Privacy Policy

This policy explains what personal information Valet Lavage collects when you book with us, why we collect it, and your rights. Valet Lavage is operated by Riyaadah Holdings (Pty) Ltd (registration number 2026/454784/07), with its registered office at 5 Nathaniel Isaacs Crescent, North Beach, Durban, KwaZulu-Natal, 4001. The company is the responsible party for your information under the Protection of Personal Information Act (POPIA).

What we collect

• Your name.
• Your phone number, which is also your WhatsApp contact.
• The address or location where the vehicle will be washed.
• Your booking details: the service, vehicle, date, time, distance from our base and the fee.
• Your email address. Your booking confirmation and receipt are sent there, and it is also how you sign in to your account.
• Your vehicle’s registration number, only if you choose to give it. This is optional, and a booking works exactly the same without it.
• A payment reference for each booking. We never see or store your actual card number, expiry date or security code.
• Your loyalty progress, counted against your account.

Why we collect it

We use your information to provide the service you booked: to confirm the booking, work out the call-out fee, take payment, contact you about the appointment, run the loyalty reward, and keep a record of your bookings and invoices. We do not sell your information, and we do not use it for advertising.

If you give us your vehicle’s registration number, we use it for one purpose only: so that the team can identify your vehicle on arrival, which matters in a complex, an office park or shared parking. It is passed to the team allocated to your booking and is not used to identify you, to link your bookings together, or for any other purpose. It is held with that booking and no longer.

Your email address identifies your account. An account is created when you pay for a wash, and the bookings made with that address are held against it. Because the address is what proves the account is yours, we confirm you control it before anyone can open it: signing in sends a code to that address and nowhere else. We do not change the address on an existing account without confirming the new one.

Card details

Card payments are handled entirely by our payment provider, PayGate, on their own secure, PCI-DSS compliant systems. Your card number, expiry and security code are entered on their page and never reach us. We do not currently offer saved cards or a one-tap repeat payment; each booking is paid separately through the provider's secure page.

Who we share it with

We share information only with the service providers that make the booking work:

• Our payment provider, to process your payment.
• Google Maps Platform, for the optional browser address search helper and for server-side address resolution used to measure distance and calculate the call-out fee.
• Messaging services (WhatsApp and email), to send you booking confirmations and reminders.

Google Maps address processing

If Google Maps address search is available and you use it, the words you type are sent directly from your browser to Google so it can show address suggestions. A selection gives us an opaque Google place ID and suggestion text. You must confirm or correct the address in our standard address field before continuing. We preserve the Google Maps branding and attribution displayed with the suggestions.

When you submit a booking, our server independently resolves the selected place ID, or the customer-confirmed address if no place was selected. Browser-provided coordinates are not trusted. We store the place ID, your confirmed address, the derived distance, and the resulting business fee. New bookings do not retain Google coordinates permanently; a bounded geocoding cache may keep them for no more than 30 days. Older booking records may still contain historical coordinates created before this policy was introduced.

Firebase App Check with reCAPTCHA Enterprise helps protect the browser integration from automated abuse and may process browser and device signals for that purpose. If the Google helper, App Check, or server lookup is unavailable, you can still type your address manually. We keep the address you submit and mark the call-out fee as on request instead of sending it to a different mapping provider or guessing a fee. Google processes data under the Google Privacy Policy.

Where it is kept and how it is protected

Your booking information is stored in our booking system, which runs on Cloudflare’s infrastructure. We apply reasonable technical measures to protect it, including encrypted connections, access controls, and storing sign-in codes and sessions in a protected form. No system is perfectly secure, but we take the safeguarding of your information seriously.

How long we keep it

We keep your information for as long as needed to provide the service and to meet our legal and accounting obligations. You may ask us to delete information that we are no longer required to keep.

Cookies and analytics

The site uses a privacy-friendly, cookieless analytics tool that does not track you across other sites. If you sign in to the member area, we set a single secure cookie to keep you signed in. We do not use advertising or tracking cookies.

Your rights under POPIA

You have the right to ask what information we hold about you, to have it corrected, and to ask us to delete it where we are not required to keep it. You may also object to certain uses of your information. To exercise any of these rights, contact us using the details below.

Contact

For any privacy question or request, contact our Information Officer at info@valetlavage.co.za. If you are not satisfied with our response, you may lodge a complaint with the Information Regulator of South Africa.