Privacy Policy
Last updated: 17 August 2026. Written for the Protection of Personal Information Act 4 of 2013 (POPIA). Applies to riseaccess.co.za and the Rise Access app.
- The platform operator is The Weram Group International. Contact: compliance@weram.co.za.
- We collect what we need to run the platform: account details, vehicles and registration numbers, bookings and wash history, chat messages and images, vouchers, crew records, inventory records, usage logs and payment metadata.
- We never store card details. Subscription payments are handled by PayFast.
- Each car wash is the responsible party for its own clients' and crew's records; Weram processes them as its operator.
- Platform activity can be viewed by Weram and by the account-holding car wash for security, quality, support and legal reasons.
- ID numbers are encrypted at rest, passwords are hashed, connections use TLS, and voucher QR codes contain no personal data.
- You have POPIA rights: access, correction, deletion, objection, and complaint to the Information Regulator.
- We use one essential session cookie and no tracking cookies.
- For full legal compliance from Weram, please visit www.weram.co.za and access our compliance in the legal section.
1. Who is responsible for your information
The Rise Access app runs on the Master Wash platform, operated by Weram Graphic and Website Designs trading as The Weram Group, known internationally as The Weram Group International ("Weram", "we", "us"). We are based in South Africa. For anything privacy related, contact compliance@weram.co.za.
POPIA roles are split by who the information belongs to:
- Weram is the responsible party for platform account information: signup details, login records, billing metadata and platform logs.
- Each car wash is the responsible party for the records of its own clients and crew stored on the platform (client details, vehicles, bookings, chat, feedback, vouchers, crew records). For those records Weram acts as the car wash's operator under POPIA, processing them only to provide the service.
If you are a client of a car wash and want to exercise your rights over the records that car wash holds about you, you can contact the car wash directly or contact us and we will pass the request on.
2. What we collect
- Account details: names, email addresses, phone numbers and role, for car wash owners, managers and clients.
- Vehicle details: registration numbers, make, model, colour, size class and an optional nickname, captured by the client or by staff at check-in.
- Bookings and wash history: booking dates and times, services chosen, job progress, prices and payment status recorded by the car wash.
- Chat messages: messages and image attachments sent between a client and the car wash through the platform's chat.
- Compliments and complaints: feedback messages, optional images and the responses given.
- Vouchers: the voucher code, its restrictions, expiry and redemption history. The voucher QR code contains only a random token and no personal information.
- Crew records: crew member names, phone numbers, start dates, attendance records, an optional photo and, where captured by the car wash, South African ID numbers (stored encrypted).
- Inventory records: stock items, levels, refill events and optional supplier, cost and proof-of-purchase images. These are business records but may name the staff member who updated them.
- Usage logs: IP addresses, login times, and a log of significant actions (audit log) for security.
- Payment metadata: subscription amounts, dates, edition and PayFast payment references. Card details are never stored by us. They are entered on and handled by PayFast.
- GenersysAI questions: the text of questions typed to the assistant, kept in a log so we can improve answers.
3. Why we collect it (purposes)
- To create and run accounts and provide the platform's features: bookings, check-in, job tracking, chat, vouchers, crew, inventory and reports.
- To let the car wash find a booking at arrival by name, phone number, vehicle registration or reference.
- To notify clients when their wash is checked in, ready or completed, and to alert staff to new bookings, messages and feedback.
- To bill subscriptions, send renewal reminders and keep financial records.
- To give support and answer questions.
- To keep the platform secure, prevent fraud and abuse (including voucher fraud), and investigate incidents.
- To meet legal obligations, including tax and data protection law.
4. Lawful basis
- Contract: most processing is necessary to provide the service you signed up for.
- Consent: recorded at signup and registration; you may withdraw consent where processing relies on it.
- Legitimate interest: security monitoring, fraud prevention and improving the service, balanced against your rights.
- Legal obligation: keeping financial records and responding to lawful requests.
5. Who else processes your information
We use a small number of operators and third parties, each only for the purpose listed:
- Xneelo (Pty) Ltd, South Africa: hosting of the platform and its data. Data stays in South Africa.
- PayFast (Network International), South Africa: subscription payment processing. PayFast receives the details needed to process the payment, including card details entered on their pages. We only receive payment metadata back.
- OpenAI, processed outside South Africa: only the text of questions typed to the GenersysAI assistant is sent to OpenAI to generate an answer when our built-in knowledge base cannot help. No account passwords, client databases or payment details are sent. This is a cross-border transfer under section 72 of POPIA; OpenAI is bound by contractual terms that provide an adequate level of protection. If you do not want your question text processed outside South Africa, do not use the assistant and email support instead.
We do not sell personal information to anyone. We may disclose information where the law requires it, for example to SARS, a court or a regulator.
6. Platform oversight
The same disclosure appears in our Terms of Service:
Communications, content and activity on the platform may be accessed by the platform operator and by the account-holding car wash for security, quality assurance, support and legal compliance purposes.
This means content inside a car wash account, including chat messages and images, can be viewed by the business that owns the account and by us as the platform operator, only for the purposes listed above. The chat is not end-to-end encrypted and we never claim that it is.
7. How long we keep information
- Account data is kept for as long as the account is active.
- Financial records (payments and related metadata) are kept for 5 years after the tax year they relate to, as required by SARS.
- Crew records that appear in attendance or job history are marked inactive rather than deleted, so the car wash's historical reports stay accurate. Encrypted ID numbers can be removed on request where no law requires us to keep them.
- Redeemed, cancelled and expired vouchers are kept for the car wash's reporting.
- After an account closes, remaining data is deleted or anonymised within a reasonable period, unless a law requires us to keep it longer or it is needed for a legal claim.
8. How we protect it (security measures)
- South African ID numbers on crew records are encrypted at rest with AES-256 encryption.
- All connections to the platform use TLS (HTTPS).
- Passwords are stored only as strong one-way hashes. We cannot read your password.
- Role-based access control with strict account separation: a client sees only their own vehicles, bookings, vouchers and chat, and one car wash can never see another's data.
- The booking calendar shows only how busy a slot is, never who booked it.
- Voucher QR codes carry a random token only, so a scanned or photographed voucher exposes no personal information.
- Audit logs record significant actions so misuse can be detected and investigated.
- Uploaded images are stored outside the public web root and served only to authenticated users with permission.
9. Your rights under POPIA
You may, at any time and free of charge unless the law allows a fee:
- Access: ask what personal information we hold about you and request a copy.
- Correction: ask us to correct or update inaccurate information.
- Deletion: ask us to delete information we are not legally required to keep.
- Objection: object to processing based on legitimate interest, or withdraw consent where processing relies on consent.
Send requests to compliance@weram.co.za. We will respond within a reasonable time and in any event within the periods POPIA allows. If you are not satisfied, you may complain to the Information Regulator (South Africa):
10. Cookies
Rise Access uses one essential session cookie that keeps you signed in securely. It is deleted when your session ends. We use no tracking, advertising or analytics cookies, which is why you do not see a cookie banner.
11. Children
You must be 18 or older to hold an account. We do not knowingly collect children's personal information; if you believe a child's information has been captured, contact us and we will remove it.
12. If something goes wrong (breach notification)
If we have reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and the affected data subjects as soon as reasonably possible, as required by section 22 of POPIA, and tell you what happened and what we are doing about it.
13. Changes to this policy
We may update this policy from time to time. The latest version always lives at this address, with the date at the top. For material changes we will notify account holders by email or a notice in the platform.
