POPIA Compliance v 1.0 · 2026

This statement explains how MComm Technologies (Pty) Ltd, the operator of NextGenSMS, collects, processes, stores and protects personal information in line with the Protection of Personal Information Act, 2013 (POPIA). It applies to all personal information processed through the NextGenSMS platform.

1. Scope

POPIA applies to personal information processed by a responsible party that is domiciled in South Africa, or that processes personal information inside South Africa. NextGenSMS is operated from South Africa and is therefore bound by POPIA in respect of all personal information it processes.

2. Definitions

"Personal information" means any information relating to an identifiable, living natural person, including but not limited to a name, contact number, email address, identity number, location data and online identifiers. "Processing" includes collection, storage, use, dissemination and deletion. "Data subject" means the person to whom personal information relates.

3. What we collect

We collect personal information directly from:

• Account holders: name, email, mobile number, billing address, company name, VAT number where provided, and payment metadata returned by Netcash.
• End recipients of SMS messages you send: mobile number, message content, delivery status, and any reply content captured by long numbers or short codes.
• Visitors to our websites: standard server logs (IP, user agent, referer) and cookies essential for session security.

We do not knowingly collect personal information of children under 18 without verified parental consent.

4. Why we collect it

We process personal information only for purposes that are lawful, reasonable and directly related to running the NextGenSMS platform. These purposes include: account creation and authentication, billing and tax compliance, delivery of SMS messages and replies, fraud and abuse prevention, security monitoring, and the resolution of support requests.

5. Sharing & cross-border

We do not sell or rent personal information. We share it only with: (a) the licensed South African mobile network operators who route SMS traffic, (b) Netcash, our PCI-DSS Level 1 payment gateway, for payment processing, (c) cloud infrastructure providers who host our platform under written processing agreements, and (d) law-enforcement or regulatory bodies when lawfully compelled to do so. Where personal information crosses a South African border for any of these purposes, we take reasonable steps to ensure that the recipient is bound by adequate data-protection obligations.

6. Security

We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, destruction or damage. These include encryption in transit (HTTPS/TLS 1.2+), encryption at rest for stored message content and contact records, role-based access controls on operator and reseller accounts, audit logging of administrative actions, regular vulnerability scans and penetration tests, and staff training on information-handling obligations.

7. Retention

We retain personal information only for as long as needed for the purpose for which it was collected, or as required by law. Account-holder records are retained for the duration of the account and for five years after closure for tax and regulatory purposes. Message content and delivery logs are retained for 24 months unless a shorter retention period is configured on your account. End-recipient contact records are deleted within 30 days of an opt-out request.

8. Your rights

Under POPIA, data subjects have the right to: (a) be told whether we hold their personal information, (b) access that information, (c) request correction or deletion, (d) object to processing, and (e) lodge a complaint with the Information Regulator. End recipients of SMS messages you send should direct opt-out, access and correction requests to you as the responsible sender; we will assist you in fulfilling those requests through our platform's opt-out handling and contact-management tools.

Account holders may exercise any of these rights by contacting our Information Officer using the details below. We will respond within 30 days of receiving a verifiable request.

9. Breach notification

In the event of a security compromise that affects your personal information, we will notify you and the Information Regulator as soon as reasonably possible after we become aware of the compromise, in line with sections 22 and 23 of POPIA and any applicable guidance from the Information Regulator.

10. Contact the Information Officer

If you wish to lodge a complaint with the Regulator

The Information Regulator (South Africa) can be contacted at:

• Physical address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg
• Postal address: P.O. Box 31533, Braamfontein, Johannesburg, 2017
• Website: inforegulator.org.za

This statement is a concept preview. It will be reviewed and signed off by MComm Technologies' Information Officer before public launch.