Privacy and POPIA

• Account means the account created for you on the Platform, identified by your mobile number. There is no password: you sign in with a one-time code sent by SMS.
• Company (“we”, “us”, “our”) refers to Million Thrive (Pty) Ltd (registration number 2017/459930/07), trading as Black Diamond Energy, the responsible party under POPIA. Our Information Officer is Ashtee Govender. Million Thrive (Pty) Ltdis contactable at [email protected].
• Platform refers to Black Diamond Energy — a marketplace where registered, document-checked South African sites / buyers and service providers of diesel, petrol, jet fuel, paraffin and LPG gas agree a sale and settle it through TradeSafe, an escrow provider.
• Operator means a person who processes personal information on our behalf, under a written agreement requiring POPIA-equivalent protection.
• Personal Information has the meaning given to it in POPIA: information relating to an identifiable person, including a juristic person.
• Usage Data means data generated automatically by your use of the Platform or its infrastructure.
• Country means the Republic of South Africa.

Information you give us

• Your mobile number. It is your account identity. We send a six-digit code to it to verify that the number is yours. We store only a hash of that code, never the code itself, and never a password — there is no password.
• Your name and the company you represent, and whether you are registering as a site / buyer or a service provider.
• We collect your email address to enable escrow processing with our payment partner TradeSafe.
• Vetting documents. Your company registration (CIPC), the identity document of the authorised signatory, and — for service providers who hold one — your wholesale fuel license. These are what an administrator reads before your account is opened.
• Deal records. The listings you publish, the volumes you request or accept, the collection and delivery points you enter, the sale agreements you accept (with the date, time and network address of each acceptance), and the settlement breakdown produced for the bank.
• Messages on a deal. Each deal carries a thread between its two parties. The message text is encrypted in our database. It is readable by the two parties and by a Black Diamond Energy administrator, and by nobody else. Administrator access is deliberate: a dispute over a delivery is settled by reading what the parties actually agreed. Messages cannot be edited or deleted by anyone once sent, including us.
• Driver details on a load. The name and mobile number of the driver who is nominated by the service provider for each delivery. The number is encrypted in our database.
• Delivery sign-offs. The full name typed by the person receiving a load at offload, recorded against that load.
• If you register as an investor: your South African ID number, the bank account we pay dividends and withdrawals into, a bank confirmation letter and, if you choose, a copy of your ID. The ID number and the account number are encrypted in our database and shown back to you masked. A Black Diamond Energy administrator reads them to approve your account and to pay a withdrawal you ask for, and every such view is recorded. Share purchases are paid through PayFast: your card or banking details are entered on PayFast’s own page and never reach us — PayFast tells us only that the payment went through, and its reference.
• The driver’s location, while a load is in transit. When a driver starts a trip on their delivery link, and only while that page stays open, the phone reports its position every forty-five seconds. Only the most recent position is kept — each one replaces the last, so there is no trail of where the driver has been. It is visible to the two parties to that deal and to a Black Diamond Energy administrator, and it stops the moment the load is signed off, the page is closed, or the driver’s phone declines the permission. Declining changes nothing else: the trip and the sign-off work identically and the deal simply shows no live position.

What we never collect

We hold no card numbers, no bank account details and no payment credentials of any kind for sites / buyers, service providers or brokers. The one exception is an investor’s own payout account, described above, which we need in order to pay them. No trading money passes through the Platform: TradeSafe receives, holds and releases all funds under its own terms with you, and its own privacy terms apply to what it holds.

Usage data

Your IP address, browser type, the pages you visit and the time of your visit, collected automatically and used to run and secure the service — including the rate limits that protect the sign-in flow and the driver links from automated abuse.

Cookies

One cookie for everyone: a session cookie that keeps you signed in. It is httpOnly, Secure in production and SameSite=Lax, and it holds a random token rather than anything about you. We use no advertising cookies, no analytics, no social login and no cross-site tracking of any kind.

Broker referral links. If you arrive through a broker’s personal link, a second cookie of ours (referral_code, kept for 30 days) remembers that broker’s code. If you then register as a site / buyer or a service provider, we link your account to that broker, and the registration page tells you which broker it is. The broker sees your company name, whether you are a site / buyer or a service provider and whether your account is approved, and earns a share of the Black Diamond Energy fee on your deals; you pay nothing extra. Tell us at any time if the link is wrong and we will remove it.

POPIA requires a lawful basis for each purpose. Ours are the performance of a contract with you, compliance with our legal obligations, and our legitimate interests in operating a marketplace that is not a vehicle for fraud.

• To verify who you are before you can see a price or trade. A marketplace with unverified counterparties is a marketplace for fraud, which is why vetting is manual and why documents are required.
• To operate your deals: producing the sale agreement, recording each party’s acceptance, generating the settlement breakdown the bank acts on, and recording delivery load by load.
• To contact you by SMS: sign-in codes, approval or rejection of your application, and deal events — a new request, an acceptance, an escrow or guarantee confirmation, a delivery, a release. We do not send marketing SMS.
• To keep the Platform safe: rate limiting, account lockout after repeated failed codes, and an append-only audit log of privileged actions.
• To meet legal and record-keeping obligations.

• The other party to your deal sees your company name and the details of that deal. They do not see your vetting documents (your bank confirmation letter included), and they do not see your mobile number.
• Black Diamond Energy administrators can open your vetting documents during review and can read the message thread on a deal. Every single time a document is opened, that access is recorded with the administrator’s identity and the time.
• The escrow provider. An officer of TradeSafe has a read-only view of deals on the platform, so that it can verify what it is being asked to hold and release before it moves money. That view includes both parties’ registered details — company name, the name of the authorised signatory and the contact mobile number — together with each party’s current bank confirmation letter, the settlement figures, the signed agreement and its fingerprint, and the delivery sign-offs. Every time the officer opens a bank confirmation letter, that access is recorded. This is the point of the arrangement: a bank that cannot verify who it is paying should not be paying anybody.
  What the bank does not get: your vetting document files, the messages on a deal, or any ability to change anything at all. The portal has no write access to any record, which is enforced by the database and not merely by the screens.
• Operators, each under a written agreement and receiving only what they need: SMSPortal (SMS delivery), Cloudflare R2 (private storage of vetting documents), Sentry (error reporting — see clause 6), and our hosting and database provider.
• Public authorities, where we are required by law or valid legal process to disclose.

We do not sell your personal information, and we do not share it with advertisers.

Retention

• Vetting documents belonging to a rejected application are deleted six months after the rejection.
• Deal, agreement, settlement and delivery records are kept for as long as we are required to keep them for legal and accounting purposes. They are the record of a commercial transaction between two parties and are not ours alone to erase.
• The audit log is append-only by design: no role on the system, including ours, can update or delete an entry in it. Driver positions are deliberately not written to it — a location logged every forty-five seconds into a permanent record is the location history this platform has chosen not to keep.
• A driver’s last position is one point, overwritten. It stays on the load record it belongs to, as part of that delivery’s history, and is never accumulated into a trail.
• If you close your account we delete what we are not obliged to retain.

Cross-border transfer

The Platform is hosted outside South Africa — our servers and database are with providers in the European Union, and our document storage, SMS and error reporting operators process requests on their own infrastructure. Where this happens we rely on operators bound to a level of protection substantially similar to POPIA, as section 72 of the Act permits.

• The database enforces who may read what. Row-level security means a member cannot read another member’s deals, documents, messages or phone number even if our application code were wrong — the database refuses. The application connects with a role that cannot bypass those rules.
• Documents are never at a public address. They sit in a private bucket and are served only through a link that expires after five minutes, only to a signed-in administrator, and only after the access has been recorded.
• Sensitive fields are encrypted at the column — driver phone numbers and the message text on a deal — with AES-256-GCM.
• Sign-in is a one-time code with a five-minute expiry, a limit on attempts, and a lockout on the number after repeated failures.
• Error reports are scrubbed before they leave our servers. Phone numbers, driver links, document keys, settlement figures and message content are stripped from an error report before it is transmitted to our error-reporting operator — not filtered afterwards.
• All traffic is encrypted in transit, and the database is not reachable from the internet.

No method of storage or transmission is completely secure. We take the reasonable technical and organisational measures section 19 of POPIA requires; we cannot guarantee absolute security. If a breach is likely to compromise your personal information we will notify the Information Regulator and you as soon as reasonably possible, as section 22 requires.

Under POPIA you may:

• ask what personal information we hold about you, and ask for a copy of it.
• ask us to correct anything that is wrong or out of date.
• ask us to delete information we are not legally required to keep.
• object to processing in certain circumstances, and withdraw consent for anything you consented to.
• complain to the Information Regulator.

There is no self-service export or deletion button yet — we would rather say so than point you at one. To exercise any of these rights, email us at [email protected]. We will respond within a reasonable time, and we may need to verify your identity first.

The Information Regulator (South Africa)

You may complain to the Information Regulator directly. Complaints: [email protected]. Its current postal and physical address and telephone numbers are published at inforegulator.org.za.

Children

The Platform is a commercial marketplace for contracting businesses and is not directed at anyone under 18. We do not knowingly collect personal information from anyone under 18.

Changes to this policy

We may update this policy. Material changes will be notified by SMS or in the platform, and the “last updated” date at the top of this page will change. Changes are effective when posted here.

Links to other sites

TradeSafe operates its own systems under its own terms. When you fund an escrow, the personal information you give them is handled under TradeSafe’s privacy policy and Terms of Service, not this one. We have no control over, and take no responsibility for, the privacy practices of any site or service we are not operating.