PAIA Manual. TruckWys (Pty) Ltd.

1. Introduction

This manual is published by TruckWys (Pty) Ltd, registration number 2025/773091/07 ("TruckWys"), a private body as defined in the Promotion of Access to Information Act ("PAIA"). It explains how to request access to records held by TruckWys, and describes how TruckWys processes personal information in terms of the Protection of Personal Information Act ("POPIA").

2. Contact details

• Information Officer: Grant McEvoy
• Registered address: 12 Keurboom Road, Claremont, Cape Town, 7800, Western Cape
• Postal address: 12 Keurboom Road, Claremont, Cape Town, 7800, Western Cape
• Email: grant@truckwys.com
• Telephone: 084 704 1120

3. The Regulator's guide

The Information Regulator has published a guide on how to use PAIA and POPIA, available at www.inforegulator.org.za, which describes the assistance available from the Regulator and from Information Officers of public and private bodies.

4. Categories of records held by TruckWys

4.1 Records available without a formal request

• This PAIA Manual
• The TruckWys Privacy Policy
• The TruckWys Terms of Service / SaaS Agreement

4.2 Records available on request

• Customer account and billing records
• Invoice, quote and trip profitability records processed on behalf of customers
• Correspondence with the Information Officer
• Internal company, financial and compliance records, subject to the applicable grounds for refusal under PAIA

5. Personal information processed by TruckWys

Disclosures in terms of section 51 of PAIA, read with POPIA.

5.1 Purpose of processing

TruckWys processes personal information to provide its fleet quoting, invoicing and trip profitability platform, to process subscription and invoice fee billing, to work out pooled market rates and train its win probability model from quote outcomes without customer or company names, and, where a customer connects them, to sync with accounting and vehicle tracking systems.

5.2 Categories of data subjects

• Customer (fleet operator) company contacts and platform users
• Drivers and vehicle records uploaded by customers
• Customers' own shippers and debtors, to the extent reflected on invoices

5.3 Categories of personal information

• Contact and identifying information
• Vehicle, trip and route data, and driver licence and emergency contact details
• Vehicle location, heading, speed and ignition status, where a customer connects a tracking system
• Proof of delivery documents and signatures
• Invoice and payment data, including tokenised card information
• Where the mobile app is used: photographs uploaded as proof of delivery, voice recordings made for voice quoting, and a push notification token. These are described in section 3.5 of our Privacy Policy

5.4 Recipients

• Paystack: payment processing and card tokenisation
• Xero and QuickBooks: accounting sync, once available and where connected
• Cartrack and CtrlFleet: vehicle tracking, where connected
• TomTom: address search, route, distance and travel-time data, and map imagery
• OpenStreetMap services (Nominatim, OSRM and OpenStreetMap tiles): address search, routing and maps when TomTom is unavailable
• MapTiler, using OpenStreetMap data: map imagery on route previews
• OpenAI: Copilot, price suggestion explanations and voice transcription
• Anthropic: written summaries and quote parsing, where switched on
• Google Firebase Cloud Messaging, Apple Push Notification service and web browser push services: delivery of notifications
• Resend: transactional email
• Amazon Web Services: hosting and infrastructure, in the Cape Town region
• Vercel: web dashboard pages, the TruckWys website and its analytics
• FormSubmit: messages sent through the website's Talk to us form

5.5 Cross-border transfers

Our primary infrastructure is hosted in South Africa, in Amazon Web Services' Cape Town region (af-south-1), so platform data is stored locally by default. These recipients listed in 5.4 process information outside South Africa: OpenAI, Anthropic, the push notification services, Resend, TomTom, MapTiler, the OpenStreetMap services, Xero, Vercel and FormSubmit, and Paystack may do so. We transfer personal information to them under section 72 of POPIA: where the recipient is bound by law, binding corporate rules or an agreement that provides an adequate level of protection, or where the transfer is necessary to perform our agreement with the data subject or the data subject has consented to it.

5.6 Security safeguards

• Encryption in transit over TLS between our applications and our servers
• Encryption of stored credentials and integration tokens, such as accounting-platform sign-in tokens
• Tokenisation of payment card data via Paystack; no full card numbers are stored
• Email verification by one-time code at sign-up, and an optional one-time code at sign-in
• Access controls on a need-to-know basis

6. How to request access to a record

Requests must be made using the prescribed PAIA request form, available from the Information Officer or from the Information Regulator's website, and submitted to the contact details in section 2. TruckWys will respond within the statutory timeframes prescribed by PAIA.

If you only want a copy of your own personal information, or want it corrected or deleted, you do not need the PAIA form: see section 12 of our Privacy Policy. Deactivating your own account does not erase your personal information; to have it erased, email the Information Officer, as explained on our account deletion page.

7. Fees

A request for a requester's own personal information is provided free of charge. For other records the prescribed PAIA fees apply: a standard request fee, and a fee per page of photocopying, calculated in accordance with the fee schedule prescribed under the PAIA regulations.

8. Availability of this manual

This manual is available on the TruckWys website and, on request, in hard copy from the registered address in section 2.