Privacy Policy
Mastande is committed to protecting your personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA). This policy explains how we collect, process, store and share your personal information when you use umastande.co.za.
1. Who We Are (Responsible Party)
Mastande is operated by Umastande (Pty) Ltd, CIPC Reg. No. 2026/757331/07. For the purposes of POPIA, we are the Responsible Party.
Information Officer: Thebeyapelo Modise, Chief Executive Officer · privacy@umastande.co.za
Registered address: 16 Mokgatle Street, Kwa Thema, Springs, Gauteng, 1575, South Africa
Registered with the Information Regulator (South Africa) under registration number 2026-067370.
2. Personal Information We Collect
- Identity: full name, ID number (optional), date of birth
- Contact: email address, phone number
- Account: hashed password — never stored in plain text
- Listing data: property details, pricing in ZAR, photographs
- Application data: employment status, income, cover notes
- Financial: billing details processed by Stripe in ZAR — we never store card numbers
3. Lawful Grounds (POPIA Section 11)
| Processing activity | Lawful ground |
|---|---|
| Account management | Contract — s.11(1)(b) |
| Payment processing (ZAR) | Contract — s.11(1)(b) |
| Marketing emails | Consent — s.11(1)(a) |
| Analytics cookies | Consent — s.11(1)(a) |
| WhatsApp notifications | Consent + Contract |
| Fraud prevention | Legitimate interest — s.11(1)(f) |
4. Your POPIA Rights
- Access (s.23): request a copy of all personal information we hold
- Correction (s.24): request correction or deletion of inaccurate data
- Object (s.11(3)): object to processing based on legitimate interest
- Withdraw consent: at any time, without affecting prior processing
- Delete: request deletion of your account and associated data
Email privacy@umastande.co.za — we respond within 30 days (POPIA requirement).
5. Data Retention
Financial records are retained for 5 years in line with the Tax Administration Act 28 of 2011 (SARS requirement). Account data is retained until deletion plus 30 days. Analytics data is anonymised after 2 years.
6. Information Regulator
You have the right to lodge a complaint with the Information Regulator (South Africa):
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001Email: complaints.IR@justice.gov.za · Website: www.inforegulator.org.za