Privacy & POPIA

Your privacy, by design.

Built around POPIA — you control what you share, and you can export or erase your data at any time.

⚠ Draft template — have this reviewed by your legal adviser before launch.

Last updated: 2 June 2026.

Voyage is built privacy-first and aligned with South Africa's Protection of Personal Information Act (POPIA). This policy explains what personal information we process, why, and the choices and rights you have.

Who is responsible

Your employer (the company whose Voyage workspace you use) is the responsible party for the personal information processed about its employees. Voyage acts as an operator, processing that information on the company's instructions to provide the service.

What we process

  • Account & profile — name, work email, employee number, role and reporting line.
  • Trip & expense data — travel requests, routes, mileage, receipts and expense claims.
  • Optional personal details you choose to share — home address, vehicle details and emergency contacts. These are private by default; you decide, field by field, what to share with your company.
  • Location — collected only when you enable trip tracking, to record distance for SARS-compliant mileage.
  • Technical — device and log information needed to run and secure the service.

Your POPIA rights

You can, at any time:

  • Access & export a copy of all personal information we hold about you, from within the app.
  • Correct inaccurate information.
  • Erase your personal information. When you do, we delete your personal records and anonymise your account. Travel and expense records are retained in anonymised form only where the law requires it (e.g. SARS tax-record retention) — no personal information survives.
  • Object to, or withdraw consent for, optional processing such as location tracking.

How long we keep it

We keep personal information only as long as needed to provide the service or as required by law. Financial records may be retained for the statutory tax-retention period (about five years), anonymised once you erase your account.

Security

Each company's data is isolated in its own database schema. Passwords are hashed, traffic is encrypted in transit, and access follows least-privilege rules. See our security page for more.

Contact

To exercise a right or ask a privacy question, contact us via the contact page, or speak to your company administrator.