Privacy Policy

ParcelOps is a cloud-native freight management platform operated by ParcelOps (PTY) Ltd, a company registered in South Africa (Registration No: 2026/495809/07). Our platform is used by South African courier companies to manage their freight operations.

For privacy-related queries, contact us at: privacy@parcelops.co.za

We collect information necessary to provide our freight management services:

Account information: Name, email address, phone number, and company details provided during registration.

Operational data: Waybill information, delivery addresses, parcel details, and shipment history processed through the platform.

Driver data: For drivers using the ParcelOps Driver app: the driver account's name, email address and phone number, location (while the app is open and, in the installed Android and iPhone apps, while the driver is on a run even when the app is closed or the screen is off, if the driver agrees), photos and signatures captured as proof of delivery, activity logs, crash and performance diagnostics (see section 10), and a device push token so the office can send notifications. See section 10 for details.

Customer data: Shipping addresses, contact details, and invoice history for customers of courier companies using our platform.

Usage data: Log data, browser type, IP address, and platform usage patterns to improve our service.

We use collected information to:

- Provide, operate, and improve the ParcelOps platform
- Process and track freight shipments
- Generate invoices and process payments via PayFast or Paystack
- Send operational notifications (delivery updates, invoices, system alerts)
- Ensure the security and integrity of our platform
- Comply with legal obligations under South African law

ParcelOps is committed to compliance with the Protection of Personal Information Act, 4 of 2013 (POPIA).

As a responsible party, we process personal information lawfully, minimally, and for specific, defined purposes. We implement appropriate technical and organisational measures to protect personal information against loss, damage, or unauthorised access.

Your rights under POPIA include the right to access your personal information, request corrections, and object to processing. To exercise these rights, contact our Information Officer at: privacy@parcelops.co.za

The ParcelOps platform and its databases are hosted in a South African data centre.

Some of the service providers listed in section 6 process information outside South Africa to deliver their feature, for example WhatsApp messages (Meta) and AI answers (Anthropic). Where that happens, we share only what the feature needs, and only with providers bound by data protection terms that give a level of protection comparable to POPIA, as section 72 of POPIA requires.

We implement industry-standard security measures including encrypted data transmission (TLS), encrypted data at rest, role-based access controls, and regular security audits. Access to personal information is restricted to authorised personnel only.

We do not sell personal information to third parties.

We may share information with:

- PayFast and Paystack: Payment processing for online payments, through the courier's own account with whichever of them the courier uses (subject to that provider's own privacy policy)
- Google Firebase (Cloud Messaging, Crashlytics, Performance Monitoring): Delivers push notifications to the ParcelOps Driver app and receives its crash reports and performance measurements
- Mapbox: Displays maps in the ParcelOps Driver app
- Meta (WhatsApp Business Platform): Carries WhatsApp messages to and from ParcelOps and from courier companies that connect their WhatsApp number (see section 12)
- Anthropic: Provides the AI behind Ask ParcelOps, the in-app assistant and AI replies on WhatsApp. The text needed to answer a question is sent to Anthropic to produce the answer; under its commercial terms Anthropic does not use it to train its models
- Cloud hosting provider: Infrastructure is hosted in South Africa
- Law enforcement: Where required by a valid legal obligation under South African law

Courier companies using our platform are responsible parties for the personal information of their own customers and drivers. ParcelOps processes this data as an operator on their behalf.

We retain personal information for as long as necessary to provide our services and meet legal obligations. Operational data (waybills, invoices) is retained for a minimum of five years to comply with South African tax and commercial record-keeping requirements.

You may request deletion of your account data by contacting us at privacy@parcelops.co.za. Note that some information may be retained where required by law. Drivers should also read section 10 for how driver app data is handled and deleted.

Our marketing website (parcelops.co.za) uses minimal cookies for session management and analytics, plus two first-party cookies (po_first, po_last) that record the page you first arrived on, the site that referred you and any campaign tags in the link, so that if you start a trial or contact us we know which channel brought you. They contain no personal information and are not shared with third parties. The ParcelOps application uses cookies strictly necessary for authentication and platform operation.

We do not use third-party advertising cookies.

We may update this privacy policy from time to time. When we do, we will update the date at the top of this page and notify active users by email where the changes are material.

The ParcelOps Driver app is for drivers of courier companies that use ParcelOps. The courier company creates each driver's login and is the responsible party for the driver's personal information. ParcelOps processes that information as an operator on the courier's behalf, in line with POPIA.

What the app collects, and why:

- Location (approximate and precise): collected while the driver is on a run, including when the app is closed or the screen is off (the installed Android and iPhone apps, with the driver's agreement), so dispatch can see where the driver is and help with the day
- Camera: used to scan parcel barcodes and to take proof-of-delivery photos
- Photos and signatures: captured at delivery or collection as proof of delivery
- Account details: the driver's name, email address and phone number
- Device token: lets the office send push notifications to the driver's phone
- Offline queue: scans and delivery outcomes are held on the phone when there is no signal and sent when it is back online
- Crash and performance diagnostics (Android and iPhone): technical information about faults and speed, described below, with no personal details in it

Location while you are on a run. In the installed Android and iPhone apps, the app shares the driver's location with their courier company's office while the driver is on a run, including when the app is hidden, another app is in front or the phone's screen is off. Before this can start, the app asks the driver in a full-screen message, and the driver can say "Not now": the app then uses location only while it is open on screen. The driver can change this at any time with the switch "Share my location when the app is closed" on the "Your phone" page. While location is being shared, an Android phone shows a notification and an iPhone shows its location symbol at the top of the screen. Sharing starts automatically, only while the app is on screen, once the driver has agreed, is signed in and has stops left for the day. It stops when the driver taps "Finish day", signs out, closes the app, switches the setting off, has no stops left, and at midnight South African time at the latest. The app does not ask for the Android "all the time" or the iPhone "Always" location permission: the phone's "while using the app" permission is enough, because sharing is started while the app is on screen. The website version of the driver app shares location only while it is open on screen. Drivers can switch location, camera or notifications off in the phone's settings at any time, although some features then stop working.

No advertising. The app has no ads and no advertising ID. We do not sell or share driver data for advertising.

Crash and performance diagnostics. To find and fix faults, the Android and iPhone apps send crash reports and performance measurements to Google Firebase (Crashlytics and Performance Monitoring), which acts on our behalf. A report contains technical information only: the kind of error, the app version, the type and software version of the phone, how much memory was free, how long the app took to start, and a short trail of which screens were open. It does not contain the driver's name, phone number, email address, any customer's or recipient's details, addresses, waybill numbers, photos or sign-in details. Google also receives the type of network connection (wifi or mobile) and the phone's IP address, which it uses only to work out the country the measurement came from. Each installation has a random identifier that is not linked to the driver's identity. We use this information only to keep the app working and to measure how fast it is. It is not used for advertising.

Service providers. Push notifications are delivered through Google Firebase Cloud Messaging, crash reports and performance measurements are received by Google Firebase (Crashlytics and Performance Monitoring), and map tiles are loaded from Mapbox. They act on our behalf to deliver those features.

Security. Driver app data is encrypted in transit (TLS) and stored in South Africa, as described in section 5.

Retention and deletion. The driver app's location history is kept for 7 days and then deleted automatically; the driver's profile keeps only the last known position, and the position recorded with a proof of delivery stays with that proof. A driver can ask their courier company to remove their profile, or write to privacy@parcelops.co.za. We will then delete or anonymise the driver's account data: the login, profile, device token and any location history we hold. Some records must be kept by law, for example proof of delivery linked to waybills, which is retained for five years (see section 7).

ParcelOps for Shopify and ParcelOps for WooCommerce let a merchant who is a customer of a courier company on ParcelOps connect an online store, so that the store's orders are booked with that courier. The merchant connects the store with their own ParcelOps customer API key. The courier company is the responsible party for the delivery information, and ParcelOps processes it as an operator on the courier's behalf, as described in section 6.

What we process, and why: for each order that needs shipping, the recipient's name, delivery address and phone number, the order number and the weight of the items. We use them only to price and book the delivery with the courier, to show the merchant the courier's prices before they book, and to put the courier's tracking number and link back on the order. The buyer's email address is passed on only if the merchant switches that option on; it is off by default. We do not use this information for marketing or advertising, and we do not sell it.

What we keep: the booking and its waybill are the courier's operational records and are kept as described in section 7. For a Shopify store the app also keeps, for the merchant's order list: the order number, a status line, the booking and waybill references and the tracking links, the name of the shipping method the buyer chose and the amount paid for shipping, the delivery service chosen, the courier's prices for the services offered, and the number and weight of the parcels. None of these identify the buyer: the app does not keep the buyer's name, address, phone number or email. It also keeps the store's access token and the merchant's API key, both encrypted. Labels and waybills the merchant prints from Shopify are made at that moment from the courier's records; the link to print them works for ten minutes and the app keeps no copy. For a WooCommerce store the plugin keeps its settings and the merchant's API key in the store's own database.

Deletion and erasure requests: when a merchant uninstalls the Shopify app, its stored order list is deleted after 30 days, and the store's access token and webhook are removed straight away. When Shopify tells us a store or a customer must be erased, we delete that store's order list or that customer's order rows straight away. Copies of delivery events sent to a store's webhook are deleted after 7 days. Merchants and their customers can also ask us to delete or correct their information by emailing privacy@parcelops.co.za.

ParcelOps uses Meta's WhatsApp Business Platform in two ways.

When you message ParcelOps on WhatsApp. We receive your phone number, your WhatsApp profile name and the messages and files you send. We use them to answer your questions, understand what your business needs and follow up with you about ParcelOps. Replies may be written by an AI assistant. It says that it is an assistant, and it passes the conversation to a person when needed or when you ask. We keep the conversation as a record of your enquiry and of any account that follows from it, and we do not use it for anything else. You can ask us to delete it at any time by emailing privacy@parcelops.co.za.

When a courier company uses WhatsApp through ParcelOps. A courier company on ParcelOps can connect its own WhatsApp Business number, so its customers can ask for quotes, book and track parcels and receive delivery updates on WhatsApp, answered by the courier's staff or by an AI assistant. The courier company is the responsible party for those conversations, and ParcelOps processes them as an operator on its behalf, as described in section 6. Updates are sent only to people who have messaged the courier or agreed to receive them, and anyone can ask the courier to stop them.

Who else handles the messages. WhatsApp messages travel through Meta's WhatsApp Business Platform and are subject to WhatsApp's own terms and privacy policy. When an AI assistant writes a reply, the conversation is sent to Anthropic to produce it (see section 6). We do not sell WhatsApp conversations, and we do not use them for advertising.

For privacy-related queries or to exercise your POPIA rights:

Email: privacy@parcelops.co.za
Post: ParcelOps (PTY) Ltd (Reg No: 2026/495809/07), South Africa

For general enquiries, visit our contact page.