Privacy Notice

1. Who we are

MAFASA Protection & Intelligence Group (Pty) Ltd ("MAFASA","we", "us") is a private security company registered and operating in South Africa. We are a subsidiary of Idingo Group. PSiRA registration number: 6621136.

As the responsible party for purposes of the Protection of Personal Information Act 4 of 2013 ("POPIA"), MAFASA is committed to protecting the personal information of all data subjects with whom we interact.

2. What information we collect

We collect personal information only when necessary and proportionate to our purpose:

• Enquiry submissions — name, email address, phone number (optional), and the content of your message when you submit our contact form.
• Portal users — email address, display name, and role information for authorised internal staff who access our operations portal.
• Operational records — information required to deliver contracted security services, including staff deployment data, incident reports, and case documentation, collected under lawful authority and client mandate.
• Technical data — IP address, browser type, and access timestamps collected automatically through Firebase Analytics for security and performance monitoring.

3. How we use your information

• To respond to your enquiry and provide the services you have requested.
• To manage our operational and employment relationships.
• To comply with legal and regulatory obligations applicable to private security providers.
• To improve our website and portal through aggregate, anonymised analytics.

We do not sell, trade, or rent your personal information to third parties.

4. Legal basis for processing

We process personal information on the following grounds under POPIA:

• Consent — where you have expressly consented (e.g., by submitting our contact form).
• Legitimate interest — to protect our clients, staff and assets, and to investigate unlawful activity within lawful authority.
• Contractual necessity — to deliver and administer contracted services.
• Legal obligation — to meet our obligations under the Private Security Industry Regulation Act and other applicable legislation.

5. Data storage and security

Personal information is stored on secure, encrypted servers provided by Google Firebase (Firebase Authentication and Cloud Firestore), with data centres in the United States. All access is authenticated, role-restricted and audit-logged. We implement reasonable technical and organisational measures to protect your information against loss, unauthorised access, modification or disclosure.

6. Retention

We retain personal information only for as long as necessary for the purpose it was collected, or as required by law. Enquiry records are retained for 12 months. Operational and employment records are retained for the period required under applicable South African law.

7. Your rights

Under POPIA, you have the right to:

• Request access to personal information we hold about you.
• Request correction of inaccurate personal information.
• Request deletion of personal information (subject to our legal retention obligations).
• Object to processing of your personal information.
• Lodge a complaint with the Information Regulator of South Africa.

To exercise any of these rights, contact us at the address below.

8. Cookies

Our website uses only technically necessary cookies for authentication and session management. We do not use advertising or tracking cookies. Firebase Analytics uses anonymised, aggregate data and does not track individuals across websites.

9. Contact & complaints

For any privacy-related query, correction request, or complaint, please contact our Information Officer via any of the channels below.

You also have the right to lodge a complaint with the Information Regulator of South Africa.