Privacy Policy — Routelink

Effective Date: 11 August 2026

Routelink ("we", "us", or "our") provides delivery route planning and last-mile tracking software. This Privacy Policy explains how we collect, use, share and protect personal information when you use our website, applications and services (the "Service").

This policy is written with reference to the Protection of Personal Information Act 4 of 2013 ("POPIA") of South Africa. Words such as "personal information", "processing", "data subject", "responsible party" and "operator" carry the meanings given to them in POPIA.

1. The two roles we play

It is important to understand which of two roles we are acting in, because it determines who is accountable for the information.

As a responsible party. When you sign up for a Routelink account, we determine why and how we process your information — for example your name, email address, login credentials and billing details. For this information, we are the responsible party.
As an operator. When you use Routelink to plan deliveries, you upload information about other people — your delivery recipients, your drivers, and your own staff. We process that information on your instruction and for your purposes only. For this information, you are the responsible party and we are your operator.

If you are a delivery recipient who received a tracking link, the business making your delivery is the responsible party for your information. Please direct requests about your information to that business in the first instance. We will assist them in responding.

2. Personal information we collect

2.1 Information about account holders (we are responsible party)

Account and profile: business name, subdomain, country, timezone, currency, company logo, and each user's name, email address and role.
Authentication: a hashed password and access tokens. We never store your password in readable form.
Billing: your billing email and subscription status. We do not store card details — card payments are processed entirely by Stripe.
Technical: IP address, browser and device type, and error diagnostics when something goes wrong.

2.2 Information you upload about others (we are operator)

Delivery recipients: name, company, delivery address (including geocoded coordinates), contact number, email address, delivery notes, item details, and any external reference numbers you supply.
Proof of delivery: recipient name, signature, photographs, driver notes and failure reasons captured at the point of delivery.
Recipient feedback: ratings and comments submitted through a tracking link.
Drivers: name, contact number, email address, and an access PIN for the driver app.
Notification records: the email address or mobile number a delivery notification was sent to, and the content of that message.

3. Location information

We are deliberately limited in the location information we keep, and we think it is worth being specific:

Location is captured from the driver's smartphone, using the device's built-in GPS. It requires the driver to grant location permission in their browser or device settings, and can be withdrawn at any time in those settings.
We store a location snapshot at the moment a task status changes — when a driver starts, completes or fails a delivery.
We store the driver's current position while they are working a route, so that a recipient can see an approaching delivery. This value is overwritten with each update — it is not accumulated.
We do not keep a continuous "breadcrumb trail" of vehicle or driver movements in the way a vehicle-tracking provider does.
We store the coordinates of delivery and depot addresses, because route planning requires them.

Whether a recipient can see a driver's live position is controlled by the account holder in their tracking settings.

4. Third-party integrations you choose to connect

Routelink can connect to third-party systems — for example a telematics platform, an online store or a marketing tool. These connections are optional and enabled by you. Where you connect one:

You provide the credentials, and you can disconnect the integration at any time.
You are the responsible party for information sent to or received from that third party, and that third party's own privacy terms apply.
We only exchange the information needed for the feature in question — for example vehicle and zone lists, or sending delivery destinations to a vehicle.

5. Why we process personal information

We process personal information to:

Provide, operate, secure and support the Service.
Plan and optimise delivery routes, and record delivery outcomes.
Send delivery notifications and tracking links to recipients on your instruction.
Bill you and manage your subscription.
Diagnose faults, prevent abuse and maintain the security of the Service.
Comply with our legal obligations.

We rely on one or more of the following grounds under section 11 of POPIA: performance of a contract with you; our legitimate interests or those of a third party; compliance with a legal obligation; and, where required, consent.

We do not sell personal information, and we do not use the information you upload as an operator for our own purposes.

6. Who we share information with

We share personal information with service providers ("operators") who help us run the Service, under agreements that require them to protect it and to process it only on our instruction. Our principal operators are:

Railway and Google Cloud Platform — application hosting and database (European Union).
Cloudflare — file storage for uploaded images, including proof of delivery (European Union).
Stripe — subscription billing and card payment processing.
Postmark — sending transactional email and delivery notifications.
BulkSMS — sending SMS delivery notifications.
Google Maps Platform — address lookup, geocoding and maps.
Geoapify — route optimisation.
Sentry — error monitoring and diagnostics.

We may also disclose personal information where we are legally required to do so, to establish or defend a legal claim, or to a purchaser or investor in connection with a merger, acquisition or business transfer. In the last case we will take reasonable steps to ensure the information remains protected.

7. Transfers outside South Africa

Routelink's application and database are hosted in the European Union (Netherlands), and uploaded files are stored in the European Union. Some of our operators — including Stripe, Google and Postmark — process information in the United States or other jurisdictions.

This means personal information is transferred outside the Republic of South Africa. Where we do so, we take reasonable steps under section 72 of POPIA to ensure the recipient is subject to laws, binding rules or an agreement providing an adequate level of protection substantially similar to POPIA.

8. How we protect personal information

We take appropriate, reasonable technical and organisational measures to safeguard personal information, as required by section 19 of POPIA. These include:

Encryption of all traffic in transit over the public internet.
Passwords hashed using a strong one-way algorithm, and API access tokens stored only as hashes.
Logical separation of each customer account, so users only access data belonging to their own account.
Role-based permissions (Owner, Admin, Staff) governing who may view or change data.
Rate limiting and lockouts on the driver app login to limit brute-force attempts.
Verification of payment provider webhooks, and validation of data submitted to our API.
Point-in-time recovery on our database.
No storage of card details on our systems.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your login credentials confidential and for managing which of your users have access to your account.

Delivery tracking links, driver app links, and links to uploaded images such as proof of delivery are accessible to anyone holding the link. Please treat them accordingly and share them only with the intended recipient or driver.

9. How long we keep personal information

We keep personal information for as long as your account remains active and for as long as necessary to provide the Service, resolve disputes, and meet our legal, accounting and reporting obligations.

Because Routelink acts as your operator for delivery data, that information is retained for as long as you instruct us to hold it. If you would like specific data deleted, or your account and its data removed, contact us using the details in section 14 and we will action your request.

10. Your rights under POPIA

Subject to the conditions and exceptions in POPIA, you have the right to:

Be notified that your personal information is being collected, or that it has been accessed by an unauthorised person.
Request access to the personal information we hold about you, and to be told who has had access to it.
Request correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully.
Object to the processing of your personal information on reasonable grounds.
Object to direct marketing, including by unsubscribing at any time.
Not be subject to a decision based solely on automated processing that has legal consequences for you.
Complain to the Information Regulator, and to institute civil proceedings.

To exercise any of these rights, contact our Information Officer using the details in section 14. We may need to verify your identity before acting on a request. Requests for access to records may be made under the Promotion of Access to Information Act 2 of 2000 (PAIA), and a prescribed fee may apply.

If you are a delivery recipient, please contact the business that arranged your delivery, as they are the responsible party for your information. If you contact us directly, we will forward your request to them and assist them in responding.

11. Direct marketing

We will only send you electronic direct marketing where you have consented, or where you are an existing customer and the marketing relates to similar products or services. Every marketing message includes a way to opt out, and you may unsubscribe at any time at no cost. Service-related messages — such as billing notices, security alerts and delivery notifications — are not marketing and will continue to be sent.

12. Cookies and analytics

Our application uses cookies that are strictly necessary for it to function — for example to keep you signed in and to remember which account you are working in. These cannot be disabled without breaking the Service.

On our public website we use Plausible Analytics, which is privacy-focused and does not set tracking cookies or collect personal information. Some pages load resources from third parties, such as Google Maps and web fonts, which may receive your IP address as part of that request.

You can control or delete cookies through your browser settings.

13. Children

Routelink is a business tool and is not directed at children. Under POPIA a child is a person under 18 years of age, and we do not knowingly collect the personal information of a child without the consent of a competent person. If you believe we have done so, please contact us and we will delete it.

14. Information Officer and how to contact us

Our Information Officer is responsible for compliance with POPIA and for handling requests and complaints relating to personal information.

Information Officer: Andrew Cowley
Email: [email protected]
General support: [email protected]
Registered entity: Ottermake (Pty) Ltd. t/a Routelink
Address: 3 Molteno Street, Onrus River, Western Cape, 7201, South Africa

15. Security compromises

If we have reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and the affected data subjects as soon as reasonably possible after discovering the compromise, in line with section 22 of POPIA. Where we act as your operator, we will notify you without undue delay so that you can meet your own notification obligations.

16. Complaints to the Information Regulator

If you are not satisfied with how we have handled your personal information or your request, you may lodge a complaint with:

The Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Email: [email protected]
Website: inforegulator.org.za

17. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page and revise the effective date above. Where changes are material, we will take reasonable steps to notify you. We encourage you to review this page periodically.