Privacy Policy

1. Who we are

webdesignco is a business operated by its owner as a sole trader in South Africa. For the personal information described in this policy, which we collect for our own business, we are the "controller" (in UK and EU law) and the "responsible party" (in South African law).

Our privacy team handles all privacy matters and can be contacted at dgdekoker@gmail.com.

2. Our data and our clients' data

This policy covers personal information we handle in two different roles:

• As a controller: information about visitors to our website, people who enquire, and our clients' staff and contacts. This policy applies fully to that information.
• As a processor (or "operator" under POPIA) on behalf of our clients: when we build, host or maintain a client's website, we may have access to personal information belonging to that client, such as enquiries submitted through their website's contact form, their customer details, or their email accounts. We handle this information only on the client's instructions and under our agreement with them. The client is the controller, and its own privacy notice explains how it uses that information.

If you are a customer of one of our clients and have a question about your data, please contact that business directly. We will help them respond to you.

3. Personal information we collect

Depending on how you interact with us, we may collect:

• Contact details: your name, email address, phone number, and business name.
• Enquiry details: what you tell us about your business and what you need.
• Client and project information: content, images and logos, account details and access credentials you share with us, and our correspondence with you.
• Billing information: billing contact details, invoices and records of payments.
• Technical and usage information: pages visited, referring page, approximate location, device and browser type, collected through the analytics described in section 5.

We do not intentionally collect special category (sensitive) personal information. Please do not send it to us unless we ask for it for a specific reason.

4. Contact forms, quotations and communications

When you complete a form on our website, we collect the details you enter, such as your name, email address, phone number and message. If you only enter your email address in a short form, we collect just that. Form submissions are stored in our database and sent to our team by email so that we can reply to you.

If you contact us by email, phone or WhatsApp, we will keep a record of our conversation and the contact details you used. WhatsApp is operated by WhatsApp (part of Meta), and your use of it is governed by WhatsApp's own privacy policy.

We use this information to respond to you, prepare quotations and proposals, and keep a record of our dealings with you.

5. Analytics, cookies and similar technologies

Our website uses Vercel Web Analytics, provided by Vercel Inc., to measure page views and visits in aggregate. Vercel states that its Web Analytics does not use cookies and identifies visits using a hash that resets daily rather than a persistent identifier.

We do not use advertising or remarketing pixels, or tracking cookies, on our website. If this changes, we will update this policy and ask for your consent where the law requires it.

You can control or delete cookies through your browser settings.

6. How we use your information and our lawful bases

We use personal information only where the law allows us to. The list below shows our main purposes and the lawful basis we rely on under UK and EU GDPR. Similar justifications apply under POPIA section 11.

• Replying to enquiries and preparing quotations: steps taken at your request before entering into a contract, or our legitimate interest in responding to business enquiries.
• Providing and managing our services, including invoicing: performance of our contract with you.
• Keeping business and accounting records: compliance with legal obligations.
• Website analytics and improving our services: our legitimate interest in understanding how our website is used. Where cookies require consent, we will rely on your consent.
• Protecting our website from spam and abuse, for example by limiting repeated form submissions: our legitimate interest in keeping our systems secure.
• Sending marketing communications, if we do so: your consent, or, where the law permits, our legitimate interest in contacting existing clients about similar services. You can opt out at any time.

Where we rely on legitimate interests, we have considered whether they are outweighed by your rights. You can ask us for more information about this.

7. Using client information to deliver our services

To provide website design, hosting, SEO, email setup and Google Business Profile services, we may need to:

• use the content and business information you provide in order to build and update your website;
• access your domain, hosting, email, analytics, Google Business Profile or Google Search Console accounts, using credentials or permissions you give us;
• configure contact forms on your website, which may send enquiries from your customers to you or store them on our hosting systems; and
• review analytics and search performance data for your website in order to report on and improve its visibility.

We use this access only for the agreed services. We store credentials securely and ask you to change or remove our access when our services end.

8. Service providers we use

We use trusted third-party providers to run our business. They process personal information on our behalf, under contractual terms, and only for the purposes we specify. Our current providers are:

• Vercel Inc. (United States): website hosting and Web Analytics.
• Supabase Inc. (United States): database for storing website enquiries.
• Resend (United States): delivering email notifications of new enquiries to our team.
• Google LLC (Gmail): our business email, including enquiry notifications.
• WhatsApp (Meta Platforms), if you choose to contact us that way.
• Our bank and any accounting tools we use for invoicing and payments.
• Domain, hosting and email providers we use to deliver services to clients.

9. Sharing and disclosure

We do not sell your personal information. We share it only:

• with the service providers listed in section 8;
• with third-party providers you ask us to work with on your behalf, for example a domain registrar or email provider;
• with professional advisers such as accountants and lawyers, where necessary;
• where the law, a court or a regulator requires us to, or where it is needed to establish, exercise or defend legal claims; and
• with a buyer or successor if our business is sold or restructured, in which case your information will continue to be protected in line with this policy.

10. International data transfers

We serve clients in more than one country, and some of our service providers are based in, or store data in, other countries, including the United States. This means your personal information may be transferred to and processed outside the country where you live, including outside the UK, the European Economic Area and South Africa.

When we make such transfers, we rely on recognised safeguards, such as adequacy decisions, the UK International Data Transfer Agreement or Addendum, the EU Standard Contractual Clauses, or, under POPIA section 72, binding agreements that provide an adequate level of protection. We use the safeguards our providers offer, such as the data processing terms they publish.

11. How long we keep information

We keep personal information only for as long as we need it for the purposes described in this policy:

• Enquiries that do not lead to work: up to 2 years after our last contact.
• Client records and correspondence: for the duration of our relationship and afterwards for as long as tax, accounting and other legal requirements oblige us to keep them, and to deal with any claims.
• Access credentials for client accounts: deleted, or access removed, when the relevant service ends.
• Analytics data: kept according to the provider's retention settings.

When we no longer need information, we delete or anonymise it securely.

12. Data security

We use appropriate technical and organisational measures to protect personal information. These include encrypted connections (HTTPS), access controls that limit data to the people who need it, and well-established infrastructure providers.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a data breach is likely to put your rights at risk, we will notify you and the relevant regulator where the law requires us to.

13. Your privacy rights

Depending on where you live, you may have the right to:

• be told how we use your personal information (as described in this policy);
• access a copy of the personal information we hold about you;
• have inaccurate information corrected;
• have your information deleted, where we have no lawful reason to keep it;
• restrict, or object to, how we use your information, including objecting to direct marketing at any time;
• receive your information in a portable format, where applicable; and
• withdraw consent at any time, where we rely on consent. This does not affect anything we did before you withdrew it.

To use any of these rights, email us at dgdekoker@gmail.com. We may need to confirm your identity before responding. We will reply within one month (UK and EU), or within a reasonable time as required by applicable law. We will not normally charge a fee.

14. UK and EU visitors

If you are in the United Kingdom or the European Union, the UK GDPR, the UK Data Protection Act 2018 or the EU GDPR (as applicable) apply to how we handle your information. The lawful bases we rely on are listed in section 6.

You have the right to complain to a data protection authority. In the UK, this is the Information Commissioner's Office (ico.org.uk). In the EU, it is the supervisory authority in the country where you live or work. We would appreciate the chance to deal with your concern first.

15. South African visitors (POPIA)

If you are in South Africa, the Protection of Personal Information Act 4 of 2013 (POPIA) applies. We process personal information lawfully, for specific purposes, and only to the extent necessary, in line with POPIA's conditions for lawful processing.

You have the rights described in section 13, including the right to object to processing and to direct marketing. You also have the right to complain to the Information Regulator (inforegulator.org.za).

Our Information Officer can be contacted at dgdekoker@gmail.com.

16. Children's privacy

Our services are aimed at businesses. We do not knowingly collect personal information from children under 18. If you believe a child has given us personal information, please contact us and we will delete it.

17. Third-party websites and services

Our website contains links to third-party sites and services, such as WhatsApp and our clients' websites. We are not responsible for their privacy practices, so please read their privacy policies.

18. Changes to this policy

We may update this policy when our practices or the law change. The date at the top of the page shows when it was last updated. If we make significant changes, we will tell clients by email.

19. Contact us

For any privacy question or request, please contact:

• Email: dgdekoker@gmail.com
• Phone: 072 445 8957