1. Who is responsible for personal information
NALO MOBILITY FINTECH (Pty) Ltd, trading as Nalo, may act as a responsible party when it determines why and how personal information is processed, for example for direct customer accounts, billing, support, fraud prevention, service administration and legal compliance.
Where a corporate fleet customer determines the purposes of monitoring its drivers, employees, contractors, vehicles or assets and instructs Nalo to process that information on its behalf, Nalo may act as an operator for that customer. In that case, the fleet customer remains responsible for establishing a lawful basis, providing required notices and managing data-subject relationships for that customer-controlled processing.
2. Personal information we may process
| Category | Examples |
|---|---|
| Identity and contact | Name, business details, ID or registration information where lawfully required, email address, telephone number, address and authorised-user details. |
| Account and contractual | Customer number, subscription, quotation, order, vehicle allocation, account permissions, signed schedules and service history. |
| Vehicle and telematics | Registration number, VIN or asset identifier, device identifiers, GPS location, routes, trip times, speed, ignition/status events, mileage, engine hours, diagnostic information, alerts, panic events and driver-identification events. |
| Operations | Maintenance records, job cards, inspections, workshop activity, field-service events, fuel-related information, photographs or supporting documents uploaded to the platform. |
| Payment and billing | Invoice information, billing contact, payment status, bank reference and transaction metadata. Where a third-party payment processor is used, payment credentials may be processed in that provider's secure environment. |
| Technical and usage | IP address, browser/device data, authentication events, security logs, session information, platform activity and cookie identifiers. |
| Communications | Support tickets, emails, call notes, complaints, requests and feedback. |
3. Why we process personal information
We process personal information to provide and administer subscribed services, authenticate users, display fleet and trip information, issue alerts and reports, coordinate support or recovery services, install and maintain devices, manage subscriptions and payments, prevent fraud and misuse, secure the platform, improve service reliability, respond to requests, comply with legal obligations and establish or defend legal rights.
4. Legal grounds
Depending on the processing activity, Nalo relies on one or more lawful grounds recognised by POPIA, including consent, performance of a contract, compliance with a legal obligation, protection of a legitimate interest of the data subject, and the legitimate interests of Nalo or a third party where the processing is reasonable and lawful.
5. Location and driver-monitoring data
Location and behavioural telematics can reveal detailed patterns about a driver or user. Nalo processes this information only for legitimate subscribed purposes and subject to access controls. Corporate fleet customers must ensure that monitoring is transparent, proportionate and lawful and that affected drivers or employees receive the notices required by POPIA and applicable employment or workplace rules.
6. How information is collected
Information may be collected directly from the data subject, from an authorised business customer, from installed telematics devices and sensors, through platform activity, from service providers involved in installation/support/payment processing, or from lawful public or commercial sources where reasonably necessary.
7. Mandatory and voluntary information
Some information is necessary to create an account, contract for a service, identify a vehicle, process payment, provide tracking or meet legal obligations. If required information is not provided, Nalo may be unable to provide the relevant service. Optional information will be identified where reasonably practicable.
8. Sharing of personal information
Nalo may share personal information, on a need-to-know basis, with authorised customer users, installers, hosting and cloud providers, communications and connectivity providers, mapping providers, payment processors, roadside or recovery providers, merchants, professional advisers, auditors and regulators. Nalo requires operators processing personal information on its behalf to protect the information through appropriate contractual and security measures.
Nalo does not sell personal information to advertisers or data brokers.
9. Cross-border processing
Where personal information is stored or processed outside South Africa, Nalo will apply the safeguards required by section 72 of POPIA, including an applicable law, binding agreement or other lawful basis providing an adequate level of protection.
10. Security
Nalo applies reasonable and appropriate technical and organisational measures designed to protect the confidentiality, integrity and availability of personal information. Measures may include role-based access, authentication controls, logging, encryption in transit where appropriate, backups, vulnerability management, supplier controls and incident-response procedures. No internet-connected system is completely risk-free.
11. Security compromises
If Nalo has reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, Nalo will investigate and make notifications required by section 22 of POPIA. Where Nalo acts only as an operator, it will notify the responsible-party customer in accordance with POPIA and the applicable data-processing terms.
12. Retention
Nalo keeps personal information only for as long as reasonably necessary for the purpose for which it was collected, to perform a contract, resolve disputes, maintain required records or meet legal obligations. Retention periods may differ by record type. Accounting, tax, contractual and transaction records may be retained for statutory periods. Telematics and platform records may be retained for the period agreed with the customer or for the period reasonably required for the relevant service, after which they are deleted, de-identified or archived where legally permissible.
13. Direct marketing
Nalo will send electronic direct marketing only where POPIA permits it, including where valid consent has been obtained or where the existing-customer conditions in section 69 are satisfied. Every electronic marketing communication will provide a reasonable, free and uncomplicated way to opt out. Opting out of marketing does not stop necessary service, billing, security or contractual communications.
14. Cookies and analytics
The website may use essential cookies required for security, authentication, basket/session functionality and preferences. Analytics or marketing technologies that process personal information should be used only in accordance with the Cookie Policy and the consent choices made available on the website.
15. Your POPIA rights
Subject to POPIA and PAIA, a data subject may ask whether Nalo holds personal information about them, request access, request correction or deletion where legally justified, object to certain processing, withdraw consent where consent is the applicable basis, and object to direct marketing. Requests may be sent to support@nalonode.com.
If Nalo is processing information solely on behalf of a fleet customer, Nalo may refer the request to that responsible-party customer or assist that customer to respond.
16. Automated decisions
Nalo may generate alerts, scores, exceptions or automated analytics from telematics data. Nalo will not use solely automated processing to make a decision producing legal or similarly significant effects for a data subject except where POPIA permits it and appropriate safeguards are in place.
17. Children
Nalo's commercial fleet and telematics services are not directed at children. Nalo does not knowingly seek to create direct customer accounts for persons under 18. Where information about a child is processed incidentally or on a customer's instructions, the responsible party must ensure that a lawful POPIA basis exists.
18. Complaints
Privacy enquiries and requests should first be sent to support@nalonode.com. A data subject may also lodge a complaint with the Information Regulator (South Africa) through https://eservices.inforegulator.org.za/services.aspx.
19. Changes
Nalo may update this Policy to reflect legal, technical or service changes. Material changes will be communicated in a reasonable manner and the effective date will be updated.
Website processing details — 28 September 2026
For this website, NALO uses Vercel for hosting, Supabase for account and order data, Resend for transactional email, TomTom for address search, Paystack for payment checkout and Xero for invoicing.
When you agree to third-party document verification and submit your documents, NALO sends the required documents through OpenRouter to Microsoft Azure using an OpenAI model to extract names and identity or business identifiers for comparison with your submitted details. A complete match can automatically mark your verification as approved. The comparison checks whether details match; it does not establish that a document is genuine. If a result is incorrect or you need assistance, contact support@nalonode.com to request a review.
Document requests are configured to use Azure only, with no provider fallback, to deny data-collection routes and to require zero-data-retention endpoints. These routing settings are not a guarantee that all operational metadata is absent or that NALO itself retains no records. NALO stores submitted evidence and comparison results for verification and related record-keeping. The privacy rights and cross-border processing provisions in this policy also apply.