POPIA Section 18 Manual

Ref: 2025/868984/07 | Standard v2.0 | Effective: 13 June 2026

This manual outlines how DAVIDSOLOMON (Pty) Ltd 2025/868984/07 trading as CargoXchangeSA orchestrates the processing of personal information under the South African regulatory framework.

Introduction & Consent to Process

This manual sets out how DAVIDSOLOMON (Pty) Ltd 2025/868984/07 trading as CargoXchangeSA ("CargoXchangeSA", "we", "us", "our") processes personal information in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA"). By accessing, registering for, or continuing to use the CargoXchangeSA platform and its services, you, as the data subject, acknowledge that you have read, understood, and explicitly consent to the processing of your personal information as described in this manual. Your continued use signifies your active agreement to these terms, which constitutes your consent as defined by POPIA.

Designated Information Officer

In terms of Section 55 of POPIA, CargoXchangeSA has designated a responsible Information Officer to oversee our compliance with POPIA. This officer is your primary contact for any queries, requests, or concerns regarding your personal information.

Officer Identity

Head of Compliance & Integrity

Direct Channel

cargoxchange@mweb.co.za

1. Personal Information Collected & Purpose

CargoXchangeSA collects and processes various categories of personal information strictly for specific, legitimate, and lawful purposes related to providing and improving our logistics marketplace services.

A. Identity and Contact Information

Examples

Full name, company name, registration number, email, WhatsApp, physical address, ID number (for FICA).

Purpose

Account creation, user verification, communication, invoicing, and regulatory compliance.

B. Financial Information

Examples

Bank account details, payment transaction history, VAT registration status.

Purpose

Processing payments, managing escrow, facilitating payouts, and tax compliance.

C. Operational and Transactional Information

Examples

Shipment details, Booking history, digital PODs, GPS tracking data, dispute records.

Purpose

Facilitating load matching, real-time tracking, and operational transparency.

2. Disclosure to Third Parties

We only disclose your personal information where it is necessary for the performance of our services, compliance with legal obligations, or with your explicit consent.

A. Other Platform Users

Details

Shipper details shared with carriers; Carrier/Driver details shared with shippers for active missions.

Purpose

Enabling direct contracts of carriage and real-time tracking.

B. Service Providers

Details

Google Cloud (Hosting), Ozow (Payments), WhatsApp API (Notifications).

Purpose

Infrastructure operation and payment processing.

3. Cross-Border Data Transfers

In compliance with POPIA Section 72, any transfer of information outside RSA occurs only under legally permissible conditions with adequate safeguards.

A. Data Residency (At Rest)

Location

Republic of South Africa (africa-south1 Hub).

Scope

All core user profiles, identity artifacts, and financial records.

B. Application Processing

Location

European Union (GDPR-Compliant Region).

Scope

Application logic and advanced AI processing functions.

4. Data Security & Safeguards

We continuously implement appropriate technical and organisational measures to prevent unauthorized access or loss of personal information.

At Rest

AES-256 Encryption

In Transit

TLS 1.2+ Protocol

Identity

Multi-Factor Aware

5. Enterprise AI Privacy Disclosure

CargoXchangeSA utilizes Google Cloud Vertex AI Enterprise services. This ensures mandatory privacy protections for your data.

A. Model Training Shield

Commitment

Your data is NEVER used to train Google’s foundational AI models. Your inputs remain proprietary to our hub.

6. Your Rights as a Data Subject

Under POPIA, you have the right to access, correct, or request the deletion of your personal information. To exercise these rights, contact cargoxchange@mweb.co.za.

Statutory Indemnity Notice

CargoXchangeSA explicitly declares that it bears no liability for the physical execution failures of any 3rd party Carrier, Shipper, or Broker. Under POPIA, we process data solely to facilitate the logistics link. Our liability is strictly capped at the service fee collected.

Lead Representative

Head of Compliance & Ethics

Materialization Date

13 June 2026

CargoXchangeSA