What we collect, why, who sees it, and your rights.

1. Who is responsible for your information

Firearmdesk is operated by Wayne de Jager, trading as Firearmdesk, at 44 Bosduif Street, George, 6529, which is also the address for legal service. The operating company is registered and its name is being finalised; the registered name and number will appear here once settled. Email support@firearmdesk.co.za.

The Information Officer is Wayne de Jager, reachable at the address above.

2. What we collect and where it comes from

From the referring firm, when it submits a referral: the firm's name, the referrer's name, email address, mobile number, role and internal file reference. Supplying the referrer's contact details and the name of the deceased is required to open a matter; without them we cannot act. Everything else is voluntary at referral and the portal tells you what is needed at each stage.

About the estate: the name of the deceased, the date of death, the Master's reference (the estate's file number at the Master of the High Court), the province, the estimated number of firearms, where they are and who has possession, and which documents exist. Information about a person who has died is estate information rather than personal information in law; we protect it with the same care.

About the executor: name, email address and telephone number, supplied by the referring firm, which acts for the estate. We ask the firm, in its acknowledgement, to tell the executor that the matter has been referred and where this notice is; every email we send, including the executor's invitation, links to it. Executors confirm their details when they first sign in and may correct their name and telephone number in the portal; to change the email address, ask the firm or write to us.

During the matter: letters of executorship or authority, identity evidence of the executor, firearm licences and cards, firearm descriptions, serial numbers and photographs, valuation reports, the executor's signed instruction and, where a sale or transfer follows, the details of the buyer or heir and the account that receives sale proceeds.

Automatically: the IP address, browser type and time of each sign-in, secure-link and signing event, and of the actions you take in the portal, which we record as evidence of who did what and when.

3. Why we use it and on what basis

• To open, administer and close the firearm matter the firm referred: verifying the executor's authority, arranging licensed custody, valuation, the executor's instruction and the closure pack. Basis: the referral by the firm on the estate's behalf, and the duties that the Administration of Estates Act 66 of 1965 and the Firearms Control Act 60 of 2000, with its regulations on dealer and custody records, place on the estate, the executor and the custodian.
• For the executor's details supplied by the firm: the firm's referral on the executor's behalf and the estate's legitimate interest in lawful administration (section 11(1)(f) of POPIA), then the executor's own confirmation once invited.
• To keep the records the law and the estate require: chain-of-custody receipts, the audit trail, invoices and settlement statements. Basis: legal obligation and the legitimate interests of the estate, the firm and the custodian.
• To send status notifications and secure links by email. Basis: performance of the service.
• To protect the platform and its users: sign-in security, rate limiting, malware scanning of uploads and the audit trail. Basis: legitimate interest and legal obligation.

We may contact firms about the service by telephone or post. We email a firm about the service only if it asked, or agreed when we asked once, and every such message says how to opt out. We never market to executors, heirs or buyers. No decision with legal effect is taken about anyone by automated means alone.

4. Who receives it

• The referring firm, for its own matters only.
• The executor, for the matter they are invited to.
• The licensed custody site allocated to the matter, for the firearms it receives, and the valuer briefed on them. They see what they need for their part and never a firm's other matters.
• Buyers, heirs and their licensing steps, only where the executor's signed instruction leads there, and only what that step requires.
• The South African Police Service, the Central Firearms Registry or a court, where the law requires it or the executor's instruction leads to an application. External steps are recorded as waiting states with the evidence of what was submitted.
• Our hosting and email provider (section 6). Providers act on our instructions and do not use the information for their own purposes.

We do not sell personal information, share it with marketers, or use analytics or advertising services on this site.

5. What never goes by email

Notifications are plain text without attachments and carry status and secure links only. Firearm serial numbers, identity numbers, identity documents, photographs and matter documents are held in the platform and viewed there; the templates refuse any variable named for a serial or identity number, so this is enforced by the software as well as by policy. Every email links to this notice.

6. Where it is kept and cross-border transfer

The platform, its database, document storage and email run on a server operated for us by Hetzner Online GmbH in Helsinki, Finland. Hetzner is subject to the General Data Protection Regulation, a law that upholds principles substantially similar to those of POPIA and restricts onward transfer, and processes the information under a written data processing agreement with us (sections 21 and 72(1)(a) of POPIA). Backups are being put in place before the first live matters and will stay with the same provider inside the European Union. Information does not leave that environment except to the recipients in section 4.

7. How it is protected

• Encryption in transit on every connection; documents are served through signed links that expire within minutes.
• Every uploaded file is scanned for malware before any firm, executor or partner user can open it; a file that fails the scan is never served.
• Access is scoped to the firm and the matter on the server, not only in the screen.
• Two-factor verification for administrative, finance, compliance and custody-management roles, with step-up verification for actions that need two people; executors sign in by secure link and one-time code, without a password.
• An append-only audit trail enforced in the database: records are corrected by superseding entries, never edited or deleted in place.
• Internal storage positions and site addresses are seen only by custody-site staff and platform operations; firms and executors see a custody region.
• When a password is set, a partial hash of it is checked against a public breach database (k-anonymity); no personal information is sent.

These controls are as built and described on the security and chain of custody page; an external penetration test will be commissioned before broad rollout.

8. How long we keep it

For as long as the administration of the estate and the record-keeping duties that attach to firearms, custody, invoices and settlement require, and at least five years after the matter closes (ten where the matter is marked for extended retention). The audit trail of a matter is kept for the same period. A retention schedule settled by counsel will be published here; until then nothing is deleted early and nothing is kept without a reason.

9. Cookies

The public site sets no cookies. Signed-in users receive one session cookie, which is essential and is not used for tracking. Staff who choose to remember a browser after two-factor verification receive a second, essential cookie for thirty days. There are no analytics, advertising or social-media cookies.

10. Your rights

You may ask what personal information we hold about you, ask for it to be corrected or, where the law allows, deleted, object to processing based on legitimate interest, and withdraw consent where consent is the basis. Some records must be kept even after an objection, for example a signed instruction or a chain-of-custody receipt, and we will tell you when that applies. Write to the Information Officer at support@firearmdesk.co.za; we respond within the time POPIA allows and usually much sooner.

You may also complain to the Information Regulator (South Africa): Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191; P.O. Box 31533, Braamfontein, 2017; telephone 010 023 5200 or 0800 017 160; complaints through eservices.inforegulator.org.za or POPIAComplaints@inforegulator.org.za; inforegulator.org.za.

11. Changes

We will change this notice when the service or the law changes. Each revision is shown on this page with its date, and account holders are told of a material change by email.