Privacy Policy

1. Introduction

Lumo Enterprise (Pty) Ltd trading as Lumo ("Lumo", "we", "us", or "our") is committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, share, and protect your information when you use our rideshare advertising platform, including our web dashboard and mobile services.

We are bound by the Protection of Personal Information Act 4 of 2013 ("POPIA") and other applicable South African privacy laws. This policy should be read together with our Terms of Service.

2. Information We Collect

2.1 Advertiser Information

• Personal details: Name, email address, phone number
• Business information: Company name, registration details, VAT number (if applicable)
• Billing information: Payment details, invoicing address
• Campaign data: Ad creatives, targeting preferences, budget allocation
• Usage data: Dashboard interactions, campaign performance metrics

2.2 Driver Information

• Personal details: Name, email address, phone number, ID number
• Vehicle information: Registration details, make, model, color
• Ride-hailing verification: Proof of affiliation with platforms like Bolt, Uber
• Banking details: Account information for payment processing
• Location data: The screen in your vehicle reports where it is about every 30 seconds whenever it is switched on, not only while a campaign is running. We use this to show advertisers where their ads played, to estimate trips, and to find a screen that goes missing
• Security information: Device serial numbers and installation details for theft protection

2.3 Technical Information

• Device information: Browser type, operating system, device identifiers
• Network data: IP address, connection type, location
• Usage analytics: Pages visited, time spent, click patterns
• In-car display device data: Hardware status, tamper detection, connectivity
• Cookies and tracking technologies

2.4 Passengers

• Counting who is watching: The camera on an in-car screen counts how many people are looking at an ad and for how long. It does not recognise who anyone is, and no pictures or video leave the screen or are kept
• Scans: When you scan a code on a screen we count the scan (which ad, which screen, and when) and send you on to the advertiser. We do not ask who you are

2.5 Passengers Who Share a Ride (ride.lumoads.co.za)

A passenger can check in from the screen in their car and send people they trust a link that shows where the car is. Nobody needs an account, phone number or email for this. When you check in we keep:

• A key your phone holds, so that you stay the same rider. We keep only a scrambled copy of it
• The name you give for your link, if you give one
• Each ride: the screen and vehicle, when it started and ended, and whether you raised an alert
• Your phone's position during the ride, only if you choose to share it, and only while the ride page is open
• How many browsers have your link open, by a random number each browser makes up. It does not say who they are

Anyone with your link sees where the car is during your ride, the way it has come, its registration, and your phone's position if you share it. You can replace the link at any time. If you raise an alert, the people with your link see it, and our team is sent the vehicle, its driver and where the car was. We do not contact anyone else, including the police.

2.6 What We Record When You Use Our Website and Dashboard

So that we can see which parts of our website and dashboard are used, where people give up, and what breaks, the pages record what happens on them and send it to our own servers:

• Which pages you open, which buttons and links you press (by their label), and which parts of a page you scroll to
• Whether something you did worked: for example that creating a campaign succeeded, was refused, or failed
• Errors in the page itself
• Whether you are on a phone or a larger screen

We do not record anything you type, and this recording uses no cookies and does not store your IP address. Addresses are stripped of anything that identifies a record (a campaign's number, a link's code) before they are sent. Each visit gets a random number that your browser forgets when you close the tab. On the dashboard, where you are signed in, what you do is linked to your account. If your browser sends a "Do Not Track" or Global Privacy Control signal, nothing is recorded.

3. How We Use Your Information

We process your personal information for the following purposes:

3.1 Service Delivery

• Matching drivers to relevant advertising campaigns
• Managing in-car display devices and content delivery
• Tracking ad performance and generating analytics
• Processing payments and managing billing
• Providing customer support and communication

3.2 Platform Operations

• Fraud detection and prevention
• Platform security and abuse prevention
• Theft protection and device security monitoring
• Quality assurance and campaign optimization
• Legal compliance and regulatory reporting

3.3 Improvement and Analytics

• Platform performance analysis
• User experience optimization
• Product development and feature enhancement
• Market research and trend analysis

4. Lawful Basis for Processing

Under POPIA, we process your personal information based on:

• Consent: When you explicitly agree to data processing
• Contract necessity: To fulfill our service agreements
• Legitimate interest: For fraud prevention, security, theft protection, and platform improvement
• Legal obligation: To comply with applicable laws and regulations

5. Data Sharing and Third Parties

We may share your information with:

• Payment processors: For billing and payout processing
• Cloud service providers: For data storage and platform hosting
• Analytics providers: Google Analytics, on our website
• GPS and mapping services: For location tracking and route optimization
• Security service providers: For theft protection and device monitoring
• Legal authorities: When required by law or to protect our rights

6. Data Security

We implement appropriate technical and organizational measures to protect your personal information:

• Encryption of data in transit and at rest
• Access controls and authentication mechanisms
• Regular security audits and vulnerability assessments
• Staff training on data protection principles
• Secure device installation and tamper detection systems

7. Cross-Border Data Transfers

Some of our service providers may be located outside South Africa. When we transfer your data internationally, we ensure appropriate safeguards are in place, including adequacy decisions or standard contractual clauses.

8. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this policy:

• Account information: Until account closure plus 7 years for legal compliance
• Location data: A screen's exact positions for 90 days. Summaries of its trips (where a trip started and ended, to about 100 metres) for 12 months. Where an ad played or was seen is kept with the campaign's records
• Shared rides: A ride for 30 days after it ends, or 180 days if an alert was raised. Your link, its name and your phone's key until 12 months after you last used them
• Website and dashboard activity: Single events for 90 days. After that only daily counts, which do not say who did what
• Billing records: 7 years for tax and accounting purposes
• Security logs: 24 months for theft protection and incident investigation
• Marketing data: Until you withdraw consent or opt-out

9. Your Rights Under POPIA

You have the following rights regarding your personal information:

• Access: Request a copy of your personal information
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your personal information
• Objection: Object to certain types of processing
• Portability: Request your data in a portable format
• Restriction: Limit how we process your information

10. Data Breach Protocols

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the Information Regulator within 72 hours and inform affected individuals without undue delay.

11. Cookies and Tracking Technologies

We use cookies and similar technologies in these ways:

• Our website (lumoads.co.za) uses Google Analytics, which sets cookies to measure visits
• Our dashboard keeps you signed in, and remembers your theme and workspace, in your browser's own storage rather than in cookies
• Our own record of what happens on our pages (section 2.6) uses no cookies
• Videos on our Learn pages are played by YouTube. Nothing is loaded from YouTube until you press play; after that, YouTube may set its own cookies under its own privacy policy

You can block or delete cookies in your browser's settings. Our pages work without them.