This policy explains what personal information Quartermaster holds, why, where it's kept, who helps us process it, and what you can ask us to do with it, as the Protection of Personal Information Act (POPIA) requires.
1. Who we are
Quartermaster (the “Service”) is an asset-tracking service owned and run by Vanthor (Pty) Ltd (“Vanthor”, “we”, “us”), a South African company.
- Responsible party: Vanthor (Pty) Ltd, registration number 2026/479520/07, 375 Veronica Rd, Montana, Pretoria, Gauteng, 0182.
- Information Officer: Vanthor's Information Officer is registered with the Information Regulator and can be contacted at [email protected] or 375 Veronica Rd, Montana, Pretoria, Gauteng, 0182.
This policy covers the Quartermaster app at quartermaster.vanthor.co.za, our public pages on the same site, and every customer organisation whose data is hosted on Quartermaster.
It does not cover what a customer organisation does with the personal information it records about its own employees, customers or contacts. That organisation is the responsible party for that information, and we act as its operator (see section 4).
2. Our two roles under POPIA
| Whose information | Our role | Lawful basis |
|---|---|---|
| People who sign up for and use Quartermaster (administrators, asset managers, technicians, viewers) and billing contacts | Responsible party | Needed to provide the Service under our contract (POPIA s11(1)(b)) |
| Visitors to our public pages | Responsible party | Legitimate interest in running the site securely (s11(1)(f)) |
| A customer organisation's own employees, customers and contacts, recorded in Quartermaster | Operator, on the organisation's behalf | Decided by the customer organisation |
3. Information we collect about our users
What we collect
- Your name and email address (your login), from signup or an invitation.
- Your password — stored only as a one-way hash, never in readable form.
- Optional profile details: job title and phone number.
- Your organisation's name, legal name, billing and alert email addresses, and settings.
- Your role in the organisation, and when you last signed in.
- When you accepted these terms, and which version.
- An audit trail of changes made in your organisation (who changed what, and when), and in-app notifications.
- Plan and billing records: your plan, billing cycle, when the paid period ends, and PayFast's references and subscription token for your subscription. We never receive or store card or bank details — you enter those on PayFast's pages.
- Basic request data (IP address, browser, pages requested) in short-lived server logs.
We don't collect precise location, biometric or identity-document information.
Why we use it
- To provide Quartermaster: signing in, permissions, and showing your organisation its own data.
- To send service emails: verification and password resets, account and billing notices, and the alerts and reports your organisation switches on.
- To bill you and manage your plan.
- To keep an audit trail and to secure the Service and investigate misuse.
We don't use your email address for marketing unless you've separately agreed to it, and you can withdraw that consent at any time.
4. Information we process for customer organisations
Organisations use Quartermaster to manage their assets, which means recording information about their own people — mainly the employees assets are assigned or checked out to, and sometimes the customers they lend assets to. This can include names, employee codes, email addresses, phone numbers, job titles, sites and departments, addresses and notes, check-out and reservation history, work-order assignments, signatures given on check-out, uploaded documents, and anything an organisation chooses to put in custom fields.
We store and process this information only on the organisation's instructions — as set out in our Terms of Service, our Data Processing Addendum and the organisation's own settings — and only to provide the Service. The organisation decides what to record and is responsible for having a lawful basis for it and for telling its people.
Quartermaster is built for managing assets, not for sensitive data. We recommend organisations don't record special personal information (such as health, religion or biometric data) in asset records; an organisation that does must have its own lawful basis under POPIA.
5. Where it's kept, and who helps us
Quartermaster's database and uploaded files are stored on a server in South Africa. For now that server is a computer Vanthor runs in Pretoria; we'll update this page when we move to a hosting provider. These services help us run Quartermaster and only get what they need:
| Service | What it does | Information it handles | Where |
|---|---|---|---|
| Cloudflare | Carries every visit to our server securely (HTTPS) and protects it from abuse | IP address, request details, and the content of each request while it passes through | United States and worldwide |
| PayFast | Takes payments for paid plans | Your billing email and the payment details you enter on PayFast's pages; we get back the amount, date and PayFast's references | South Africa |
| Resend | Sends our emails (verification, password resets, billing notices, alerts and reports) | Recipient name and email address, and the content of the email | United States |
Where information leaves South Africa (Cloudflare and Resend), we rely on these providers' data protection agreements, which bind them to protect it adequately, as POPIA section 72 allows.
We don't share personal information with anyone else, except:
- when the law or a court order requires it — and we'll tell the affected organisation unless we're not allowed to;
- with a buyer or successor of our business, who must keep to this policy; or
- with a new service provider, after we've updated this policy and given customer organisations at least 30 days' notice and a chance to object.
We don't sell personal information, and we don't use it for third-party advertising.
6. How long we keep it
| Information | How long |
|---|---|
| Your account and organisation (users, roles, settings) | While the account is open; deleted after the post-closure export window in our Terms of Service |
| Organisation data (assets, employees, customers, check-outs, work orders, documents) and the audit trail | For the life of the account, unless the organisation deletes it sooner; deleted after closure as above |
| Billing and payment records | 5 years, as South African tax law requires |
| Server logs (IP address, browser) | Up to 90 days |
| Backups | Overwritten on a rolling cycle |
We delete information at the end of these periods, or sooner when you ask and we're allowed to.
7. Your rights
Under POPIA you can ask us to:
- tell you what personal information we hold about you, and give you a copy;
- correct information that's wrong;
- delete information we no longer have a lawful reason to keep;
- stop using it for a particular purpose, especially marketing; and
- stop processing based on consent, if you withdraw it.
If you use Quartermaster or visit our site, email [email protected] from the email address linked to your request. We may ask you to sign in to confirm it's you. We'll respond within 30 days. Organisation administrators can also export their data as CSV at any time.
If an organisation recorded your information (for example as an employee assigned a laptop), that organisation is responsible for it — please contact them. If you contact us, we'll pass your request on and act on the organisation's instructions.
If you're unhappy with how we handle your information, please tell us first. You can also complain to the Information Regulator: [email protected], inforegulator.org.za, JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001.
8. Keeping it safe
- Passwords are stored as one-way (bcrypt) hashes.
- Every connection is encrypted (HTTPS), and sign-in uses a signed, HttpOnly session cookie.
- Each organisation's data is kept separate from every other organisation's, and this is tested.
- Role-based permissions control who can see and change what, in the app and the API.
- Uploaded files are never public — they're served only to signed-in users of the right organisation.
- Changes are recorded in an audit trail, and the database is backed up regularly.
- Access to the server is limited to Vanthor.
9. If something goes wrong
If we find that personal information has been accessed or acquired without authority, we'll tell the Information Regulator and the people or organisations affected as soon as reasonably possible — we aim to do so within 72 hours of confirming it — with what happened, what it means for you, and what we're doing about it.
10. Cookies
Quartermaster uses one cookie, to keep you signed in. There are no analytics, advertising or tracking cookies. See our Cookie Notice.
11. Children
Quartermaster is a business tool for people 18 and older. We don't knowingly collect children's information. An organisation that records a child's information must get the consent POPIA requires itself.
12. Changes to this policy
If we make a material change, we'll give at least 30 days' notice by email to account contacts and in the app, and post the new version here with a new date.
13. Contact
- Our Information Officer can be contacted at [email protected]
- Post: Vanthor (Pty) Ltd, 375 Veronica Rd, Montana, Pretoria, Gauteng, 0182
- Information Regulator: inforegulator.org.za — [email protected]