POPIA Compliance Statement

Last Updated: 29 March 2026

This statement outlines how Son Security Systems (Pty) Ltd, trading as FieldMaster X, complies with the Protection of Personal Information Act 4 of 2013 (POPIA), South Africa's primary data protection legislation. POPIA came into full effect on 1 July 2021 and sets minimum standards for how organisations collect, process, store, share, and destroy personal information.

1. Our Commitment

FieldMaster X is committed to processing personal information lawfully, fairly, and in a transparent manner in compliance with POPIA. We have designated an Information Officer responsible for ensuring that our data processing practices meet the eight conditions for the lawful processing of personal information as set out in POPIA.

These eight conditions are: Accountability, Processing Limitation, Purpose Specification, Further Processing Limitation, Information Quality, Openness, Security Safeguards, and Data Subject Participation. All of our data processing activities are designed to satisfy each of these conditions.

We have registered our Information Officer with the Information Regulator of South Africa as required by POPIA. Our Information Officer is responsible for managing all POPIA compliance matters, responding to data subject requests, and liaising with the Information Regulator where required.

2. Personal Information We Collect

As a responsible party, we collect and process personal information in the following categories:

Identity information: full names, email addresses, and phone numbers of subscribers, administrators, and technicians.
Location information: GPS coordinates of technicians during active job assignments. Location data is collected only with the technician's knowledge and is limited to working hours.
Client information entered by subscribers: FieldMaster X acts as an operator when processing personal information that our subscribers (tenants) enter about their own clients. Subscribers are the responsible parties for this data.
Financial information: subscription billing records including payment method details (processed by our payment gateway; we do not store full card numbers).
Device and usage data: IP addresses, browser types, and usage logs for security and service improvement purposes.

We do not collect special personal information (as defined in Section 26 of POPIA) such as health data, biometric data, or criminal records, and we do not process personal information of children under the age of 18.

3. Purpose of Processing

We process personal information only for the following specific, explicit, and legitimate purposes:

Creating and managing user accounts and providing access to the Service.
Enabling job dispatch, real-time technician tracking, and job completion workflows.
Sending transactional communications including job notifications, invoice emails, and technician onboarding invitations.
Processing subscription payments and maintaining billing records.
Detecting, preventing, and responding to security incidents and fraudulent activity.
Complying with legal obligations under South African law including tax and financial record-keeping requirements.

We do not process personal information for direct marketing without the explicit consent of the data subject. We do not use personal information for profiling or automated decision-making that has a legal or similarly significant effect on any individual.

4. How We Protect Your Information

We have implemented appropriate technical and organisational measures to safeguard personal information against loss, damage, unauthorised access, disclosure, or destruction. These measures include:

Encryption at rest: all data stored in our Supabase database (hosted in the EU on AWS Frankfurt) is encrypted using AES-256.
Encryption in transit: all data transmitted between our platform and users is encrypted using TLS 1.2 or higher.
Access controls: row-level security (RLS) policies ensure that each subscriber's data is logically isolated. Production access requires multi-factor authentication.
Least-privilege access: our staff are granted access to personal information only to the extent necessary to perform their job functions.
Security monitoring: we log and monitor access to personal information and review logs for anomalous activity.
Incident response: we maintain a documented incident response plan. In the event of a data breach, we will notify the Information Regulator and affected data subjects within 72 hours of becoming aware of the breach, as required by POPIA.

5. Your Rights Under POPIA

As a data subject under POPIA, you have the following rights regarding your personal information. To exercise any of these rights, contact our Information Officer at privacy@fieldmaster-x.co.za. We will respond within 30 days.

Right of Access

You have the right to request confirmation of whether we hold personal information about you and to receive a copy of that information.

Right to Correction

You have the right to request that we correct or update personal information that is inaccurate, incomplete, misleading, or out of date.

Right to Deletion

You have the right to request that we delete or destroy personal information we hold about you, subject to any legal obligations that require us to retain it (such as tax and financial record-keeping laws).

Right to Object

You have the right to object to the processing of your personal information on grounds relating to your particular situation, where processing is based on our legitimate interests.

Right to Withdraw Consent

Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

6. Data Retention Policy

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Our retention schedule is:

Active subscriber accounts: retained for the duration of the subscription and for 90 days following cancellation.
Financial and invoicing records: retained for 5 years as required by the South African Income Tax Act and Companies Act.
GPS location history: automatically deleted after 90 days.
Job records and completed reports: retained for 5 years for warranty and dispute resolution purposes.
Audit and access logs: retained for 12 months.
Deleted accounts: all non-legally-required personal information is permanently deleted 90 days after account cancellation.

When retention periods expire, personal information is securely and irreversibly deleted or anonymised. We do not archive personal information indefinitely.

7. Cross-Border Transfers

FieldMaster X uses third-party infrastructure and service providers that process personal information outside of South Africa. Under POPIA, cross-border transfers of personal information are only permitted to countries, organisations, or persons that have an adequate level of data protection in place.

Our data is processed by the following third parties outside South Africa:

Supabase — EU (AWS Frankfurt, Germany). The EU is widely recognised as providing adequate data protection standards comparable to POPIA.
Vercel — USA. Processing is governed by a Data Processing Agreement aligned with GDPR and equivalent international standards.
SendGrid / Twilio — USA. Processing is governed by GDPR-aligned Data Processing Agreements.
Google Maps Platform — USA. Address query strings only; no personal identifiers are transferred.

By using FieldMaster X, you consent to these cross-border transfers to the extent required by POPIA Section 72.

8. Complaints & the Information Regulator

If you believe that FieldMaster X has processed your personal information in violation of POPIA, you have the right to lodge a complaint with the Information Regulator of South Africa at:

Information Regulator (South Africa)
Website: https://www.justice.gov.za/inforeg/
Email: inforeg@justice.gov.za
Physical address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

We encourage you to contact us first at privacy@fieldmaster-x.co.za so that we can attempt to resolve the matter directly. We take all complaints seriously and will investigate and respond within 30 days.

9. Contact Our Information Officer

All POPIA-related enquiries, data subject requests, and complaints should be directed to our Information Officer:

Information Officer
Son Security Systems (Pty) Ltd t/a FieldMaster X
Email: privacy@fieldmaster-x.co.za
Postal address: [Physical Address], South Africa
Website: www.fieldmaster-x.co.za

Our Information Officer has been registered with the Information Regulator as required by POPIA Section 55. The registration certificate is available on request.