01Who we are
This policy explains how Motion Kulca (Pty) Ltd (“Motion Kulca”, “we”, “us”) collects, uses, shares and protects personal information, as required by the Protection of Personal Information Act 4 of 2013 (POPIA). It applies to motionkulca.co.za, our booking and contact forms, our WhatsApp and email channels, the Motion Kulca client portal, and the services and products we provide.
| Responsible party | Motion Kulca (Pty) Ltd, a private company registered in South Africa |
|---|
| Registration no. | 2015/023575/07 |
| VAT no. | 4830290823 |
| Address | Suite 42 Regus Business Center, Southdowns Ridge Office Park, Irene 0123, South Africa |
| Contact | info@motionkulca.co.za · 087 711 0020 |
02When we are the responsible party, and when we are an operator
Our own clients, prospects and website visitors. When you visit our website, book a slot, ask for a quote, sign a quote or pay us, Motion Kulca decides why and how your information is used. We are the responsible party and this policy applies in full.
People who use a platform we run for a client. Our products, such as Motion VMS (gate access and visitor management, motion.gateaccessapp.com), EduCruze / Motion Fleet (school transport and fleet), Cynergy (pharmacy app), Motion Dispatch and Motion Guard, are used by estates, schools, transport operators, pharmacies and security companies. In most cases that organisation (our client) decides what information is collected about its residents, visitors, learners, parents, drivers, patients or staff, and Motion Kulca processes it on the client’s behalf as an operator under section 21 of POPIA. In that case the client’s own privacy notice applies, and requests about that information should go to the client first. We will help our clients respond.
03Personal information we collect
| Category | Examples | Source |
|---|
| Contact and identity | Name, surname, job title, company, work email, phone and WhatsApp number | Booking and contact forms, email, WhatsApp, calls, meetings |
| Enquiry and booking | Preferred date and time, area of interest, message content, notes from discovery sessions | Booking form, you |
| Client and contract | Company registration and VAT details, billing contact, signed quotes and statements of work (SOWs), project communications | You, during quoting and onboarding |
| Billing and payment | Invoices, payment references, amounts, dates and status; card type and last four digits returned by Paystack or Yoco | Paystack and Yoco (we never receive or store your full card number or CVV) |
| Client portal account | Login email and credentials, subscription plan, billing date, support tickets | Client portal |
| Technical | IP address, browser and device type, pages requested, server and security logs | Our web server and systems |
| Platform data (operator role) | Depends on the product and the client’s set-up, e.g. visitor names, vehicle registrations and QR passes (Motion VMS); learner, parent, driver and trip data (EduCruze); patient and prescription information (Cynergy); incident, patrol and location data (Motion Guard, Motion Dispatch) | Our clients and their users |
Special personal information and children. Some platforms can involve health information (Cynergy) or information about children (EduCruze). We process this only on our client’s documented instructions, where POPIA permits it (for example with consent of a competent person such as a parent or guardian, or under sections 27, 32 and 35 of POPIA)
04Why we use it (purpose and lawful basis)
- To respond to you and prepare a quote: answering enquiries, scheduling discovery sessions, preparing a custom quote or SOW (steps you asked us to take before a contract, POPIA s11(1)(b)).
- To perform our contract: delivering software, apps, AI, cloud, cybersecurity and consulting work, providing product subscriptions, support, invoicing and collecting payment (s11(1)(b)).
- To comply with the law: tax and VAT records, company law, and lawful requests from authorities (s11(1)(c)).
- Our legitimate interests: securing our systems, preventing fraud, handling disputes and chargebacks, and improving our services (s11(1)(f)). You may object to this processing (see your rights).
- With your consent: newsletters and direct marketing (s11(1)(a) and s69), and any other purpose we ask your consent for.
If you do not give us information we need for a quote, contract or payment, we may not be able to provide the service.
05Who we share it with
We do not sell personal information. We share it only where needed, with:
- Payment providers: Paystack (subscriptions and recurring card payments) and Yoco (once-off payments), which process card details on their own PCI-DSS-certified checkouts under their own privacy policies (Paystack, Yoco);
- Hosting, cloud and IT providers that run our website, client portal, products, email and backups;
- Communication tools, for example the email service that delivers our website form messages, and WhatsApp (Meta) when you message us there;
- AI providers: OpenAI, which processes message content when an AI feature or our WhatsApp assistant is used;
- Our professional advisers (auditors, accountants, lawyers) and insurers; and
- Regulators, courts and law enforcement, where the law requires it.
Our current operators (sub-processors) are Paystack (subscription payments), Yoco (once-off payments), our email service provider, EmailJS (website form delivery), Meta Platforms (WhatsApp) and OpenAI (AI features and our WhatsApp assistant), together with the hosting provider described under Hosting and cross-border transfers. Each operator may process personal information only on our instructions and must keep it confidential and secure (POPIA ss20–21).
06Payments and card security
Card payments are made on the secure checkout pages of Paystack (subscriptions) and Yoco (once-off payments). You enter your card details with the payment provider, not on motionkulca.co.za, and we never see or store your full card number or CVV. For subscriptions, Paystack keeps a secure token so it can charge the agreed amount on each billing date; you can stop future charges by cancelling as described in our Refund & Cancellation Policy. All payment pages use encrypted (TLS/HTTPS) connections.
07Cookies and third-party scripts
Our public website does not use advertising cookies. It loads icon and script libraries from content-delivery networks (cdn.jsdelivr.net and code.jquery.com), which receive your IP address and browser details when the page loads. Our booking and contact forms send the details you enter through an email delivery service (EmailJS) to our inbox. The client portal uses a session cookie that is needed to keep you logged in; it will not work if you block it.
If we add analytics tools, we will list them here before they go live.
08How long we keep it
We keep personal information only for as long as we need it for the purposes above, or for longer where the law requires or allows (POPIA s14), for example tax records, or where we need it for a dispute. After that we delete, destroy or de-identify it.
When a client contract for a product ends, we return or delete platform data as agreed in that client’s contract.
09How we protect it
We take reasonable technical and organisational measures (POPIA s19), including encrypted HTTPS connections, role-based access limited to people who need it, regular backups, and access controls and credential protection appropriate to each system, which we continue to strengthen. Card numbers are handled by Paystack and Yoco and are not stored by us.
If we have reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and affected people as section 22 of POPIA requires. Where we are an operator, we will notify our client as soon as reasonably possible so that it can do the same.
10Hosting and cross-border transfers
Our website and client portal run on Motion Kulca’s dedicated Windows server, located in India on a network operated by Ideastack Solutions Private Limited. Hosting arrangements for client product platforms are set out in each client’s agreement.
Cross-border transfer (POPIA s72): because this server is outside South Africa, personal information you submit through our website or client portal is transferred to and stored in India. We make this transfer only as section 72 of POPIA allows, including where it is necessary to perform our contract with you or to take steps you asked for before a contract, or under binding agreements that give the information adequate protection.
Some of our service providers (for example email, cloud, AI or messaging providers) may store or process information outside South Africa. We transfer personal information outside South Africa only as section 72 of POPIA allows, for example where the recipient is bound by laws or binding agreements that give adequate protection, or where you consent or the transfer is needed to perform a contract with you.
11Direct marketing
We send electronic direct marketing (email, SMS or WhatsApp) only to people who have opted in, such as by subscribing to our “Stay in motion” newsletter, or to existing clients about our own similar services, as section 69 of POPIA allows. Every marketing message tells you how to opt out, and opting out is free. Messages about your quote, project, invoices or subscription are service messages, not marketing.
12POPIA: your rights, our Information Officer and the Information Regulator
Your rights
Under POPIA (and the Promotion of Access to Information Act, 2000 (PAIA), for access to records) you may:
- ask whether we hold personal information about you, and ask for a copy or a description of it (s23);
- ask us to correct, update, delete or destroy information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (s24);
- object to processing based on our legitimate interests, and object to direct marketing at any time (s11(3));
- withdraw a consent you gave us (this does not affect processing that happened before you withdrew it);
- not be subject to a decision based solely on automated processing that has a legal or similarly significant effect on you, except as s71 allows; and
- complain to the Information Regulator (s74).
To make a request, email our Information Officer (below). We may need to verify your identity before we act. We do not charge to correct or delete your information; PAIA may allow a prescribed fee for some access requests.
If you are not satisfied with how we have handled your personal information or your request, you may lodge a complaint with the Information Regulator using its prescribed form (POPIA Form 5):
Regulator details checked on inforegulator.org.za/contact-us on 28 October 2026.
13Changes to this policy
We may update this policy from time to time. The current version and its effective date will always be on this page. If we make a material change, we will tell clients by email before it applies.