Privacy notice

How the shared demo works, what it stores and the proposed arrangements for real registration.

Draft for ASMRAF review · Version 0.2 · 14 October 2026

Prepared for the South African launch. This document sets out proposed rules; it does not confirm that staff, services or legal arrangements have been put in place.

Download PDF Send feedback

1. Current service and contact

ASMRAF plans to register in Abu Dhabi, United Arab Emirates, and launch operations first in South Africa. Registration has not been completed: the legal name, legal form, registration number, address and accountable privacy contact remain to be confirmed. This notice does not claim that ASMRAF is registered in ADGM or any particular free zone. Contact info@asmraf.org with a privacy enquiry; do not email identity documents. Real mine registration remains closed. The site offers a working demonstration using fictional mine names.

2. What the shared demo stores

The demo asks for a fictional mine name and South Africa as the country. Supabase stores the DEMO code, the labelled mine name, country link, random retry identifier, creation date and expiry date. It does not request or send your name, national ID, passport, contact number, street address or device location. No registration data is kept in browser local storage by this demo. Anyone with the complete demo code and matching mine name can retrieve the limited demo record and use it in the MinePay test journey, so use fictional information only. Opening a MinePay account is a separate process with its own notice.

3. Information proposed for registration

The current design asks for name, national ID or passport number, mine name, country and mine address, with optional contact details afterwards. These would support identity and authority checks, duplicate prevention, mine identification and application updates. Before launch, ASMRAF must document a lawful basis and necessity for each field, including whether a less intrusive identity check can replace retaining the raw number. A consent box alone does not resolve those duties.

4. Access and sharing

Demo data is held in a restricted database schema with a minimal mine-name, code, country and Demo-status mirror in MinePay’s shared registry. Public functions allow creation and code-plus-name lookup of fictional records only; they do not expose a list of registrations or identity data. Demo records do not represent ASMRAF verification. The real-registration design separately keeps identity information in a private schema inaccessible to ordinary website and MinePay users. Individually authorised verification staff and privileged technical administrators would need controlled access. MinePay has no verification authority.

5. Security and international hosting

The connected Supabase project is in the eu-central-1 (Frankfurt) region. Supabase documents encryption in transit and at rest; database privileges and row-level security restrict direct table access. Privileged administrators can read stored values. Hosting and API providers may process IP addresses and security logs to operate the service. Before real collection, confirm operator contracts, backup locations and safeguards for international transfers from South Africa and the UAE. A planned Abu Dhabi entity does not mean data is stored in Abu Dhabi.

6. Retention and your choices

Demo codes stop working in MinePay 30 days after creation. Expiry is not automatic deletion: demo records and linked test history remain until the pilot records are reviewed and removed or anonymised by an administrator. No real identity-data retention period has been approved. Before live registration, publish justified periods and deletion procedures for identity details, verification evidence, contact information, history, logs and backups. If you accidentally enter personal information into the demo name, contact info@asmraf.org with the demo code and request correction or removal; do not send further identity documents by email.

7. Questions and complaints

Send a request headed Privacy to info@asmraf.org with a safe way to reply and a MUCC code if relevant, without attaching ID. ASMRAF must establish proportionate identity checks, an accountable case owner and legal response deadlines before launch. South African complaints can also be raised with the Information Regulator through its official website. Version privacy-2026-10 is a review draft, not an approved notice for live collection; material changes must be versioned and communicated.

8. Applicable privacy arrangements

South African operations require a POPIA assessment. The UAE regime depends on the final entity, place of establishment and activities; ADGM has a distinct data-protection framework. Confirm the applicable regime and responsible entity before real collection. These draft pages do not assert that incorporation or compliance has been completed. No advertising analytics or conversational assistant is configured. External email, WhatsApp sharing and website links use the selected third-party service under its own terms.

Before this document is adopted

Confirm the legal responsible party, Information Officer, mailbox, lawful purposes and bases, hosting and transfer arrangements, retention/deletion schedule and rights-handling process. Complete POPIA review before real registration.

Proposed accountable role: ASMRAF responsible party and Information Officer. Named appointments and an adoption date must be recorded before operation.

References

These references inform the draft. They do not imply endorsement or certification of ASMRAF.

Back to all policies and documents