Draft — subject to legal review. This policy has been prepared as a working draft and has not yet been approved by a legal adviser. Items marked “To be confirmed” must be completed before this policy is treated as final.
1. Who we are
This website is operated by MST (Pty) Ltd (“MST”, “we”, “us”), a company registered in South Africa (registration number [To be confirmed: company registration number]). For the purposes of the Protection of Personal Information Act 4 of 2013 (“POPIA”), MST is the responsible party for personal information collected through this website.
Our Information Officer can be contacted at [To be confirmed: Information Officer name and email address]. Our physical address is [To be confirmed: registered business address].
2. Personal information we collect
Information you provide
When you submit an enquiry through our contact form, we collect:
- your full name, work email address and company name;
- the service you are interested in and, optionally, an estimated project budget; and
- the project description and any other information you choose to include in your message.
Please do not include special personal information (such as health information) or information about other individuals in your enquiry unless it is necessary.
Information collected automatically
Like most websites, our hosting infrastructure processes technical information such as your IP address, browser type and the pages requested. We use this information to deliver the website, keep it secure and prevent abuse (for example, limiting repeated form submissions). We do not use advertising or analytics cookies on this website.
3. How we use your information
We process personal information only for specific, lawful purposes, namely to:
- respond to your enquiry and communicate with you about it;
- assess and prepare proposals for services you have asked about;
- maintain records of business correspondence; and
- protect the security and integrity of our website and systems.
We rely on your consent (given when you submit the form), on the need to take steps at your request before concluding a contract, and on our legitimate interests in operating our business securely, as permitted by section 11 of POPIA. We will not use your information for direct marketing unless you have separately agreed to receive it, and you may opt out at any time.
4. Sharing your information
We do not sell personal information. We share it only with service providers (“operators”) that process it on our behalf to run this website and deliver email, such as our website hosting and email delivery providers. These providers are bound by contractual obligations to keep the information confidential and secure, as required by sections 20 and 21 of POPIA. We may also disclose information where required by law.
5. Transfers outside South Africa
Some of our service providers may store or process information on servers located outside South Africa. Where this happens, we take steps to ensure the recipient is subject to laws, binding rules or agreements that provide an adequate level of protection, in accordance with section 72 of POPIA. [To be confirmed: list of hosting and email providers and their data locations]
6. How long we keep information
We keep enquiry information only for as long as needed for the purposes described above, including any resulting business relationship, and thereafter for as long as required by law or for legitimate record keeping. Enquiries that do not lead to an engagement are deleted or de-identified within [To be confirmed: retention period].
7. Security
We apply appropriate, reasonable technical and organisational measures to protect personal information against loss, damage and unauthorised access, including encrypted connections (HTTPS), access controls and restricting access to people who need it. If we become aware of a security compromise affecting your personal information, we will notify you and the Information Regulator as required by section 22 of POPIA.
8. Your rights
Subject to POPIA, you have the right to:
- ask whether we hold personal information about you and request access to it;
- request the correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;
- object to the processing of your personal information on reasonable grounds;
- withdraw your consent at any time, without affecting processing that took place beforehand; and
- lodge a complaint with the Information Regulator.
To exercise these rights, contact our Information Officer using the details in section 1. We may need to verify your identity before responding. Requests for access to records may also be made in terms of our manual under the Promotion of Access to Information Act (PAIA). [To be confirmed: PAIA manual availability]
9. Cookies
This website does not set advertising, tracking or analytics cookies. Any cookies or similar storage used are strictly necessary for the website to function. If this changes, we will update this policy and, where required, ask for your consent first.
10. Children
Our website and services are intended for businesses. We do not knowingly collect personal information from children under the age of 18.
11. Complaints
If you are concerned about how we have handled your personal information, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with the Information Regulator (South Africa). Its current contact details are published at inforegulator.org.za.
12. Changes to this policy
We may update this policy from time to time. The latest version will always be available on this page, with the date it was last updated.