Privacy Policy and POPIA Notice

Last updated: 6 October 2026. This notice explains, in plain language, what personal information the Master Transport platform processes, why, and what your rights are under the Protection of Personal Information Act, 2013 (POPIA). The retention and deletion terms in section 9 apply to existing subscribers from 28 October 2026.

1. Who is responsible for your information

Master Transport is operated by The Weram Group International ("Weram", "we", "us"). Responsibility depends on the kind of information:

• Operational data recorded by a subscribing transport company (its clients, passengers, drivers, vehicles, trips, boarding records, positions, quotes, invoices and messages): the transport company is the responsible party under POPIA, and Weram processes that information on its behalf as an operator.
• Account and billing data (subscriber company details, user logins, subscription and payment records, support tickets): Weram is the responsible party.

If you are a driver, a passenger, a parent or guardian, or a client of a transport company that uses Master Transport, that company decides what is recorded about you. Direct questions about your record to them first; we will assist them in responding.

A company's own web address. Some transport companies use Master Transport at a web address of their own (for example yourcompany.co.za), showing their own name, logo and colours. That is the same platform, run by Weram on Weram's servers, with the same protections, and this notice applies there in full: the company is still the responsible party for its operational records and Weram is still its operator.

2. What we collect

• Login details: names, email addresses, phone numbers, roles, an optional profile photo and passwords (stored only as strong one-way hashes).
• Driver records: details captured by the employer, including driving licence and professional driving permit (PDP) numbers and expiry dates, contact and emergency contact details, a photo, and scanned documents. South African ID numbers, where captured, are stored encrypted.
• Passenger records: names, contact and emergency contact details, pickup and drop-off places, special instructions and, for school transport, the school, grade and guardian details, as captured by the transport company or its client. Many passengers are children; the company and its clients are responsible for capturing only what is needed.
• Trip records: the trip's client, driver, vehicle, stops, planned and actual times, and a timeline of every event on it: check-in, departure, each passenger's boarding and off-boarding with the time and, where permitted, the position, checkpoints, arrival and completion. Each entry says whether it was recorded by a device or estimated by the system.
• Location data: described in section 3.
• Pinned points and saved places: the exact point of a pickup, drop-off, stop or place when somebody drops a pin on the map, uses their phone's location or picks an address search result, how the point was set (on the map, from the phone, by search), how accurate the phone said it was, and the gate, entrance or landmark note written for the driver. Places a client saves for itself (such as Home or Work), with who added each place. Many of these points are homes, often a child's; they are used only to collect and drop off passengers, to guide the driver and to work out how far away the vehicle is.
• Client and money records: clients, bookings, quotes with the approver's typed name and drawn signature, invoices, payments recorded by the office and statements.
• Messages: chat messages sent inside the app, the photos and documents attached to them, reactions, and the record of when a message was delivered and read. Section 6 explains who can see them.
• Ratings and incidents: star ratings and comments a client gives a trip, and incidents logged by a driver or the office, with any photo attached.
• Billing information: subscription plan, tax invoices and payment confirmations. Card details are handled entirely by PayFast; we never see or store them.
• Branding and domain requests: the logo and colours a company uploads for its own branding, and any artwork it sends us. When a company asks for its own domain: the name it wants, whether it already owns the name, what the "Check it" look found, any note it adds, when its owner accepted the three domain terms, and the progress notes our staff keep while setting the domain up.
• Enquiries: the company name, contact person, email address, phone number, fleet size, passenger numbers and message given when someone asks us for a quote. An enquiry an owner sends from inside the app is linked to their company.
• Support queries: the name, email address and phone number you give us, the subject, category and text of your query, the ticket's status and dates, and every reply our team sends. A signed-in person's ticket is linked to their login and company; a query from someone with no account is linked to nothing but the address given. The confirmation we email carries the ticket number and a link, never the text of your message.
• Technical logs: sign-in events, IP addresses, the network block an IP belongs to (for the spam protection on our public forms), and an audit trail of significant actions in the system.

3. Location during a live trip

Journey tracking and the live map are the heart of the product, so they are described here in full.

• When: a driver's position is recorded only while a trip is live (from check-in to completion), only when the transport company has switched tracking on for its account, only when the driver has granted the phone's location permission, and only while the trip screen is open on the driver's phone. Outside a live trip the app does not track anybody. The driver's screen says on it what is being shared, how often, and why sharing paused.
• The screen stays on: during a live trip the trip screen asks the phone to keep the screen on, because a web app can share its location only while that screen is open and in front. The driver can switch this off on the phone ("Let the screen sleep"). When the driver leaves the screen (the screen goes off, a navigation app opens, the screen is closed, or location is switched off) the app records only that sharing paused and why, so the office knows the reason the vehicle stopped moving on the map.
• What and how often: latitude and longitude, the accuracy the phone reported, speed and heading where available, and the time. The phone shares its position every 10 seconds when the vehicle is near a pickup where passengers are waiting (within about 3 km or 10 minutes), at the interval the company chose (15, 30, 60 or 120 seconds) while it is moving, and once a minute while it is standing still or the driver is only checked in, plus whenever the driver records an event such as a passenger boarding. Positions taken where there is no signal are kept on the phone for at most an hour and sent when the signal returns. A position that is too rough (worse than 500 m) is not kept.
• Who sees it: the transport company's office sees the vehicle from check-in to completion. A client sees the vehicle on a live map only on its own trip, only from the moment the driver taps Start trip (never while the driver is only checked in, which can be at the driver's home), only until its own passengers have been dropped off (or, on a trip with no passengers listed, until the vehicle arrives), only while the position is less than 10 minutes old, and only when the company allows it (each company can switch the client live map off). The route a client sees starts at Start trip. The driver sees their own position and their stops. Other clients, other drivers and the public never see it.
• Near-pickup notices: when the company allows it, the client is told once when the vehicle is about 3, 5 or 10 minutes from its pickup, and again when the driver arrives there, by a notification in the app and on the phone.
• Learned places: when a driver arrives at a stop, or boards or off-boards a passenger there, and the stop has no point on the map yet, a position accurate to 50 m or better, taken at that moment, is saved onto that stop's place, so the route gains a real point. It never replaces a point somebody pinned. A driver can also send the spot where they are standing when a pin looks wrong; that report is kept on the trip's timeline and the office decides whether to move the pin.
• How long: position breadcrumbs are deleted automatically after the company's retention period (30, 90 or 180 days; 90 by default). The vehicle's current position on a live trip is kept in a separate record that is deleted 24 hours after the trip ends, and the last known position noted on a finished trip is cleared after the company's retention period (and never sooner than 7 days). The trip's timeline of events (boarded, off-boarded, arrived) is kept as an operational record, with the position of each event where one was recorded.
• Estimates: distances and "about 6 min away" are worked out from the straight-line distance, corrected for the roads, at the usual speed for the time of day, not from live traffic. Every figure says where it comes from ("Estimate", "Road estimate", "Driver says" or "Scheduled"), a position more than 3 minutes old never produces minutes, and the driver's own "running late" message is shown beside the estimate. An estimate is never presented as a recorded fact.

4. Why we process it (purposes and lawful basis)

• To provide the service the subscriber contracted for: planning and running trips, boarding records, journey tracking, quotes, invoices and the client portal (performance of a contract).
• To give clients, including parents and guardians, an honest record of who transported their passengers, whether they boarded, where the journey is and when it will arrive (legitimate interest of the company and its clients, and the safety of passengers).
• To keep reliable operational records and meet the company's legal and contractual obligations, including licence and permit expiry tracking (legitimate interest and legal obligation).
• To bill subscribers and prevent fraud (performance of a contract and legal obligation).
• To secure the platform, stop abuse of the public forms and investigate misuse (legitimate interest).
• Where consent is the basis (for example optional email notifications), you may withdraw it at any time.

5. Sharing and operators we use

We do not sell personal information. We share it only with:

• the subscribing company and the users it authorises. A client of a transport company sees only its own trips, passengers, quotes, invoices and messages, and sees a driver's phone number, photo or rating and a vehicle's photo only when the company has chosen to show them;
• service providers who help us run the platform: South African web hosting, email delivery, PayFast for payment processing and, for the help assistant only, OpenAI (section 8), each bound to protect the information;
• map pictures: on pages that show a map (and only those), your browser loads the map pictures straight from the OpenStreetMap Foundation in the United Kingdom, through its content delivery network. Like any web picture, that request carries your IP address, your browser's details, the address of our site (not the page) and the area of the map on screen, which can show the neighbourhood of a pickup or a school route. No name, trip or booking detail is ever part of it. The map data itself is "© OpenStreetMap contributors". If Weram moves to another map provider (Stadia Maps or Esri), that provider is named here first;
• address search and street names, when Weram switches them on: Geoapify (servers in Germany) and, as a stand-by, openrouteservice run by HeiGIT in Heidelberg, Germany. They receive only the words typed into the search box (text that looks like a phone number, an ID number or an email address is never sent) or a pinned point rounded to about 10 m, and, for road distances, the rounded positions of the vehicle and its next stop. They never receive a name, phone number, trip or booking number, or who is asking. The screen shows which service answered ("Powered by Geoapify"). This is off until Weram has signed Geoapify's data processing agreement. Without it, people drag the map to the spot instead;
• a domain registrar, when we register a company's own domain. We register it in Weram's name with Weram's details, so no personal information about the company's people goes to the registrar. A domain name itself is public, as every domain name is. The "Check it" button sends only the name that was typed to the public domain name system (DNS), to see whether anything already uses it;
• authorities where the law requires it.

Information sent outside South Africa (POPIA section 72). The map pictures come from the United Kingdom, and address search, street names and road distances (when switched on) are answered in Germany. Both are covered by data protection law substantially similar to POPIA (the UK GDPR and the EU GDPR). Geoapify will process the lookups under a written data processing agreement with Weram, which is signed before address search is switched on, and each receives only what is described above, for that purpose only.

6. Messages and chat oversight

Master Transport includes a chat so that the office, drivers and clients can talk about the work in one place. Please read this section carefully, because it describes monitoring that is deliberate and that we would rather state plainly than bury.

• Messages are stored. What you send in the app, including photos, documents, reactions and the record of when a message was delivered and read, is kept as part of the transport company's records. It is not a disappearing chat.
• The company owner and its office staff can read every conversation in their company, including one-to-one messages between drivers and the conversations between a driver and a client. This is disclosed here and in the instruction manual for every role, which is linked from the account menu on every page. Companies are told, in the owner's manual, to say it to their people in person as well.
• Drivers and clients see only the conversations they are part of.
• The oversight is itself recorded. Every time an owner or manager opens a conversation they are not part of, that view is written to the audit trail with the date, the person and the conversation.
• Reviewing is read-only. Someone reading a conversation they are not part of cannot post into it, and their reading does not change the read ticks that the people in the conversation see.
• System messages are posted into a client's conversation by the platform as a trip progresses ("Passenger Thando M. boarded at 06:42."). They repeat what the trip timeline already records.

This applies to messages sent through Master Transport. It does not apply to your personal accounts: the platform cannot see, and we do not read, your WhatsApp, personal email, SMS or anything else outside this app. Treat the chat in this app as a work channel that the company can review, and keep private matters on your own personal channels.

7. Weram support access

Weram staff cannot browse a company's records. The only route into a subscriber's data is a support session: time-boxed (one hour), opened with a written reason, shown to the company in a banner on every page while it is open, and written to the company's audit trail when it starts and ends. Inside a support session Weram staff other than the platform owner are read-only. Outside such a session our staff have no route into your trips, passengers or messages.

The one exception is the company's logo. It is already shown to the company's own clients, on its documents and in its emails, and Weram needs it to set up the company's branding (its app icons and its own web address), so Weram staff may open the logo without a support session. Every time they do, it is recorded in the audit trail. No other file of yours is reached this way.

8. The help assistant

"Ask GenersysAI" answers from a written guide held on our own server. Only when the guide cannot answer with confidence is the text of the question sent to OpenAI to draft a reply, grounded on the same guide. It is sent without your name, login or company, we do not keep the question, and we record only the size of the exchange to keep the service within its daily limit. Do not put personal or sensitive information in a question; for anything about your own record, use Get Support instead.

9. Retention

POPIA says personal information may be kept only for as long as it is needed for the purpose it was collected for. A transport company's operational records (trips and their timelines, boarding records, passengers, clients, drivers, vehicles, quotes, invoices, messages and uploaded files) serve that company's operation, so they are kept while the company has access to the platform.

When a company's access ends, its records are kept for a further 3 months and then deleted permanently, together with the logins of its people and the audit trail of what they did in the app. Access ends when a cancelled subscription reaches the end of the period that was paid for, when the account is suspended or closed, when a trial ends without payment, or when a sign-up is never paid. The company's account owner is warned by email 30 days, 7 days and 1 day before the deletion date, can download the records as spreadsheet files at any time until then (uploaded photos and documents only while the account is active, and for a closed account on request), and can stop the deletion by restoring access. Once deleted, the records cannot be recovered by anybody, including us. The company's branding and domain requests, and the enquiries its owner sent from inside the app, are deleted with them. An enquiry from someone who has no account with us is kept with Weram's sales records until that person asks us to delete it.

Position breadcrumbs are deleted sooner: automatically after the company's position retention period (section 3), whether or not the subscription is running. The vehicle's current position on a live trip is deleted 24 hours after the trip ends, and a finished trip's last known position after the company's position retention period.

Answers from the address search and street-name services are kept for at most 30 days (a failed or empty answer for one hour), at most 50 000 of them, so the same search is not sent twice. They hold only public map facts (a street name and a point), filed under a scrambled key that names no person and no company. Weram also counts how many lookups and map pages each company used each day (numbers only) for 400 days, to keep within the providers' free limits.

The transport company is the responsible party for its operational records, and Weram holds them only on its behalf, as its operator. The company can instruct us in writing to delete them sooner, and we will do so, except for anything a law requires to be kept. A company that has to keep records for longer, for example the invoices it issued, which SARS generally expects a business to keep for five years, must download them before the deletion date. A person whose information is in those records keeps the rights set out in section 11. That request goes to the transport company first, and we assist it.

What Weram keeps after a company's data is deleted, for its own records: the company name, registration and VAT numbers, billing address and email, and the record of the subscription payments the company made to Weram, for as long as tax law requires; and Weram's own record of the account (when access ended and why, the notices sent and when, any hold on the deletion, when a copy was downloaded, and the actions Weram staff took on the account, including the support access log), without the company's records and without the IP addresses of its people. Security logs of the platform itself are kept for as long as needed to protect it. Spam-protection counters on the public forms are deleted after two days.

10. How we protect it

• Encryption in transit (HTTPS) and encryption of especially sensitive fields such as ID numbers at rest. A company's own domain gets its own security certificate and is served over HTTPS in the same way.
• On a company's own domain, only that company's people can sign in. Everybody else is told to sign in at the platform's main address instead, in the same words whether or not the email address has an account.
• Passwords stored as strong one-way hashes; optional and, for platform staff, mandatory two-factor authentication.
• Strict role-based access: every record is scoped to the owning company, a driver sees only the trips allocated to them, and a client sees only its own trips, passengers, documents and messages, and only the driver and vehicle details the company has chosen to release.
• A tamper-resistant audit log of significant actions, and time-boxed, logged support access.
• Uploaded files and signatures stored outside the public web space and served only after permission checks.
• Public forms protected against automated abuse without storing what a visitor typed: only a hash of the email address and the network block of the visitor are kept, for two days.

11. Your rights under POPIA

You have the right to:

• be told what personal information is held about you;
• request access to it, and ask for correction or deletion of information that is inaccurate, out of date or no longer necessary;
• object to processing in certain circumstances, and withdraw consent where processing is based on consent;
• complain to the Information Regulator if you believe your information is being misused.

To exercise these rights, contact your transport company (for operational records) or us at compliance@weram.co.za. We respond within a reasonable time and at most within the periods POPIA allows.

Information Regulator (South Africa): inforegulator.org.za

12. Cookies and sessions

The platform uses only the cookies it needs to work: a session cookie to keep you signed in and, if you choose "keep me signed in", a secure token for that device. The installed app keeps a copy of its own screens on your device so it can open without a signal. We do not use advertising or cross-site tracking cookies.

Map pictures are kept in your browser's own cache, like any picture on the web; the app's offline copy never stores map pictures, positions or live-map answers. A few choices are remembered in your browser's local storage on that device only: "Simple map" on a map, whether the tip on the pin map was already shown, and on a driver's phone "Let the screen sleep", whether the small map is shown, whether to ask before opening a navigation app, and positions that could not be sent yet (at most 60, at most an hour old, deleted once they are sent). Signing out on that phone deletes the driver's items.

Cookies belong to the web address you are using. On a company's own domain the session and the "keep me signed in" token are that domain's own, separate from the platform's main address, and a password reset link asked for there opens there.

13. Changes to this notice

If we change this notice in a material way we will tell subscribers by email or in the app before the change takes effect. The latest version always lives at this address.

14. Contact us

The Weram Group International, operator of Master Transport.
Company registration CK2000/001664/23 · VAT registration 4650259106
POPIA registration 51475/2021-2022/IRRTT
1st Floor, 292 Surrey Avenue, Ferndale, Randburg, 2194, South Africa
Telephone: 087 351 6984
Information officer: compliance@weram.co.za
Support: support@mastertransport.co.za