication of Road Traffic Offences Act, No. 46 of 1998 (“AARTO”), verification process and within their online tool.
5.1 AARTO
We perform the necessary verification of your driver licence on the website (http://www.aarto.gov.za/index.php/legislation), using a procedure for online identification by the Road Traffic Management Corporation of South Africa. We will transmit the following data to AARTO:
– Name, ID number and driver licence number
5.2 Legal basis
The legal basis for the processing of this data is required for contract performance or to carry out pre-contractual activities.
6. Google Maps
In the following we describe data processing in the context of the use of Google Maps.
6.1 Google Maps application
This website, as well as the Driva App, use Google Maps API applications. This enables us to display interactive maps directly on the website or on our App and enables you to conveniently use the map function. This application is essential for the functionality and complete provision of our content and services. You can view Google’s Terms of Use here: https://policies.google.com/terms?hl=en. The additional terms of use for Google Maps/Google Earth can be found here https://www.google.com/intl/en-US_US/help/terms_maps.html. You can find Google’s Privacy Policy here: https://policies.google.com/privacy?hl=en. We use Google Maps to determine the current location of our vehicles and to show you the nearest available vehicle. In addition, we use Google Maps to translate geo-positions into addresses and to show you the estimated walking distance to the selected vehicle. After your approval, we will use Google Maps to show your planned arrival location and the remaining arrival time for handover to a subsequent customer on our app. We do not share this information with Google. This data will only be transmitted to Google anonymously. It cannot, therefore, be traced back to you.
6.2 Legal basis
The legal basis for the processing of this data is necessary for the fulfilment of a contract or for the implementation of pre-contractual measures.
7. Cookies
In the following, we describe processing procedures within the framework of using cookies in detail.
7.1 Use of Cookies
Cookies are small text files that are stored on your hard drive by a web server. Cookies contain information that can later be read by a web server in the domain that issued the cookie to you. Cookies cannot run programs or deliver viruses to your computer. There is a distinction made between two different types of cookies. Session cookies are deleted as soon as you end the session. Temporary and permanent cookies are stored on the data carrier for a longer period or indefinitely.
7.2 Data in the context of the use of cookies
No personal data is stored in the cookies we use. The cookies we use are also not combined with personal data. In this respect, these cookies cannot be attributed to any particular person. When a cookie is activated, it only receives an identification number. Personal data such as name, IP address, etc. are not assigned to this identification number at any time. Using cookie technology, we only receive anonymous information, such as which pages of our website have been visited, etc.
7.3 Use of session cookies
Most of the cookies we use are so-called session cookies, which are necessary to keep your visit consistent, i.e. to ensure that, for example, no renewed login is required and that your preferences or other information already entered during the reservation request are retained during the session. In addition, we need session cookies to ensure that a specific offer that you have clicked on will be assigned to your request (e.g. for promotional offers). These session cookies are automatically deleted when the session ends. In addition, we use cookies when you visit the website subsequently to detect if you are particularly interested in certain offers, which allows us to display such targeted offers on the site. This assignment is only made using abstract criteria (e.g. “BMW”) and not on a personal basis.
7.4 Onsite targeting
Our website uses cookie technology to collect data to simplify our website. This tells us how the website is used and enables us to constantly optimise our offering. The following data is processed:
– Search terms used
– Frequency of page views
– Use of website functions
This data is used exclusively for anonymous evaluation of the use of the website and is never merged with the personal data stored by us. Using the information obtained through clickstream analysis, we make our website as attractive as possible in order to best meet our customers’ needs.
9. Product and advertising e-mails
The section below explains our data processing for the purpose of product information and advertising.
9.1 Product recommendation e-mails
We want to provide our customers with regular product recommendation e-mails. For this purpose, we use the e-mail address you specified as part of registration, your name and your date of birth. Our product recommendation e-mails are intended to inform you about products we offer, in which you may be interested on the basis of your most recent rental. In addition, we want to send you our confirmation notification regarding your registration and helpful product use instructions. You will receive these e-mails regardless of your subscription to our newsletter. Furthermore, we will use your data for the following purposes: Measures for the further development of services and products, reporting on the success of the utilised measures in the course of time, testing and optimisation of procedures for requirement analysis, benchmarking, and enrichment of our data, e.g. from publicly available sources or internal market research. We do not share data with third parties. Your data will be stored as long as we maintain a business relationship with you and you have not objected to this data processing. You have the right to object to this data processing at any time, either as a whole or for specific measures. In this case, we will no longer process your data. You may send your objection via e-mail to drivasupport@pacecarrental.co.za or via regular mail by writing to Pace Car Rental South Africa (Pty) Ltd, 40 40th Street, Eastgate Commercial Park, Malboro North, Sandton. There is also an unsubscribe link in all notifications, which will be considered an objection if activated.
9.2 Legal basis
The legal basis for the processing of data after registration for the newsletter by the user is with the User’s consent.
9.3 Personalised advertising and/or offer e-mails
We want to regularly send interest-based customised advertisements and/special offers for Driva to our customers via e-mail. Special offers also include our Driva packages with special co-operation partners, which you can view at :https://www.driva-sa.co.za .
9.4 Legal basis
The abovementioned data processing and the associated purposes are part of our legitimate interest.
9.5 Newsletter
We would like to regularly provide interested parties and our customers with advertisements about our products and services about the following products and product categories of our contract partners via e-mail, text message and push notifications. For this purpose, we will use the e-mail address you specified as part of registration, your mobile phone number and your name. Your data will be exclusively used for distributing our newsletter. We do not share data with third parties. Your data will be stored until you withdraw your consent. You have the right to withdraw your consent to this data processing, at any time, without citing any reasons. In this case, we will no longer process your personal data. You may send your notice to withdraw consent via e-mail to drivasupport@pacecarrental.co.za or via regular mail by writing to Pace Car Rental South Africa (Pty) Ltd, 40 40th Street, Eastgate Commercial Park, Malboro North, Sandton. There is also an unsubscribe link in all e-mails, which will be considered withdrawal of consent if confirmed.
9.6 Legal basis
The legal basis for processing data after a User’s subscription to the newsletter is the presence of the User’s consent.
10. Market and survey research
In the following we, describe data processing procedures in the context of market and survey research.
10.1 Statistical purposes
We process your personal data for market research and polling purposes. Your data will be made anonymous, only used by us for statistical purposes and cannot be traced back to you at any time. You can object to this data processing at any time and without giving reasons with effect for the future. For this purpose, you can use the functions described under section 2 in the Privacy Policy.
11. Your rights as an affected person
11.1 Right to information
You have the right to ask us at any time about the data stored concerning you, as well as its origin, recipients or categories of recipients to whom this data is transmitted and the purpose of storage.
11.2 Right of revocation
If you have given your consent to the use of data, you can revoke this at any time without giving reasons with effect for the future.
11.3 Right of correction
If your data stored with us is incorrect, you can correct it at any time in your customer account or have it corrected by us through our service centre.
11.4 Right of deletion and blocking
You have the right to block and delete your personal data stored by us. As a rule, your personal data will be deleted within a maximum of 2 working days after assertion of this right. Should the deletion contradict legal, contractual, fiscal or commercial-law storage obligations or other reasons based in law, your data can only be blocked, not deleted. Once your data has been deleted, it is no longer possible to provide information.
11.5 Right to data transmission
Should you request the personal data provided to us, we will release or transmit the data to you or another person responsible, if you so desire, in a structured, current and machine-readable format. The latter, however, shall only be the case if this is technically possible.
11.6 Right of objection
You have the right to object at any time and without giving reasons for data processing for the purpose of direct marketing. In addition, it is pointed out that the execution of the framework contract as well as the handling of individual contracts may be restricted or no longer possible due to opposition to all data processing operations.
11.7 Extended rights in relation to data processing for personalised data evaluation
With regard to the data processing of personalised data evaluation, in addition to the aforementioned rights, you also have the right of participation granted to a natural person in the decision-making process, a right of appeal and a right to disclosure of our position.
11.8 Contact for assertion of the rights of the persons affected
For asserting your rights you are entitled to the means mentioned in section 2 of the Privacy Policy.
11.9 Right of appeal to the supervisory authority
You have the right to file a complaint with the competent supervisory authority, being the Regulator, against the processing of your personal data if you feel that your rights under the POPIA have been violated.
12. Data protection notice in the General Terms and Conditions
Please see the data protection information included in Item 165 of our General Terms and Conditions, which you can access at https://www.driva.co.za. This section discusses how we process your personal data, which we need to implement individual rental contracts. In addition, we explain which personal data we must process, if applicable, in case of claims for recourse. Due to our legal liability as vehicle owners and to determine non-contractual and/or non-compliant use, we may also process your personal data. When you drive one of our vehicles, we use the so-called geo-fencing system, which involves the identification of your GPS location to provide you with valuable information. This does not involve creating a route profile. We process your personal data to send you additional push notifications for targeted communication. Finally, the section contains information about processing your personal data for identity verification and credit checks.
13. Changes to the Privacy Policy
This Privacy Policy may be subject to change over time. We encourage you to regularly review the Privacy Policy for any changes. However, we will provide you with a corresponding notification in case of significant changes. This may involve e-mail notification if necessary. This Privacy Policy was last updated in January 2020
You can download our Privay Policy here: