Privacy Policy & POPIA Notice

01. Legislative Framework & Definitions

This Privacy Policy and Compliance Manual constitutes the statutory disclosure of AIR-O-AIRPORT PARKING (PTY) LTD ("Airoparking", "the Responsible Party", "we", "us", or "our") pursuant to the provisions of:

• Section 14 of the Constitution of the Republic of South Africa, 1996 (the fundamental constitutional right to privacy);
• The Protection of Personal Information Act No. 4 of 2013 ("POPIA");
• The Promotion of Access to Information Act No. 2 of 2000 ("PAIA");
• The Electronic Communications and Transactions Act No. 25 of 2002 ("ECTA");
• The Cybercrimes Act No. 19 of 2020; and
• The National Credit Act No. 34 of 2005 ("NCA") (governing credit reporting for corporate facilities).

02. Lawful Grounds & Justification for Processing

In terms of Section 11(1) of POPIA, we strictly process personal information only where one or more of the following lawful grounds apply:

• Performance of a Contract (Section 11(1)(b)): Processing is necessary for concluding or executing the vehicle bailment, valet parking custody, corporate fleet dispatch, or long-term vehicle storage agreement.
• Statutory & Legal Obligation (Section 11(1)(c)): Processing is mandatory to comply with obligations imposed by South African law, including the Tax Administration Act No. 28 of 2011 (issuing commercial invoices and maintaining accounting records for five years), the Companies Act 71 of 2008, and the Financial Intelligence Centre Act 38 of 2001 ("FICA").
• Legitimate Interests of the Data Subject (Section 11(1)(d)): Processing protects the traveler’s interests, such as real-time flight telemetry monitoring to ensure vehicle staging punctuality and prevent airport stranding.
• Legitimate Interests of the Responsible Party (Section 11(1)(f)): Processing is necessary to protect physical compound perimeter security, prevent vehicle theft, investigate transit insurance claims, and manage corporate credit risk.
• Voluntary Consent (Section 11(1)(a)): Where explicit consent is required, such as opt-in promotional communications, client surveys, or credit bureau vetting.

03. Categories of Personal Information Collected

In compliance with the Principle of Minimality (Section 10 of POPIA), we collect only the personal information strictly required to deliver safe, professional airport valet parking and vehicle custody:

04. Compliance with the 8 Conditions for Lawful Processing

Our governance framework embeds the eight statutory conditions of Chapter 3 of POPIA:

05. CCTV, Telemetry & Digital Custody Pre-Check

Due to the nature of motor vehicle bailment and custody:

• Compound CCTV Surveillance: Our 12,000 m² off-airport compound in Bredell is under 24/7 high-definition CCTV video surveillance with infrared night recording. Footage is recorded solely for premises security, theft deterrence, and vehicle damage adjudication. Footage is overwritten on an automated 30-to-90 day loop unless flagged for formal police or insurance investigation.
• Digital Pre-Check Inspection: At Parkade 2 South Level 3 Block H, our staff photograph vehicle body panels, record odometer readings, and document pre-existing defects. This imagery is uploaded to encrypted cloud storage to establish indisputable vehicle custody baselines protecting both customer and operator.
• Driver PrDP Tracking: Vehicles in transit between the airport and the compound are driven exclusively by vetted drivers holding valid South African Professional Driving Permits (PrDP), tracked via real-time telemetry.

06. Corporate Termed Facilities & Credit Bureau Consent

For corporate fleet and corporate account applicants applying for deferred settlement terms (30/60/90 days):

07. Operators & Cross-Border Data Transfers (Section 72)

We do not sell, rent, or trade client databases under any circumstances. We disclose personal information to authorized third-party Operators solely to fulfill our contractual services:

• Cloud Infrastructure (Google Firebase / GCP): Web application, Firestore databases, and secure image storage are hosted on Google Cloud Platform infrastructure. In terms of Section 72(1)(a) of POPIA, transfers to these cloud regions are governed by binding data processing agreements providing equivalent or superior data protection standards.
• Payment Gateways (PayFast by Network): Online payments are processed through PayFast (PASA and PCI-DSS Level 1 certified). Payment processing is subject to PayFast's regulated privacy covenants.
• Accounting Software (Intuit QuickBooks Online): Invoicing and debtor statement generation synced through encrypted enterprise accounting APIs.
• Aviation Telemetry APIs: Flight numbers transmitted anonymously to flight radar services to obtain aircraft arrival time estimates.

08. Security Safeguards & Breach Protocol (Section 19–22)

We implement comprehensive technical and organizational safeguards:

Section 22 Breach Notification Protocol: In the event of a confirmed or reasonably suspected security compromise involving personal data, we will notify the South African Information Regulator and affected data subjects as soon as reasonably possible, specifying the nature of the breach, suspected consequences, and remediation measures taken.

09. Retention & Destruction of Records (Section 14)

Personal information is retained only for as long as necessary to achieve the purpose for which it was collected:

• Financial & Booking Records: Retained for a mandatory statutory period of five (5) years in compliance with the Tax Administration Act No. 28 of 2011 and Companies Act 71 of 2008.
• Vehicle Condition Pre-Check Photos: Retained for one hundred and eighty (180) days post vehicle return to cover latent damage claims, after which they are automatically archived or purged.
• CCTV Footage: Continuously overwritten on a 30-to-90 day loop, unless required for ongoing criminal prosecution or insurance settlement.
• Destruction Protocol: Digital records scheduled for deletion are purged using cryptographic de-identification and deletion routines; physical records are incinerated or shredded.

10. Data Subject Rights & Information Officer

Under Sections 23, 24, and 25 of POPIA and the provisions of PAIA, you have the following enforceable statutory rights:

• Right of Access: Request confirmation whether we hold your personal information and obtain a formal record thereof.
• Right to Rectification: Request correction or updating of inaccurate, irrelevant, outdated, or incomplete records.
• Right to Erasure / Deletion: Request destruction or deletion of personal information where we are no longer authorized to retain it.
• Right to Object: Object on reasonable grounds to the processing of your personal information (Form 1 of the POPIA Regulations).
• Right to Withdraw Consent: Withdraw consent for non-essential processing at any time without retroactive effect.

11. Direct Marketing & Cookie Policy (Section 69 POPIA)

Electronic Direct Marketing: We strictly adhere to Section 69 of POPIA. We only send marketing communications (discounts, loyalty vouchers) where you have given explicit opt-in consent or where you are an existing customer who booked services with us previously. Every marketing communication contains a clear, functional opt-out/unsubscribe facility.

Cookies & Local Storage: Our website uses minimal, strictly essential first-party cookies:

• Theme Preference Cookie: Persists your dark-mode visual interface preferences.
• Session Navigation State: Anchors page scrolling to the main menu when navigating between tabs.
• Google reCAPTCHA v3: Evaluates risk scores to prevent automated bot submissions and spam attacks on our contact forms.

12. Lodging a Complaint with the Information Regulator

While we encourage data subjects to resolve any concerns directly with our Information Officer, you have the statutory right under Section 74 of POPIA to lodge a formal complaint with the South African Information Regulator: