Privacy policy

ShuttleSync is an operations platform for shuttle, transfer and tour operators. It is provided by Naroko (Pty) Ltd, a South African company (“ShuttleSync”, “we”, “us”). We are committed to handling personal information in line with South Africa’s Protection of Personal Information Act (POPIA) and, where it applies, the EU General Data Protection Regulation (GDPR).

This policy applies to:

• the ShuttleSync website;
• the ShuttleSync operations platform used by operator staff;
• the Agent Portal used by travel agents and corporate accounts;
• public booking and confirmation pages, and the emails, SMS and messages the platform sends; and
• the ShuttleSync Driver app. Because the driver app collects location data, it has its own, more detailed policy at /privacy-policy/driver. Where the two differ, the driver policy applies to the driver app.

Most personal information in ShuttleSync is entered by a shuttle, transfer or tour operator (an “Operator”) about its own customers, passengers, agents, staff and drivers. For that information the Operator is the responsible party (controller) and decides why and how it is used. ShuttleSync processes it on the Operator’s behalf, as an operator (processor), under our agreement with them.

ShuttleSync is the responsible party for the information we collect directly: account and login details, website visits, demo requests and support correspondence, and the technical and usage information described below.

If you are a passenger or a customer of an Operator and you have a question about your booking or your information, the quickest route is usually the Operator you booked with. We will help them respond.

Information Operators and agents enter

• Booking details: passenger names, contact numbers and email addresses, pickup and drop-off locations, dates and times, flight numbers, special requirements and notes.
• Customer, company and agent records, including billing details, references and pricing.
• Staff and driver accounts: name, email address, mobile number, role and, for drivers, vehicle and licence details.
• Emails and messages forwarded or pasted into the platform to be turned into booking drafts.

Information generated by using the platform

• Trip status updates, dispatch assignments, schedule changes and invoices.
• Driver location while a driver is on shift or on a trip, collected through the driver app.
• A log of the confirmations, reminders and other messages the platform sends, including delivery status.
• Flight status information retrieved for bookings that include a flight number.
• Audit records of who created or changed a record and when.

Technical information

• Device type, operating system, browser, app version and IP address.
• Error reports and diagnostic logs, which may include the page or action in use at the time.
• Privacy-respecting website usage statistics (see Cookies and analytics below).

We use personal information to:

• provide the service: create and manage bookings, dispatch drivers, track flights and vehicles, send trip communications and produce invoices and statements;
• run accounts: authenticate users, apply each Operator’s access rules and keep records of changes;
• support and communicate: respond to requests, send service notices and, for Operators, information about the platform;
• keep the platform secure and reliable: detect misuse, diagnose faults and prevent fraud;
• improve the platform, including through aggregated and de-identified data as described below; and
• meet legal obligations, such as tax and record-keeping requirements.

Our lawful bases are the performance of our agreement with each Operator and, for information we hold directly, our legitimate interests in operating, securing and improving the service, or your consent where we ask for it.

Some features use artificial intelligence to save operators typing, for example turning a forwarded email into a draft booking, or drafting a tour itinerary. The content an Operator submits to those features is sent to our AI service provider to produce the draft and is used only for that purpose under contractual terms that restrict its use. A person at the Operator always reviews and approves the result before it becomes a booking.

We may aggregate and de-identify information so that it no longer identifies any individual or any Operator. We use this data to understand how the platform is used, to improve and develop features, to produce statistics and industry insights, and for research and benchmarking. We may share or publish data in this form. Information that has been de-identified in this way is not personal information, and we do not attempt to re-identify it.

• Your Operator. Staff at the Operator you book with, work for or act as an agent for can see the information relevant to their role.
• Drivers and passengers. A driver sees the passenger details needed to complete a trip; a passenger may receive the driver’s name, vehicle and contact details ahead of a pickup.
• Service providers that help us run the platform, acting on our instructions and bound by confidentiality. These include providers of cloud hosting and databases, email, SMS and push-notification delivery, flight data, maps, error monitoring, analytics and AI services.
• Integrations an Operator connects, such as an accounting system. Information is shared with the Operator’s chosen provider only when the Operator turns the integration on.
• Authorities where we are legally required to disclose information, and professional advisers under a duty of confidence.
• A successor if our business is sold or restructured, in which case this policy continues to apply.

We do not sell personal information, and we do not share it with advertisers.

Information is encrypted in transit and at rest. Every Operator’s data is separated from every other Operator’s at the database level, and access within an Operator is limited by role. We log administrative access and changes to records. No system is perfectly secure, so we also keep backups and have procedures for responding to incidents, and we will notify affected Operators and the regulator where the law requires it.

We keep personal information for as long as it is needed for the purposes above, which generally means for as long as the Operator’s account is active and thereafter for the period required by law. Booking, invoice and payment records are kept to satisfy South African tax and record-keeping requirements. Driver location history is kept for a shorter, fixed period. When information is no longer needed we delete it or de-identify it.

Our service providers may store or process information outside South Africa. Where they do, we rely on contractual safeguards with those providers so that the information receives a level of protection substantially similar to POPIA.

Subject to the law, you may:

• ask what personal information we hold about you and receive a copy;
• ask us to correct information that is inaccurate or out of date;
• ask us to delete information, subject to retention obligations. Drivers can use the account deletion page;
• object to or restrict certain processing, and withdraw consent where processing relies on it; and
• lodge a complaint with the Information Regulator of South Africa, or your local supervisory authority.

Where an Operator is the responsible party for your information we will pass your request to them and help them respond.

The platform uses cookies that are necessary to keep you signed in and to protect against cross-site request forgery. The website uses privacy-respecting analytics that count page views without identifying visitors or using tracking cookies. We do not use advertising cookies.

ShuttleSync accounts are for adults. Passenger details for a child may be entered by an adult making a booking on their behalf, and are handled as booking information under this policy.

We may update this policy from time to time. Material changes will be notified to Operators in the platform or by email, and the date at the top of this page will change.

Questions, requests and complaints about personal information can be sent to privacy@shuttlesync.app.

Naroko (Pty) Ltd
South Africa