Privacy notice

Velappi is a South African workforce development platform that trains and places delivery drivers with vetted employers. The responsible party under POPIA is Velappi (Pty) Ltd, registration number 2026/524830/07.

Information Officer: Leon Qwabe · hello@velappi.co.za

From driver applicants via the /apply form:

• Full name, email address, phone number, city
• Years of delivery experience, preferred training location
• Free-text notes you choose to add
• South African ID number (13 digits) — used only to verify eligibility to work in South Africa and to complete training records
• Timestamp, IP address and browser user-agent at consent

From employers via the /hire form: company name, contact name, work email, phone, city, number of drivers needed and free-text notes.

• Consent — you tick the POPIA consent box on the form.
• Performance of a contract — to run training and placement between drivers and employers.
• Legal obligation — verifying right to work in South Africa.

• Your ID number is encrypted with AES-256-GCM before it is written to the database. The encryption key is stored as a Cloud secret, not in the database.
• We store a keyed HMAC-SHA-256 hash of your ID number solely to detect duplicate applications; the hash cannot be reversed into the number.
• Only vetted Velappi staff (admin or trainer role) can request a decrypted view, one record at a time, and must provide a reason. Every reveal is logged with the staff member's identity, the reason and the timestamp.
• Any 13-digit sequences typed into free-text note fields are automatically redacted to [redacted-id] at the database layer.
• Data is transmitted over TLS. The managed Postgres database is encrypted at rest by our infrastructure provider.
• Access to the admin dashboard requires email + password, with breached-password checking (HIBP) enabled at sign-up and password change.

These are the technical controls we operate today. We do not claim to hold SOC 2, ISO 27001 or PCI certifications.

We share driver profiles (name, contact, city, licence, training status) with prospective employers only when we're actively placing you. We do not sell personal information.

Sub-processors we use: our managed Postgres/hosting provider (Lovable Cloud, backed by Supabase / Cloudflare), and transactional email delivery. All data is stored in the region configured for the project.

• Applications that never progress past "pending training" are purged 12 months after the last activity on the record.
• Trained and placed drivers: kept for the duration of the employment relationship plus 3 years, to meet labour and tax record-keeping norms.
• Employer requests: 24 months from receipt.
• Audit logs (ID number access, consent records): kept for 5 years for accountability, then purged.

You have the right to:

• Access the personal information we hold about you
• Correct or update it if it is wrong
• Ask us to delete it ("right to be forgotten")
• Withdraw your consent at any time
• Object to processing you consider unlawful
• Lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za

To exercise any of these rights, email hello@velappi.co.za. We aim to respond within 30 days.

Velappi Information Officer: Leon Qwabe · hello@velappi.co.za