← Back to home
Legal

Privacy Policy

Effective date: 18 August 2026  ·  Last updated: 18 August 2026

App: Ride of Passage ("the App")

Operated by: XP Labs Pty Ltd ("we", "us", "our", "the Company")

Contact email:hello@rideofpassage.co.za

This Privacy Policy explains how we collect, use, store, share and protect your personal information when you use the App. We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA").

This Privacy Policy should be read together with our Terms of Use.

1. Who is responsible for your information

XP Labs Pty Ltd is the Responsible Party (data controller) for your personal information under POPIA.

For any POPIA-related queries, or to contact our Information Officer, email us at:

  • Email: hello@rideofpassage.co.za

2. What personal information we collect

We collect only what we need to run the App and help you study. This includes:

Information you give us when you register or use the App:

  • First name and last name
  • Email address
  • Password (stored in encrypted/hashed form; we never store it in plain text)
  • Province (used to tailor content and understand where our learners are)

Information generated as you use the App:

  • Your learning progress, completed lessons, levels and modules
  • Quiz, test and practice results, scores and attempts
  • XP, streaks, badges and other in-app progress data
  • Settings and preferences

Information we collect automatically:

  • Device type, operating system and app version
  • Approximate region (derived from your province or device settings)
  • App usage and diagnostic data (crashes, performance, feature usage)
  • A unique device or installation identifier

Payment information:

  • Purchase records (what you bought and when)
  • We do not store your full card or banking details. Payments are processed by our third-party payment provider, PayFast, a South African payment gateway, who handles your payment data under their own terms and privacy policy. All payments are processed in South African Rand (ZAR) within South Africa; we do not process cross-border payments.

3. How we collect your information

We collect personal information:

  • Directly from you when you register, purchase access, contact support, or use the App
  • Automatically as you interact with the App
  • From third-party service providers we use (for example, payment, hosting and analytics providers)

4. Why we process your information and our legal basis

Under POPIA we may only process your information where we have lawful grounds. We rely on the following:

PurposeLegal basis under POPIA
Create and manage your accountPerformance of our agreement with you
Give you access to purchased contentPerformance of our agreement with you
Track and save your learning progressPerformance of our agreement / your consent
Process payments and prevent fraudPerformance of agreement / legitimate interest / legal obligation
Send service messages (e.g. receipts, important notices)Performance of agreement / legitimate interest
Send reminders, streak nudges and marketingYour consent (you may opt out at any time)
Improve the App and fix problemsOur legitimate interest
Comply with the lawLegal obligation

5. Who we share your information with

We do not sell your personal information. We share it only with parties who help us operate the App, and only as far as needed:

  • Cloud hosting and infrastructure providers (to store data and run the App)
  • PayFast, our payment processor (to take payments)
  • Analytics and crash-reporting providers (to understand usage and fix bugs)
  • Communication/push notification providers (to send reminders and notices)
  • Professional advisors and authorities where required by law

Each provider is required to protect your information and use it only for the agreed purpose.

6. Cross-border transfers

Some of our service providers (for example, cloud hosting and analytics) may store or process data outside South Africa. Where this happens, we take steps required by section 72 of POPIA to ensure your information receives an adequate level of protection, for example through contractual safeguards or by using providers in countries with comparable data protection laws. Our payment provider, PayFast, processes all payments within South Africa; we do not process cross-border payments.

7. How long we keep your information

We keep your personal information only for as long as:

  • Your account is active, or
  • We need it to provide the App and our services, or
  • We are required to keep it by law (for example, tax and financial records), or
  • We need it to resolve disputes or enforce our agreements.

When information is no longer needed, we delete or de-identify it. You can ask us to delete your account at any time (see section 9).

8. How we protect your information

We apply reasonable technical and organisational measures as required by POPIA, including:

  • Encryption of passwords and data in transit
  • Access controls limiting who can see personal information
  • Secure, reputable hosting providers
  • Regular review of our security practices

No system is perfectly secure. If a data breach occurs that risks your rights, we will notify you and the Information Regulator as required by POPIA.

9. Your rights under POPIA

You have the right to:

  • Access the personal information we hold about you
  • Correct or update information that is inaccurate or incomplete
  • Delete your information or account, where we are not legally required to keep it
  • Object to processing in certain circumstances
  • Withdraw consent for marketing or other consent-based processing, at any time
  • Lodge a complaint with the Information Regulator (see section 13)

To exercise any right, contact us at hello@rideofpassage.co.za. We may need to verify your identity before acting on your request.

10. Children and minors

The K53 learner's licence may be applied for from the age of 17 in South Africa, so some of our users may be minors (under 18).

  • POPIA treats the personal information of children with special care.
  • If you are under 18, you may only use the App and provide personal information with the consent and supervision of a parent or legal guardian (a "competent person").
  • By allowing a minor to use the App, the parent or guardian consents to this Privacy Policy on the minor's behalf.
  • We do not knowingly process a minor's information without such consent. If we learn we have done so without the necessary consent, we will delete it.

11. Marketing communications

We will only send you marketing messages (such as study tips, offers and reminders) where you have agreed to receive them. You can opt out at any time via the App settings or the unsubscribe option in any message. Opting out of marketing does not stop important service messages (such as payment receipts or policy changes).

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you in the App or by email. The "Last updated" date at the top shows the latest version. Continued use of the App after changes means you accept the updated policy.

13. Complaints: the Information Regulator

If you believe we have not handled your personal information properly, please contact us first so we can try to resolve it. You also have the right to complain to:

The Information Regulator (South Africa)

  • Website: inforegulator.org.za
  • Email (general): enquiries@inforegulator.org.za
  • Email (POPIA complaints): POPIAComplaints@inforegulator.org.za
  • Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

End of Privacy Policy.