Rent 2 — Privacy Policy
Effective Date: 15 May 2026 Version: 1.0 Document Status: Draft for Legal Review
1. Introduction
This Privacy Policy ("Policy") describes how Smart Station T/A Rent2 ("Rent 2", "we", "us", or "our"), with company registration number to be confirmed, collects, uses, stores, and protects your personal information when you use our rent-to-own vehicle management platform at rent2.co.za and its associated portals.
We are committed to protecting your privacy and complying with the Protection of Personal Information Act, 4 of 2013 ("POPIA") and other applicable South African data protection laws.
Information Officer:
- Name: Angela Grant
- Email: privacy@rent2.co.za
- Telephone: to be confirmed
- Postal address: to be confirmed
2. Definitions
- "Customer" — an individual who applies for or holds a rent-to-own agreement with a Client dealership through our Platform.
- "Client" (or "Tenant") — a vehicle dealership business that subscribes to the Platform to manage their Rent 2 Agreements.
- "Platform" — the Rent 2 software-as-a-service operated by us.
- "Personal Information" has the meaning defined in section 1 of POPIA.
- "Processing" has the meaning defined in section 1 of POPIA.
- "Responsible Party" has the meaning defined in section 1 of POPIA (the party that determines the purpose and means of processing personal information).
- "Operator" has the meaning defined in section 1 of POPIA (the party that processes personal information on behalf of a Responsible Party).
3. Our Role Under POPIA
3.1 When You Are a Customer
When you apply for or hold a rent-to-own agreement, the Client dealership (e.g., "AutoDrive JHB (Pty) Ltd") is the Responsible Party for your personal information. The Client decides what information to collect from you, why they collect it, and how long to keep it.
Rent 2 acts as the Operator — we process your information on behalf of the Client, store it securely, and provide the technical infrastructure. We do not use your information for our own purposes.
For any privacy queries about your application or contract data, please contact your Client dealership directly. They are also obliged to maintain a POPIA Manual under section 51 of the Act.
3.2 When You Are a Client (Dealership)
When you subscribe to the Platform as a Client, Rent 2 is the Responsible Party for the information we collect from you to provide and bill the service (company details, contact persons, payment information, usage data). This Policy describes how we handle that data.
3.3 When You Visit the Marketing Site
When you visit rent2.co.za and submit a contact form or "Book a Demo" request, Rent 2 is the Responsible Party for the personal information you provide.
4. Personal Information We Collect
4.1 As a Customer
The Client collects the following categories of personal information from you during the 6-step application wizard, which we store on their behalf:
| Category | Specific Items |
|---|---|
| Identity | Title, first name, last name, date of birth, gender, South African ID number, nationality, marital status, home language, ethnic group (BBBEE classification) |
| Contact | Mobile number, alternative number, home/landline, email address, mobile type (contract/pre-paid) |
| Residential | Current and previous home address, suburb, city, province, postal code, years and months at address, residency type, monthly rent or bond, landlord or bondholder details, parking type and vehicle overnight location |
| Employment | Employer name, type, industry, job title, employment type, years and months at employer, work address, work phone, work email, HR/supervisor contact, nature of business; previous employer details where applicable |
| Income & Expenses | Basic salary, car allowance, commission, overtime/bonus, additional income, net take-home, spouse income (if joint applicant), monthly expenses across categories (rent, vehicle finance, insurance/medical aid, credit cards/loans, other) |
| Banking | Bank name, account type, account holder name, account holder ID, account number (encrypted at rest), branch code, years with bank, salary pay date, debit order preference |
| Next of Kin | Title, name, relationship, ID number, mobile, email, address |
| Vehicle Selection | Vehicle of interest, chosen purchase option tier |
| Documents | Copy of SA ID, proof of residence, payslips, bank statements, driver's licence, signed consent forms |
| Application Metadata | Submission date, status changes, internal reviewer notes, approval/rejection reason |
| Contract Lifecycle | Contract number, signature timestamps, IP address at signing, payment history, incident records, communications log |
| Vehicle Telemetry (where active) | GPS location, speed, odometer, ignition events, geofence violations (captured by the tracking device fitted to the rented vehicle) |
| Insurance Data | Policy number, claim history, named driver details |
4.2 As a Client
We collect from you:
- Company name, trading name, company registration number, VAT number, NCA registration (where applicable)
- Owner/admin contact: first name, last name, email, mobile, role
- Staff users: name, email, role, permissions
- Banking details for receiving subscription invoices and (where the Client uses our debit-order facility through us) for collection settlement
- Subscription tier, plan history, billing records
- Usage data: number of applications, contracts, vehicles, API calls, storage usage
4.3 From Marketing Site Visitors
We collect:
- Information you submit on "Book a Demo" or "Contact Sales" forms: name, company, email, phone, fleet size, plan interest, message
- Technical analytics: IP address (truncated), browser type, device type, pages viewed, referrer, anonymised session ID (via privacy-respecting analytics; we do not use third-party advertising trackers)
- Cookie preferences (see §8)
5. Sources of Personal Information
We collect personal information from:
- You directly — when you complete forms, submit documents, sign agreements, or interact with the Platform
- The Client dealership — who may pre-populate your application via an invitation link (with your contact details) before you complete it
- Third-party verification services that we use on the Client's behalf:
- a registered credit bureau for credit-bureau enquiries (only with your explicit National Credit Act consent at application time)
- a vehicle-telemetry provider for telematics data (only after the vehicle is allocated to your contract)
- Automatic technical capture — IP address, timestamps, audit log of significant events
6. Purpose of Processing
We (or the Client) process your personal information for the following lawful purposes under POPIA:
6.1 Performance of a Contract
- Assessing your application for a rent-to-own agreement (affordability, credit, identity)
- Generating, signing, and managing your rental agreement
- Collecting monthly rental payments
- Issuing receipts, statements, and invoices
- Tracking the rented vehicle (where the device is fitted)
- Processing insurance claims and incident reports
- Communicating with you about the contract
6.2 Compliance with Legal Obligations
- Verifying identity under FICA (Phase 1) requirements
- Complying with the National Credit Act (affordability assessments, credit reporting)
- Retaining tax and accounting records (SARS — 5 years)
- Responding to lawful information requests from regulators
6.3 Legitimate Interests
- Detecting and preventing fraud
- Protecting Platform security
- Pursuing recovery of overdue amounts
- Improving the Platform (with anonymised aggregate data only)
6.4 With Your Consent
- Sending marketing communications about new vehicles or promotions
- Sending payment reminders and service alerts via WhatsApp Business
You may withdraw consent at any time — see §11 (Your Rights).
7. Disclosure of Personal Information
We do not sell your personal information. We share it only with:
7.1 Service Providers (Operators on our behalf)
We use trusted third-party operators to run the Platform on our behalf — covering cloud hosting and file storage, authentication, transactional email and SMS, WhatsApp messaging, electronic signatures, credit-bureau enquiries, debit-order collections, vehicle telemetry, and background processing such as document virus-scanning. Each operator processes your personal information only on our documented instructions, is bound by a written operator agreement (under POPIA section 21) imposing protections equivalent to or stronger than POPIA requires, and receives only the minimum information needed for its purpose. A current list of our operators is available on request from our Information Officer (see section 1).
7.2 Cross-Border Transfers
Some operators process personal information outside South Africa (in the European Union and/or the United States). Any such transfer occurs only if the recipient is in a jurisdiction with substantially similar data protection laws or is bound by a binding corporate rule or agreement that gives effect to POPIA section 72.
7.3 Legal Disclosure
We may disclose personal information when required by law, court order, or to:
- The South African Revenue Service for tax matters
- The Information Regulator
- Law enforcement under a valid warrant
- Our legal advisors when investigating fraud or breach
7.4 Business Transfers
If the Platform is sold or merged, your personal information may be transferred to the acquiring entity. We will notify you in advance and you retain all rights under this Policy.
8. Cookies and Similar Technologies
We use cookies to operate the Platform. Categories:
| Category | Purpose | Examples |
|---|---|---|
| Strictly necessary | Authentication, session, security | authentication cookie, CSRF token |
| Preferences | Remembering your settings | Theme, language, last-viewed page |
| Analytics (with consent) | Understanding usage to improve the product | Privacy-respecting analytics |
| Marketing | None — we do not use marketing cookies | — |
You can manage cookie preferences at any time via the cookie banner on first visit or by clicking "Cookie Preferences" in the footer.
9. Data Retention
We retain personal information for the periods specified below. After expiry, the information is permanently anonymised or deleted.
| Category | Retention |
|---|---|
| Active customer applications | Duration of contract + 5 years (per NCA s.170(1)) |
| Declined applications | 12 months from decision, then anonymised |
| Completed/purchased contracts | 5 years post-completion (per NCA s.170(1)) |
| Terminated contracts | 5 years post-termination (per NCA s.170(1)) |
| Payment records | 5 years (per SARS Tax Administration Act) |
| Credit bureau enquiry records | 7 years (per NCR requirements) |
| Audit log of admin actions | 5 years (per POPIA s.14 reasonable security) |
| WhatsApp/SMS/Email message log | 12 months |
| Vehicle telemetry data | Duration of contract + 1 year |
| Support communications | 1 year post-resolution |
| Marketing site enquiries | Until conversion or 24 months (whichever is earlier) |
| Documents uploaded during application | Duration of contract + 5 years |
10. Security Measures
We implement the following safeguards under POPIA section 19:
- Encryption in transit: HTTPS/TLS 1.3 for all connections
- Encryption at rest: AES-256 for sensitive fields (ID numbers, bank account numbers); industry-standard encryption for database storage
- Row-Level Security: Database access is filtered per tenant — Clients cannot see each other's customers
- Authentication: Multi-factor authentication required for Platform Admin and Client staff users
- Audit logging: Every significant action (login, data export, payment, decision) is logged with actor identity, IP address, and timestamp
- Virus scanning: All uploaded documents are scanned by ClamAV before being moved to permanent storage
- Backup: Daily encrypted backups with 30-day retention
- Penetration testing: Annual third-party security assessment
- Access control: Role-based access; principle of least privilege; quarterly access review
- Vendor due diligence: All sub-processors are reviewed for POPIA compliance before integration
11. Your Rights Under POPIA
You have the following rights:
11.1 Right of Access
You may request a copy of the personal information we hold about you (POPIA s.23). We will respond within 30 days. The first request per year is free; subsequent requests may incur a reasonable fee.
11.2 Right to Correction
If your personal information is inaccurate or incomplete, you may request correction (POPIA s.24). For customers, you can update most fields directly in the Customer Portal under "Your Profile". For sensitive fields (ID, name), submit a correction request to your Client dealership.
11.3 Right to Deletion / Destruction
You may request deletion of your personal information (POPIA s.24) when:
- It is no longer required for the original purpose
- Consent has been withdrawn and no other lawful basis applies
- You object to processing and no overriding legitimate ground exists
Note: Deletion may be refused or delayed if we have a legal obligation to retain (e.g., NCA s.170, SARS).
11.4 Right to Object
You may object to processing on legitimate-interest or direct-marketing grounds (POPIA s.11(3)).
11.5 Right to Withdraw Consent
For marketing communications and WhatsApp notifications (opt-in items), you may withdraw consent at any time:
- Email: Click "Unsubscribe" at the bottom of any marketing email
- WhatsApp: Reply "STOP" to any WhatsApp message
- SMS: Reply "STOP" to any SMS
- In-app: Manage in Customer Portal > Profile > Communications
11.6 Right to Data Portability
You may request your data in a structured, machine-readable format (POPIA s.24(b)).
11.7 Right to Lodge a Complaint
If you believe we have not complied with POPIA, you may lodge a complaint with:
Information Regulator (South Africa)
- Website: https://inforegulator.org.za
- Email: enquiries@inforegulator.org.za
- Postal: PO Box 31533, Braamfontein, Johannesburg, 2017
12. How to Exercise Your Rights
Submit a Data Subject Request via:
- Email: privacy@rent2.co.za
- In-app: Customer Portal > Profile > "Submit Privacy Request"
- Postal: Information Officer, to be confirmed
We may need to verify your identity before processing the request — we will request a copy of your ID document and may use a brief video confirmation for sensitive requests.
We respond within 30 calendar days of receiving a complete and verified request.
13. Children's Privacy
The Platform is not intended for children under 18. We do not knowingly collect personal information from minors. If you become aware that a minor has provided personal information, please contact our Information Officer for immediate removal.
14. Changes to This Policy
We may update this Policy from time to time. Material changes (those affecting your rights or how we use your data) will be notified to you at least 30 days before they take effect via:
- Email to the email address on file
- In-app banner notification
- A revision-history entry in the footer of this document
Continued use of the Platform after a change indicates acceptance of the revised Policy.
15. Contact Us
Questions, requests, or complaints:
- Information Officer: Angela Grant
- Email: privacy@rent2.co.za
- Telephone: to be confirmed
- Postal address: to be confirmed
- Information Regulator (independent oversight): enquiries@inforegulator.org.za
Revision History
| Version | Date | Author | Changes |
|---|---|---|---|
| 1.0 | 2026-05-15 | Information Officer | Initial publication |
End of Privacy Policy v1.0