How we protect your personal information under POPIA.
Last updated: 24 August 2026 · Applies to https://themasked.co.za and all services of The Masked House Pty Ltd (Reg. No. 2021/793943/07).
The Masked House Pty Ltd ("we", "us", "our") provides web hosting, domain registration, email hosting and IT services in South Africa. In terms of the Protection of Personal Information Act 4 of 2013 ("POPIA"), we are the Responsible Party for personal information processed through our website, client portal and services.
Information Officer: The Managing Member/Director · legal@themasked.co.za · 021 730 0687
PostNet Suite 26
Private Bag X1
Gansbaai
Western Cape
South Africa
7220
We only collect what we need to provide and bill our services:
Account & billing: name, company name, email address, phone number, billing address, company/VAT registration numbers.
Service data: domain names, hosting account details, support tickets and correspondence, invoices and payment records (we do not store card numbers — card payments are processed by PayFast/Yoco).
Technical data: IP addresses, browser type, login timestamps, server and security logs.
Website: information you submit via the contact form, domain search, or online order forms (hosting, web design and IT service requests) — including your contact details, company information, project requirements and any logo or files you upload.
Migration credentials: if you request a migration and choose to give us login details for your previous service provider, we store those credentials in our internal support system, use them only to perform the migration, restrict access to our technical staff, and recommend you change them as soon as the migration is complete. You may instead choose to provide them later or not at all.
Payment agreements: if you choose monthly auto debit, the recurring payment agreement (tokenised card / debit details) is held by PayFast — we never see or store your card number.
We process personal information to: conclude and perform our service agreements with you (POPIA s11(1)(b)); create and manage your client portal account; provision hosting, domains and email; invoice and collect payment; provide support and respond to tickets; secure our systems, prevent fraud and abuse; comply with legal obligations (e.g. tax and company records — s11(1)(c)); and, with your consent or under legitimate interest, send you service notices about your own services. We do not sell personal information, and we do not send third-party marketing.
Accountability: our Information Officer oversees compliance. Processing limitation: we collect minimal, relevant information, lawfully and with your knowledge. Purpose specification: information is collected for the explicit purposes above. Further processing limitation: we do not use your information for unrelated purposes. Information quality: you can correct your details anytime in the portal. Openness: this policy is our notification under s18. Security safeguards: see section 7. Data subject participation: see section 8.
Only where necessary to deliver the service: payment processors (PayFast, Yoco — they receive payment details you enter on their secure pages); domain registries and registrars (e.g. ZACR for .co.za — registrant details are required to register a domain and may appear in WHOIS records as required by the registry); data centre / network providers hosting our servers; and professional advisers (accountants/auditors) under confidentiality. All operators process under written terms consistent with POPIA s20–21. We disclose information to authorities only where the law requires it.
Our servers are hosted in South Africa. Some domain registries and service providers (e.g. for international domain extensions) are located outside South Africa; transfers to them occur under POPIA s72 — only as necessary to perform your contract, or to jurisdictions with adequate protection.
We protect personal information with, among others: encrypted connections (SSL/TLS) on our website, portal and mail services; hashed passwords (bcrypt) — we can never see your password; one-time PIN (OTP) verification at portal login; firewalls, brute-force protection and security monitoring; role-based access (clients see only their own data); and daily off-server backups. In the event of a data breach affecting your personal information, we will notify the Information Regulator and affected data subjects as required by POPIA s22.
You have the right to: access the personal information we hold about you (s23); correct or update it (s24 — mostly self-service in the portal); request deletion where we are not legally required to retain it; object to processing (s11(3)); withdraw consent where processing is based on consent; and not be subject to unsolicited direct marketing (s69). To exercise any right, email our Information Officer at legal@themasked.co.za. We respond within a reasonable time and may verify your identity first.
If you are not satisfied with our response, you may complain to the Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg · POPIAComplaints@inforegulator.org.za · inforegulator.org.za.
We keep account and billing records for as long as you are a client and thereafter as required by law (tax and accounting records: 5 years; contractual records: 3 years after termination, or longer where a claim may arise). Support tickets are retained for service-history purposes. Backups roll over automatically. When retention ends, records are deleted or de-identified.
Our website uses only strictly-necessary cookies: a session cookie for portal login and a security (CSRF) token. We do not use advertising or third-party tracking cookies. Your browser can block cookies, but the portal will not work without the session cookie.
Our services are aimed at businesses and persons 18 years or older. We do not knowingly process personal information of children without the consent of a competent person (POPIA s34–35).
Requests for access to records under the Promotion of Access to Information Act 2 of 2000 (PAIA) may be directed to our Information Officer at legal@themasked.co.za.
We may update this policy from time to time. The latest version is always published on this page with its date. Material changes will be communicated to portal account holders by email.
