Who processes your information
The responsible party is Entilini Operations (RF) (Pty) Ltd, operator of Chapman's Peak Drive. Enquiries about this policy, or about the personal information held about you, may be sent to [PRIVACY EMAIL ADDRESS] or to the Information Officer at the address in the PAIA Manual.
What is collected
Website use: pages viewed, approximate location derived from your IP address, device and browser type, and referring page. This is collected in aggregate to understand how the site is used.
Frequent User accounts: your name, contact details, vehicle registration, account balance, top-up history and trip records — the information necessary to operate the account.
Enquiries: whatever you choose to include when you contact the operator by form, email, telephone or WhatsApp.
Toll operations: transaction records at the plaza, and camera and licence-plate data captured for toll enforcement, safety and incident investigation.
Why it is processed
To operate the toll and Frequent User systems; to publish road status and safety information; to respond to enquiries; to investigate incidents; to meet legal, regulatory and concession obligations; and to improve this website.
Personal information is not sold. It is not used for marketing without your consent, and consent may be withdrawn at any time.
Payments
Card details are not stored on this website. Payments are processed by a PCI-DSS-compliant South African payment gateway, and card data is transmitted directly to that gateway.
Who it may be shared with
Personal information may be shared with the Western Cape Government as the asset owner, with service providers who process information on the operator’s behalf under written contract, with the payment gateway, and with law-enforcement or regulatory bodies where the operator is legally obliged to do so.
Where information is processed outside South Africa, the operator will ensure the recipient is subject to a law or agreement providing an adequate level of protection, as required by section 72 of POPIA.
How long it is kept
Records are retained for as long as necessary for the purpose collected, and thereafter for any period required by law — including the retention periods applicable to financial records and to the concession. Records are then destroyed or de-identified.
Your rights
You have the right to ask what personal information is held about you, to have it corrected or deleted where it is inaccurate, irrelevant, excessive, out of date or unlawfully obtained, to object to processing on reasonable grounds, and to withdraw consent where processing is based on consent.
You also have the right to lodge a complaint with the Information Regulator (South Africa), enquiries@inforegulator.org.za.
Security
Appropriate technical and organisational measures are in place to protect personal information, including encrypted transport, role-based access control, and audit logging of administrative changes. Where a security compromise affecting personal information occurs, the operator will notify the Information Regulator and affected data subjects as required by section 22 of POPIA.
Demo concept — not yet in force
This document is drafted to the correct structure but contains fields that only the operator can supply — company registration details, the appointed Information Officer, and the addresses on record. These appear in square brackets. It must be completed and reviewed by the operator's attorney before publication. Nothing here constitutes legal advice.