Privacy Policy and POPIA Notice

Last updated: 15 September 2026. This notice explains, in plain language, what personal information the Master Security platform processes, why, and what your rights are under the Protection of Personal Information Act, 2013 (POPIA).

1. Who is responsible for your information

Master Security is operated by The Weram Group International ("Weram", "we", "us"). Responsibility depends on the kind of information:

• Operational data recorded by a subscribing security company (its staff records, rosters, attendance, patrols, occurrence book entries, incidents and customer records): the security company is the responsible party under POPIA, and Weram processes that information on its behalf as an operator.
• Account and billing data (subscriber company details, user accounts, subscription and payment records, support correspondence): Weram is the responsible party.

If you are a security officer or a customer of a security company that uses Master Security, that company decides what is recorded about you. Direct questions about your record to them first; we will assist them in responding.

2. What we collect

• Account details: names, email addresses, phone numbers, roles and passwords (stored only as strong one-way hashes).
• Officer records: employee details captured by the employer, including PSiRA registration numbers and grades, contact details, next of kin, employment information and credential documents. South African ID numbers, where captured, are stored encrypted.
• Location data: GPS position, accuracy and distance from site, captured at the moment an officer checks in or out of a shift or logs a patrol checkpoint. While a patrol round is open, and only while it is open, the app also records the officer's position about twice a minute, so that the round shows the walk between the points and not only the stops. That trail belongs to the round, is never shown to a customer, and is deleted when the round is deleted. Outside an open patrol round the app does not track officers.
• Operational records: shifts, occurrence book entries, incident reports, inspection results, photos and documents uploaded as evidence.
• Messages: chat messages sent inside the app, the photos and documents attached to them, emoji reactions, and the record of when a message was delivered and read. Section 5 explains who can see them.
• Billing information: subscription plan, invoices and payment confirmations. Card details are handled entirely by PayFast; we never see or store them.
• Support queries: when you send a query through the Get Support page, we keep the email address you gave us, the message you typed, the category you chose, the ticket's status and the dates it was opened, answered and closed, together with every reply our team sends on it. If you were signed in when you sent it, the ticket is linked to your account and company, so that we can help with that account; a query from someone with no account is linked to nothing but the email address. The confirmation we email you carries the ticket number and a link back to the ticket, never the text of your message. Tickets are kept for as long as needed to answer them and to keep a record of what was asked and what we said.
• Technical logs: sign-in events, IP addresses, and an audit trail of significant actions in the system.

3. Why we process it (purposes and lawful basis)

• To provide the service the subscriber contracted for: rostering, attendance, compliance, patrols, incident and occurrence records (performance of a contract).
• To prove compliance and keep reliable operational records, including PSiRA-related credential tracking (legitimate interest and legal obligations of the employer).
• To verify that officers are on site when checking in and patrolling (legitimate interest of the employer and its clients; officers are informed through this notice and their employer).
• To bill subscribers and prevent fraud (performance of a contract and legal obligation).
• To secure the platform and investigate misuse (legitimate interest).
• Where consent is the basis (for example optional communications), you may withdraw it at any time.

4. Sharing and operators we use

We do not sell personal information. We share it only with:

• the subscribing company and the users it authorises (a customer of a security company sees the service figures and today's roster for its own sites, including the names of the officers rostered, its own requests and visitor passes, and otherwise only records that the company deliberately releases or shares with it);
• service providers who help us run the platform: South African web hosting, email delivery, and PayFast for payment processing, each bound to protect the information;
• authorities where the law requires it.

5. Messages, workplace chat and calls

Master Security includes a chat so that officers, managers and client contacts can talk about the work in one place. Please read this section carefully, because it describes monitoring that is deliberate and that we would rather state plainly than bury.

• Messages are stored. What you send in the app, including photos, documents, emoji reactions and the record of when a message was delivered and read, is kept as part of the security company's records. It is not a disappearing chat.
• The company owner can read every conversation in their company, including one-to-one messages between officers. Until 7 September 2026 a notice saying so also sat on top of every conversation in the app. It was taken off the chat screen because it covered a third of a phone on every thread; the monitoring did not change and neither did the duty to disclose it. It is disclosed here, and in the instruction manual for every role, which is linked from the account menu on every page. Companies are told, in the owner's manual, to say it to their people in person as well.
• Managers, officers and client contacts see only the conversations they are part of. Being a manager does not open other people's threads.
• Weram staff can read a company's conversations only during a support session: time-boxed, opened with a written reason, shown to the company in a banner while it is open, and recorded in the audit trail. Outside such a session our staff have no route into your messages.
• The monitoring is itself recorded. Every time an owner or a Weram support person opens a conversation they are not part of, that view is written to the audit trail with the date, the person and the conversation.
• Reviewing is read-only. Someone reading a conversation they are not part of cannot post into it, and their reading does not change the read ticks that the people in the conversation see.
• In-app calling was withdrawn on 7 September 2026. For calls made before that date we retain who called whom, when, how long the call lasted and how it ended. No audio or video was ever captured or stored, by us or by the security company, so there is no recording of any call. Those retained call lines remain visible inside the chat thread they belong to, under the same oversight rules as the messages around them, and the company owner can ask for the record through Support.
• The help assistant. "Ask GenersysAi" answers from a written guide held on our own server. Only when the guide cannot answer with confidence is the question text sent to OpenAI to draft a reply. It is sent without your name, account or company, we do not keep the question, and we record only the size of the exchange to keep the service within its daily limit. Do not put personal or sensitive information in a question; for anything about your own record, use Get Support instead.

Why this is done: to deliver the service the client contracted for and to answer requests raised in the app; to investigate incidents, complaints and disputes about what was reported or instructed and when; to meet the employer's duty to supervise its officers and keep reliable operational records; and to support and protect the platform. The lawful basis is performance of a contract and the legitimate interests of the security company and its clients, and officers and client contacts are informed through this notice and through the instruction manual for their role.

One technical point about the calls made before the withdrawal. A call travelled directly between the two devices rather than through our servers, which meant the two devices exchanged their network addresses with each other, as any internet call does. Those addresses were working detail for a call in progress and never part of its record: the system deleted them the moment the call ended, and a daily maintenance pass clears any left behind by a call that never closed properly. A call can no longer be started, so nothing of the sort is collected now. What remains of calling is the record described above, and nothing else.

This applies to messages sent through Master Security. It does not apply to your personal accounts: the platform cannot see, and we do not read, your WhatsApp, personal email, SMS or anything else outside this app. The practical rule is a simple one. Treat the chat in this app as a work channel that your employer can review, and keep private matters on your own personal channels.

If you believe a conversation was reviewed without good reason, ask your employer for the audit trail entry for it. They can see it, and so can we on request.

6. Retention

Operational records are not deleted because a subscription ends. Occurrence books, incident records, patrol records and attendance histories have to stay reliable over time, so when a subscription is cancelled or lapses, or an account is closed, the company's access to the platform stops but its records are kept. If the company comes back, its records are still there.

After a subscription ends, the security company is still the responsible party for its operational records, and Weram still holds them only on its behalf, as its operator. The company can ask us for a copy of its records at any time. It can also instruct us in writing to delete them, and we will do so, except for anything a law requires to be kept. A person whose information is in those records keeps the rights set out in section 8, including the right to ask for information that is inaccurate, out of date or no longer necessary to be corrected or deleted. That request goes to the security company first, and we assist it.

Account and billing records are not deleted when a subscription ends either. Audit and security logs are kept for as long as needed to protect the platform.

7. How we protect it

• Encryption in transit (HTTPS) and encryption of especially sensitive fields such as ID numbers at rest.
• Passwords stored as strong one-way hashes; optional and, for platform staff, mandatory two-factor authentication.
• Strict role-based access: every record is scoped to the owning company, guards see only their own duties, and customers see only their own sites' service figures and today's roster (with the names of the officers rostered), their own requests and visitor passes, and the records the company releases or shares with them.
• A tamper-resistant audit log of significant actions, and time-boxed, logged support access; our staff cannot browse subscriber data silently.
• Uploaded files stored outside the public web space and served only after permission checks.

8. Your rights under POPIA

You have the right to:

• be told what personal information is held about you;
• request access to it, and ask for correction or deletion of information that is inaccurate, out of date or no longer necessary;
• object to processing in certain circumstances, and withdraw consent where processing is based on consent;
• complain to the Information Regulator if you believe your information is being misused.

To exercise these rights, contact your security company (for operational records) or us at support@mastersecurity.co.za. We respond within a reasonable time and at most within the periods POPIA allows.

Information Regulator (South Africa): inforegulator.org.za

9. Cookies and sessions

The platform uses only the cookies it needs to work: a session cookie to keep you signed in and, if you choose "remember me", a secure token for that device. We do not use advertising or cross-site tracking cookies.

10. Changes to this notice

If we change this notice in a material way we will tell subscribers by email or in the app before the change takes effect. The latest version always lives at this address.

11. Contact us

The Weram Group International, operator of Master Security.
Company registration CK2000/001664/23 · VAT registration 4650259106
POPIA registration 51475/2021-2022/IRRTT
1st Floor, 292 Surrey Avenue, Ferndale, Randburg, 2194, South Africa
Telephone: 087 351 6984
Email: support@mastersecurity.co.za