Privacy Policy

Musket Goose (Pty) Ltd is a private company incorporated in the Republic of South Africa. We build and operate software for other companies, and we build products of our own. We work from Cape Town; our registered office is elsewhere in the Western Cape, and both are in the table below.

This notice explains what we do with personal information, and it is written to satisfy section 18 of the Protection of Personal Information Act 4 of 2013 (POPIA). Where POPIA uses the term responsible party, it means the organisation that decides why and how information is processed. For everything described here, that is us.

It covers https://musketgoose.com and the operator platform our team signs in to. It does not cover software we have built for a client and run on their behalf. For that software the client decides what is collected and why, which makes them the responsible party and us the operator. Section 12 below explains what that changes.

POPIA section 11 allows processing on one of several grounds. Consent is only one of them, and for most of what we do it is not the right one: an employer cannot sensibly ask an employee to consent to being paid.

Nothing on the public website requires you to give us anything. You can read every page without telling us who you are.

If you write to us, we need an address to reply to. Without one there is nothing we can do with the message.

If we are working together, some information is genuinely required and some is not. We cannot invoice a company without its billing details, and we cannot pay an employee without their banking and tax details. Where a field is optional we will say so at the time. Where it is required by law, section 3 above names the law.

We do not sell personal information, and we do not share it with anyone for their own marketing.

It reaches other people in only four ways.

• Service providers that run parts of our systems. Each one is named individually, with what it does and where it holds data, at /subprocessors. We keep that list current because a client's due diligence is entitled to a straight answer.
• Professional advisers: our accountants and auditors, and our attorneys where we need advice.
• Government, where the law requires it: SARS, the Companies and Intellectual Property Commission, the Department of Employment and Labour, and the Information Regulator.
• Banks and payment providers, so that money can move.

Most of the services we depend on are not South African, so a good deal of what we hold is processed abroad. POPIA requires us to say so plainly, and to have a proper basis for it.

Today the information reaches United States and the European Union. The database behind the operator platform sits in the United States, and its region is fixed for the life of the project, so employee, payroll, client and financial records are held there. The sub-processor list at /subprocessors says which provider is in which place.

Section 72 of POPIA allows a transfer out of the country where the recipient is bound by an agreement that gives an adequate level of protection and restricts onward transfers, or where the transfer is necessary to perform a contract. We rely on the first of those. Every provider we use contracts on the European Standard Contractual Clauses through its data processing agreement, and each agreement is linked from the sub-processor page.

It is worth being straight about one thing. South Africa has no list of countries it considers adequate, and none of these providers offers a POPIA-specific agreement. What they offer is a European-standard one, which imposes substantially the protections POPIA asks for. That is the safeguard we rely on, rather than any claim that these companies are certified under South African law.

Longer than you might expect, in some cases, because the law says so. Company and tax records are kept for the periods the Companies Act and the Tax Administration Act require, which is generally five to seven years and sometimes longer. Employment records are kept for the periods the labour legislation requires, and contracts are kept for as long as a claim could still be brought on them.

Where no law sets a period, we keep information for as long as there is a reason to, and the reason is usually the relationship itself. Enquiries that go nowhere are deleted when we notice them. Records of work done are kept while the work is supported and for a reasonable period after.

We should be honest about the mechanism. Nothing in the platform deletes personal information on a timer today. Deletion happens when we review a record and act on it, or when you ask us to and we are free to do it. We would rather tell you that than describe an automatic schedule that does not exist. If you want something removed, ask, and section 9 explains how.

No system is perfectly secure, and anyone who tells you otherwise is selling something. What we can say is that these are real controls, that they are tested, and that the section below says what we will do if they are not enough.

If you have found a vulnerability, please tell us. How to do that, and our undertaking not to pursue you for it, are at /security.

• Access to the platform requires an account, and each account carries a role that limits what it can reach. Permission is checked on the server for every request, not only in the interface.
• Passwords are stored as hashes and cannot be read back, by us or by anyone who obtained the database.
• Sessions live in a signed, HttpOnly cookie and are recorded on the server, so a session can be revoked centrally and a password change ends the others.
• Repeated failed sign in attempts are rate limited and locked out.
• IP addresses in audit and session records are hashed before storage.
• Everything is served over HTTPS, and our hosting and database providers encrypt data at rest.
• Credentials for other services are held in the environment and never written to our database.
• Actions taken in the platform are written to an audit log, with sensitive values redacted.
• Access is granted on a least privilege basis and reviewed when someone's role changes or they leave.

POPIA gives you the following rights over information we hold about you. They cost nothing to exercise, apart from a prescribed copying fee in one case noted below.

• Ask whether we hold information about you at all. This confirmation is always free.
• Ask for a copy of it, and for the identities of the third parties who have had access to it. A prescribed fee may apply to the copy itself, and we will give you a written estimate before doing the work.
• Ask us to correct anything inaccurate, irrelevant, excessive, out of date, incomplete or misleading.
• Ask us to delete or destroy information we are no longer entitled to keep.
• Object to processing we carry out on the ground of legitimate interest.
• Withdraw consent, where consent is what we relied on. Withdrawing it does not undo what was lawful before.
• Complain to the Information Regulator, whose details are in section 13.

Section 22 of POPIA requires us to report a security compromise to the Information Regulator and to the people affected, as soon as reasonably possible after we discover it. There is no minimum threshold in the Act, and no seventy two hour clock either: the duty is to move as fast as is reasonable and not to sit on it.

You would be told what happened, what information was involved, what we recommend you do about it, and who caused it if we know. We would tell you directly where we can reach you, and by a prominent notice on this website where we cannot.

If we hold information on behalf of a client, we tell that client immediately, because the duty to notify the people affected is theirs and they cannot discharge it without knowing.

We do not run marketing campaigns, and we do not send bulk email. If that changes, section 69 of POPIA sets the rules and they are strict.

Electronic marketing to somebody who is not already a customer requires their consent, and we may ask for that consent only once. An unsubscribe link is not consent, and the Regulator confirmed as much in the 2025 amendments. Where you are already a customer we may write to you about similar work, and every message will identify us and give you a free way to stop it.

Nothing in this section applies to ordinary correspondence about work we are doing for you.

A large part of what we do is build and run software that holds a client's data. In those systems the client decides what is collected and why. POPIA calls them the responsible party and calls us the operator, and the difference matters to you.

As operator we process only on the client's documented instruction. We do not use their data for our own purposes, we keep it confidential, we secure it as section 19 requires, and we tell the client immediately if we have reason to believe someone has reached it who should not have. Those duties are in a written agreement, which section 21 of POPIA requires and which we sign as a matter of course.

If your information is in a system we run for one of our clients, your rights are exercised against that client rather than against us. Write to us anyway if you are not sure who to ask, and we will point you at the right company rather than leave you to work it out.

Please raise it with us first. Most things are a misunderstanding and we would rather fix it than read about it in a complaint.

You do not have to, though, and you can go to the Information Regulator at any time. A complaint is made on Form 5, it costs nothing, and the Regulator must acknowledge it with a reference number within 14 days.

This is a company website and it is not aimed at children. We do not knowingly collect information about anyone under 18 through it. If you believe we have, write to us and we will delete it.

We link to software we have built for other companies. Those sites are run by our clients or by us on their behalf, under their own privacy notices. A link from here is not an endorsement of what happens there, and this notice stops at our boundary.

We update this notice when what we do changes, and the date at the top of the page tells you when that last happened. Where a change materially affects you we will do more than change the date quietly.

The current sub-processor list, which is the part most likely to change, is at /subprocessors and names 3 providers today.