Privacy Notice

Version 1.2 · October 2026

1. Who we are

Meridian Fuel is operated by PULSS Digital Ltd, a company registered in England and Wales. We are the data controller for the information described here — meaning we decide what is collected and why.

Because we are registered in the UK and operate in Zimbabwe, we handle your information under both sets of rules: the UK General Data Protection Regulation, the EU GDPR where processing happens inside the EEA, and Zimbabwe's Cyber and Data Protection Act [Chapter 12:07] together with the regulations POTRAZ enforces. Where the two differ, you get the benefit of the stricter.

We intend to transfer this platform to a Zimbabwean company in the same group. If that happens we will tell you at least 30 days beforehand, and your legal rights will not be reduced.

2. What this notice covers

Everything we collect about you when you use Meridian — whether you are a buyer, a fuel supplier, a transport company, or a driver using our mobile app.

It does not cover what other companies on the platform do with information you give them to complete a deal. When a supplier sells fuel to a buyer, or a transport company accepts a job, each of them decides for itself what to do with what it receives — each is its own data controller, and each is responsible for its own compliance. Your dealings with them are between you and them.

3. What we collect

Everyone who holds an account

• Name, email address, phone number, and your password (stored as a cryptographic hash — we never store or see the password itself)
• Your company's name, registration number, tax number and address
• Records of what you did on the platform and when

Suppliers and transport companies, additionally

• The names, national identity numbers and dates of birth of your directors and of anyone owning 20% or more of your business
• Whether any of those people hold public office (a "politically exposed person")
• Copies of your licences, tax clearances and certificates
• Your bank details, so buyers and carriers know where to pay you
• Details of your trucks and trailers

Buyers, additionally

• Where you want fuel delivered, including a map location you set yourself
• Your order and payment history as recorded on the platform

Drivers, additionally

• Your name, photograph, licence and certificate details
• Your location while you are on a job — see section 5
• Photographs you take at depots and delivery sites, meter and dip readings you enter, and signatures you collect
• A record of your completed jobs, which your employer can see

4. Why we collect it, and our legal basis

| What for | Under UK / EU GDPR | Under Zimbabwe's CDPA |
| --- | --- | --- |
| Running your account and providing the platform | Performance of our contract with you | Necessary to perform the contract |
| Checking you are who you say you are, and screening against international sanctions lists | Legal obligation, and our legitimate interest in not facilitating unlawful trade or financial crime | Statutory obligation, and legitimate interest |
| Recording deliveries, measurements, documents and signatures | Performance of our contract, and our legitimate interest in evidence that settles disputes | Contractual performance, and legitimate interest in resolving disputes |
| Tracking a driver's location during a job | Our legitimate interest, and that of transporters and buyers, in cargo security and delivery verification — see section 5 | Legitimate interest in security and completing the job |
| Sending you emails, texts and app notifications about your orders | Performance of our contract | Carrying out what you asked for |
| Understanding how the platform is used, and finding faults in it | Our legitimate interest in a secure, working platform, using data that does not identify you where we can | Legitimate interest in improving the service |
| Sending your information outside Zimbabwe | Standard Contractual Clauses, or the UK's International Data Transfer Agreement | **Your express, informed consent** — see section 7 |

5. Driver location — stated plainly

If you are a driver, the Meridian app records where the truck is while you are carrying a load. Precisely:

• It records only while you are driving on a job — from when you press Start on the way to the depot until you arrive there, and from when you depart the depot until you arrive at the delivery site. Not while you are loading, not after you arrive, not between jobs, and not on your days off.
• It records only while the app is open. It does not track you in the background or when the app is closed.
• It takes a position about every 20 seconds, and keeps only the most recent one needed to show the load is moving. We do not build a trail of everywhere you have been, and we do not sell or trade movement data.
• Your employer can see it, along with your job timings and your record of completed deliveries. That is the point of it: your employer is responsible for the load you are carrying.
• The buyer sees a limited version — your first name, the truck's registration, and roughly where the load is with an estimated arrival time. They do not get your phone number or your full identity.
• We keep it for as long as the delivery record it belongs to.

You can turn location off on your phone at any time. If you do, the app cannot record where a load is, and your employer may not be able to assign or verify your jobs. We would rather tell you that than pretend otherwise.

6. Who else sees your information

We use other companies to run the platform. They act on our written instructions and may only use your information to provide their service to us. Every one of these is a service the platform actually uses:

| Company | What they do | Where | How the transfer is protected |
| --- | --- | --- | --- |
| **Supabase** | Stores the database, logins and uploaded files | Ireland (EEA) | Adequacy |
| **PowerSync** | Syncs jobs to the driver app so it works offline | United States / EU | Standard Contractual Clauses |
| **Vercel** | Runs the website | United States, and edge locations worldwide | Standard Contractual Clauses |
| **OpenSanctions** | Checks names against international sanctions lists | Germany (EU) | Adequacy |
| **Mapbox** | Turns addresses into map locations, draws the maps, and works out the road ahead and the arrival time shown on the driver's map — for which it receives the truck's position while you are driving | United States | Standard Contractual Clauses |
| **Resend** | Sends our emails | United States | Standard Contractual Clauses |
| **Twilio** | Sends our text messages | United States | Standard Contractual Clauses |
| **Google Firebase** | Delivers notifications to the driver app | United States | Standard Contractual Clauses |
| **Sentry** | Tells us when something breaks | United States | Standard Contractual Clauses |
| **PostHog** | Shows us how the platform is used | United States / EU | Standard Contractual Clauses |

We also share information with other users of the platform where the deal requires it — a supplier sees the buyer they are selling to, a transporter sees the job it accepted, a buyer sees the delivery evidence for its own order. We do not sell, rent or lease your information to anyone, ever, and we do not share it for advertising.

We will share information with the police, a court, or a regulator — including POTRAZ, the UK's Information Commissioner's Office, or a financial intelligence unit — where the law, a court order or a warrant requires it.

7. Your information leaves Zimbabwe

It has to, and you get a separate say in it.

Our database sits in Ireland, and some of the services above run in the United States and elsewhere in Europe. That means your information is transferred out of Zimbabwe.

Under Zimbabwean law, that needs your express and informed consent. We ask for it separately when you sign up, and we set out there exactly where the data goes, who holds it, how it is protected and for how long. It is a distinct question with its own answer, deliberately — not a line buried in this notice.

Under UK and EU law, transfers to countries without an adequacy decision are covered by the European Commission's Standard Contractual Clauses or the UK's International Data Transfer Agreement, as set out in the table above.

8. How long we keep it

We keep information only as long as we need it — to provide the service, to meet legal and tax duties, to settle disputes, and to enforce our contracts.

| What | How long | Why |
| --- | --- | --- |
| Your account and its history | While your account is open, and **seven years** after you close it | Limitation periods and commercial record-keeping |
| Delivery records, measurements, photographs and signed notes | **Seven years** from the delivery | Tax clearance, audit, and settling disputes |
| KYC and sanctions screening records | **At least five years** after our business relationship ends | Anti-money-laundering law |
| Error logs and usage analytics | **Up to two years** | Monitoring and security |

9. Your rights

Depending on where you are, you can ask us to:

• show you what we hold about you
• correct anything that is wrong, incomplete or out of date
• delete it — though see the retention section above; we cannot always agree, and we will tell you plainly why
• stop or restrict using it for a particular purpose, including where we rely on our legitimate interest
• give you a copy in a structured, commonly used, machine-readable form you can take elsewhere
• withdraw your consent where we relied on it — such as the consent to send your information outside Zimbabwe. Withdrawing it does not undo what we did lawfully before you withdrew it.

Ask by emailing the address in section 12. We will respond within 30 days. We will not charge you for a reasonable request, and we will not treat you differently for asking.

If you are unhappy with our answer you can complain to:

• Zimbabwe — POTRAZ, the Data Protection Authority: dpa@potraz.gov.zw
• United Kingdom — the Information Commissioner's Office: ico.org.uk

10. Keeping it safe

• Who can see what. Access is restricted to the people who need it, and the database itself enforces it, so one company on the platform cannot read another's records.
• Encryption. Information is encrypted in transit using TLS 1.3, and at rest using AES-256.
• Documents. Uploaded identity documents, licences and tax certificates sit in private storage that cannot be reached by a public link.

If there is a breach that puts your rights at risk, we will tell POTRAZ within 24 hours as Zimbabwean guidance requires, and the UK's Information Commissioner's Office within 72 hours, and we will tell you directly without undue delay.

11. Changes

If we change this notice in a way that matters, we will tell you at least 30 days beforehand, by email or in the app, and ask you to read it again. Minor corrections we will just make, and the date at the top will change.

12. Contact

Questions, concerns or requests about this notice, or about how we handle your information, go to our Data Protection Officer.

• Data Protection Officer — Evans Edwin Musara
• Email — privacy@pulss.click

The data controller is PULSS Digital Ltd, registered in England and Wales.

• Registered office — 71-75, Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ
• Company number — 16975736