MassTrail
View demoApply

Effective 5 November 2026

Privacy, field evidence and accountable use.

This notice explains the information MassTrail handles, why it is needed, who can receive it and how to exercise a privacy right.

Use the right channel. The public contact form is for business contact details and an enquiry. Do not submit passwords, identity documents, customer files, vehicle records or production evidence there; we will arrange a protected channel when required.

1. Who this notice covers

This notice is intended to cover customer administrators and users, site operators, drivers and field actors, counterparty responders, independent reviewers, supplier/installer contacts, support contacts and public-site visitors whose personal information is processed through MassTrail.

Responsible party: for customer programme data, the customer identified in the relevant Order Form ordinarily determines the purpose and means, with MASSTRAIL (PTY) LTD (2026/877160/07), trading as MassTrail, acting as operator. MASSTRAIL (PTY) LTD is responsible party for its own website enquiries, contracts, accounts, security and billing records.

Information Officer: Dr Therry Martins · privacy@masstrail.co.za · +27 78 716 0366 · Helderkruin, Gauteng, South Africa 1724.

2. Our role and the customer’s role

For customer programme, evidence and user data, the customer will ordinarily determine why the data is processed and will ordinarily be the responsible party; MassTrail will ordinarily act as its operator under written instructions. MassTrail is expected to be the responsible party for public enquiries, account administration, security, billing, service telemetry, product communications and its own legal obligations. The signed order form and data-processing schedule must resolve the role for each data set and prevail over this summary.

3. Information we expect to process

MassTrail is not designed to collect national identity numbers, biometrics, bank credentials, private household details, health information, children’s information or worker income merely because an upstream system contains them. Customers must remove fields that are not required for the agreed purpose.

4. Where information comes from

Information may come directly from the individual; the customer or its source systems; an assigned origin, receiver, hauler, recycler or reviewer; a registered device or approved supplier interface; and security/hosting systems that operate the service. MassTrail does not scrape or buy contact profiles for the evidence product.

5. Why information is processed

The responsible party must document the applicable POPIA justification for each production purpose. Consent will not be used as a convenient substitute where the real basis is contract, law or a properly assessed legitimate interest.

6. Camera, plate, location and workplace evidence

ProofLens and ProofMove can involve vehicle registrations, images, location and workplace activity. They may be enabled only for a documented, proportionate purpose with appropriate signage/notice, labour and counterparty consultation where required, event-level collection where feasible, role-restricted playback, access logging and a specific retention rule. Location corroborates route movement; it does not prove contents or reported mass.

7. OCR, models and human decisions

OCR and anomaly functions produce suggestions. MassTrail retains the model and version, confidence, suggested value and human action. It does not silently alter evidence or make an autonomous fraud, employment, payment, legal or assurance decision about a person.

8. Recipients and sub-processors

Authorised customer users, assigned counterparties and reviewers receive only the access their role and organisation permit. Approved MassTrail personnel may access restricted diagnostics under a time-bound, audited support process. Information may also be processed by contracted hosting, identity, email, malware-scanning, monitoring and support providers under written safeguards.

The sub-processor register names the providers, purposes and locations used for the relevant service. Customer contracts include a provider-change notice and objection process.

9. International transfers and hosting

MassTrail uses South African primary application regions where the selected service supports them. Some communications, analytics, support or provider control-plane services may process limited information elsewhere. A transfer is used only where the applicable POPIA section 72 basis, contractual safeguards, data categories and instructions are recorded.

10. Retention, correction and deletion

Retention is set by evidence type, customer contract, reporting/legal obligations, disputes and legal holds. Account/security logs, field media, location, source payloads, close records and support cases do not share one blanket period. The applicable customer schedule states each period and trigger.

Evidence corrections append a linked event; a locked close is never overwritten. This integrity rule does not eliminate data-subject rights. Where deletion is legally required but an evidential record must remain, the responsible party must determine whether restriction, de-identification or another lawful treatment satisfies both duties.

11. Security safeguards

The service uses organisation membership, least privilege, database and object-layer tenant isolation, MFA/SSO, encrypted transport, restricted support access, immutable originals, signed exports, security logging, dependency/secret scanning, backups and incident procedures. No internet service can promise absolute security. The customer Security Schedule and DPA allocate detailed controls and compromise responsibilities.

12. Your choices and POPIA rights

Subject to applicable law and verification of identity, a data subject may ask whether information is held, request access or correction, request deletion or restriction, object to certain processing, withdraw consent where consent is the basis, and complain to the responsible party or Information Regulator. Customer-controlled programme requests should normally be directed first to that customer; MassTrail will assist it as operator.

The Information Regulator lists general enquiries at enquiries@inforegulator.org.za, POPIA complaints at POPIAComplaints@inforegulator.org.za and telephone 010 023 5200 / 0800 017 160.

13. Required information and consequences

Some account and source fields are required to provide the contracted workflow or preserve attribution. Optional fields will be labelled. Refusing a required field may prevent account creation, evidence classification, a control, close approval or access to an assigned request; it must not cause an undisclosed downgrade or invented observation.

14. Children and vulnerable people

The service is a business tool for authorised adults and is not directed at children. Reclaimer or worker programmes involving vulnerable people require enhanced minimisation, fair notice, non-coercive capture and a documented impact and prior-authorisation assessment where applicable.

15. Cookies and public-site analytics

The current build does not deploy advertising trackers. Protected-workspace authentication uses strictly necessary session/security technology. Any optional analytics or marketing technology must be listed by name and purpose and, where required, held until a valid choice is recorded. See the cookie notice.

16. Changes and contact

Material changes will be notified through the service or contractual channel before they take effect where required. Contact privacy@masstrail.co.za or use the privacy-request contact route; do not attach identity evidence to the public form.