Data & Privacy Notice

This Data & Privacy Notice applies across the main MJW Group website, all MJW Group subdomains, all current and future applications — including Notara, Obstrata, Ledgera, Vaulta, and any future app, portal, dashboard, software product, beta environment, hosted tool, or digital service — and all dashboards, portals, hosted services, and digital products operated by MJW Group.

The MJW Group ecosystem may process the following categories of personal and operational information:

• Identity information (name, surname, ID number where applicable)
• Contact details (email address, telephone number, physical address)
• Account information (username, login credentials, profile details)
• Billing information (payment details, invoices, subscription records)
• Support records (queries, correspondence, feedback)
• Technical data (IP address, browser type, operating system, device identifiers)
• Device and usage logs (access times, feature usage, session data, navigation patterns)
• Uploaded files (documents, images, records, attachments)
• Workflow records (tasks, actions, assignments, status updates)
• Operational data (reports, dashboards, metrics, configuration settings)
• Business records (financial entries, property records, tenant data, inspection logs)
• Other information submitted through the platforms by users

Information may be collected through:

• Direct user input during registration, onboarding, or account setup
• User submissions, uploads, and form entries
• Communications with MJW Group (email, support, feedback)
• Cookies, local storage, and session management tools
• Analytics and performance monitoring services
• Platform usage, feature interaction, and navigation patterns
• Administrator actions and configuration changes
• Integrations with third-party services
• System and platform logs

Personal information may be processed for the following purposes:

• Operating, maintaining, and improving the platforms
• Creating and administering user accounts
• Authenticating users and managing access controls
• Providing technical and customer support
• Processing subscriptions, payments, and billing
• Delivering requested features, services, and functionality
• Improving service quality, performance, and user experience
• Monitoring security, detecting threats, and preventing misuse
• Enforcing agreements, policies, and terms
• Complying with legal, regulatory, and statutory obligations

The processing of personal information may rely on one or more of the following lawful bases, as applicable under the Protection of Personal Information Act (POPIA) and other relevant legislation:

• Consent — where the user has given clear and voluntary consent
• Contract — where processing is necessary to perform or enter into an agreement
• Legal obligation — where processing is required by law or regulation
• Legitimate interests — where processing is necessary for the legitimate interests of MJW Group, provided such interests are not overridden by the rights and interests of the data subject
• Protection of legitimate interests — where processing is necessary to protect the legitimate interests of the data subject or another natural person

MJW Group platforms may use cookies, local storage, session management tools, diagnostics, and analytics technologies for authentication, session persistence, user preferences, performance measurement, service quality improvement, diagnostics, and security purposes. Users may manage cookie preferences through their browser settings, though disabling certain cookies may affect platform functionality.

Personal information may be shared with the following categories of recipients where reasonably necessary and lawful:

• Hosting and cloud infrastructure providers
• Storage and backup service providers
• Analytics and performance monitoring providers
• Payment processors and billing services
• Communication and notification providers
• Customer support tools and providers
• Contractors, consultants, and technical advisers
• Professional advisers (legal, accounting, audit)
• Regulators and law enforcement where required by law
• Integration partners where the user has enabled such integrations

MJW Group does not sell personal information to third parties.

Some service providers, infrastructure components, or integration partners may be located outside the Republic of South Africa. Where personal information is transferred to a jurisdiction outside South Africa, MJW Group takes reasonable steps to ensure that such transfers are conducted in accordance with applicable data protection legislation, including but not limited to the requirements of POPIA regarding transborder information flows.

MJW Group implements reasonable technical and organisational safeguards to protect personal information, including but not limited to:

• Access controls and authentication mechanisms
• Encrypted connections (TLS/SSL) for data in transit
• Encryption at rest for stored data where appropriate
• System logs and audit trails
• Regular backups and disaster recovery procedures
• Role-based permissions and least-privilege access principles
• Environment separation and secure deployment practices

No system, network, or transmission method can be guaranteed to be absolutely secure. Users are encouraged to protect their own credentials and report any suspected security incidents promptly.

Personal information is retained only for as long as reasonably necessary to fulfil the purposes for which it was collected, including service delivery, compliance with legal and regulatory obligations, security, backups, dispute resolution, and operational continuity. When personal information is no longer required, it will be securely deleted, anonymised, or de-identified in accordance with applicable law and internal retention policies.

Where users upload, submit, manage, or store information relating to other individuals through any MJW Group platform — including but not limited to tenant records, patient records, family data, employee data, customer data, or other third-party personal information — users are solely responsible for ensuring they have lawful authority, notice, consent, or mandate to process such information. MJW Group processes such information on behalf of the user and relies on the user's representations regarding lawful authority.

Subject to applicable law, users and data subjects may have the right to:

• Request access to personal information held about them
• Request correction of inaccurate or incomplete personal information
• Object to the processing of personal information on reasonable grounds
• Request deletion of personal information where lawfully permitted
• Withdraw consent where consent was the basis for processing

Requests may be submitted to info@mjwgroup.co.za. MJW Group will respond to valid requests within a reasonable period and in accordance with applicable law.

MJW Group does not knowingly collect personal information from children under the age of 18, except where a specific product explicitly permits it and a lawful basis exists or an authorised responsible person (such as a parent or legal guardian) has provided consent. Where MJW Group becomes aware that children's personal information has been collected without appropriate authorisation, reasonable steps will be taken to delete such information.

Users must not upload, submit, or store special or sensitive personal information — including but not limited to health information, biometric data, religious or philosophical beliefs, political opinions, trade union membership, sexual orientation, or criminal records — through any MJW Group platform without a lawful basis and proper authority. Where a specific product is designed to handle such information (for example, a health management platform), the product-specific terms and safeguards apply in addition to this notice.

MJW Group may send service-related notices, administrative communications, and operational updates as necessary for the administration and operation of the platforms. Any marketing communications will be handled in accordance with applicable law, including the provision of opt-out mechanisms where required. Users may opt out of marketing communications at any time by following the unsubscribe instructions provided or by contacting MJW Group.

Where a personal information security incident occurs and notification is legally required, MJW Group will take reasonable steps to notify affected parties and the relevant regulatory authority in accordance with the requirements of POPIA and other applicable legislation. Notification will include, where possible, a description of the incident, the categories of information affected, and the steps being taken to address the incident.

This Data & Privacy Notice may be updated, revised, or amended from time to time. The latest published version shall apply from its stated effective date. Material changes will be communicated where practicable. Users are encouraged to review this notice periodically to remain informed of how their personal information is handled.

For any data or privacy enquiries, contact us at info@mjwgroup.co.za.