Privacy Policy

Widbrook Consulting (Pty) Ltd

Who we are

Widbrook Consulting (Pty) Ltd is the responsible party for the personal information described in this policy.

Registration number: [number]
Physical address: [Physical address]
Postal address: [Postal address]
Address for legal service of documents: [Address for legal service of documents]
Email: hello@widbrook.net
Website: www.widbrook.net

Information Officer: Claire Coustas. Email hello@widbrook.net. Registered with the Information Regulator [under reference / on date].

What this policy covers

This policy explains what personal information we collect through this website and in the course of our work, why we collect it, what we do with it, where it is held and what rights you have. It applies to everyone whose personal information we hold, including individuals and juristic persons. Under the Protection of Personal Information Act 4 of 2013, a company can be a data subject, so information about a client organisation is treated with the same care as information about a person.

The information we collect, and why

If you send us an enquiry. We collect your name, email address, and whatever you choose to tell us in the message. You may also give us your organisation and telephone number; both are optional and the form says so.

We use this to reply to you, to work out whether we can help, and to keep a record of the enquiry. Your enquiry is stored on our website database and a copy is sent to our email so that we can reply to it. Our lawful basis is section 11(1)(b) of POPIA, taking steps at your request before entering into a contract, and section 11(1)(f), our legitimate interest in responding to people who contact us. We do not rely on consent for this, so there is no consent for you to withdraw; if you would rather we deleted the enquiry, ask and we will.

Supplying the information is voluntary. If you do not give us a name and an email address we cannot reply to you.

If you subscribe to our emails. We collect your email address, the date and time you subscribed, the IP address and browser details the subscription came from, and a record of the exact wording you agreed to and that you ticked the box. Our lawful basis is your consent under section 11(1)(a), and the processing is also governed by section 69, which deals with direct marketing by electronic communication.

We keep the record of your consent because the law places the burden of proving it on us. You can withdraw your consent at any time by emailing the Information Officer at hello@widbrook.net, and every email we send will also tell you how to stop them. When you withdraw, we delete your subscription record and keep only your email address and the date on our suppression list, so you are not contacted again by mistake. Before we send anything, we will email you once to confirm your subscription; if you do not confirm within 30 days, we delete your address.

We do not add people who send an enquiry to our mailing list. They are separate systems with separate permissions, because section 15 of POPIA requires further processing to be compatible with the purpose the information was collected for, and marketing is not compatible with replying to a question.

If you become a client. We collect what the engagement requires, which is set out in the engagement letter rather than here, and we process it to perform the contract under section 11(1)(b) and to meet obligations imposed on us by law under section 11(1)(c).

When you simply visit. Cloudflare, which hosts this site, processes the technical information every web request carries, including IP address, browser and the page requested, in order to deliver the site and protect it from attack. We do not keep our own access logs. Our form handler records errors, without the content of any message, for Cloudflare’s standard log retention period. Our analytics tool is described in the cookie notice and does not identify you or store anything on your device.

Who we share it with

We do not sell personal information and we do not share it for anyone else’s marketing.

We use the following service providers, who process information on our instructions under written agreements as required by section 21 of POPIA:

We will also disclose personal information where the law requires it, or where it is necessary to establish, exercise or defend a legal claim.

Where your information is held

Enquiries and newsletter subscriptions are stored on Cloudflare’s D1 database service. Cloudflare does not operate this service in South Africa and there is no African location available. We have set the storage preference to Western Europe, although Cloudflare describes the preference as an indication rather than a guarantee.

This is a transfer of personal information outside South Africa and is governed by section 72 of POPIA. We rely on [section 72(1)(a), the recipient being subject to a law or binding agreement that provides an adequate level of protection / the relevant ground, to be confirmed with our attorney] and on our written agreement with Cloudflare, which requires it to maintain the security measures described in section 19.

Our email is provided by Google, which may also hold it outside South Africa, so emailing us instead of using the form does not keep your enquiry in the country. If you would rather nothing you tell us is held outside South Africa, telephone us, say so at the start of the call, and we will agree with you how any note of the conversation is kept.

How long we keep it

What	How long
Enquiries that do not become work	24 months from the date of the enquiry, then deleted. This includes the copy of each enquiry sent to our email so that we can reply
Client records	As required by the engagement and by law, and no longer
Newsletter subscriptions	Until you unsubscribe
Suppression list, being people who have objected or asked not to be contacted	Indefinitely, holding only the email address and the date of the request, because deleting it would defeat its purpose
Error logs from our form handler, which contain no message content	Cloudflare’s standard log retention period, [period]
Newsletter addresses not confirmed after our first email	30 days from that email, then deleted

How we look after it

We take appropriate technical and organisational measures to protect personal information from loss, damage, unauthorised destruction and unlawful access, as section 19 of POPIA requires.

In practice that means the site runs over HTTPS with strict transport security; access to the systems holding personal information requires two-factor authentication and is limited to Claire Coustas and our website developer, who acts only on our instructions under a written agreement; the form is protected against automated abuse; personal information is not held on local devices or in email folders longer than necessary; and we review these arrangements at least annually.

We are a risk and compliance practice. We take the view that the standard of “generally accepted information security practices” in section 19(3) is higher for us than it would be for most small businesses, and we have built accordingly.

If something goes wrong

If we have reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and the affected data subjects as soon as reasonably possible after discovering it, as section 22 requires. Notification to you will be in writing, by email to the address we hold and, if the circumstances warrant it, by a notice placed prominently on this website. It will describe what we think happened, what we are doing about it and what you can do to protect yourself.

Your rights

You have the right to:

• ask what personal information we hold about you and be given a copy, under section 23;
• ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, under section 24;
• object to processing we carry out on the basis of legitimate interests or the other grounds in section 11(1)(d) to (f), under section 11(3);
• withdraw consent where we rely on it, at any time, under section 11(2)(b);
• object to direct marketing at any time; and
• complain to the Information Regulator.

POPIA prescribes forms for some of these. An objection is made on Form 1 and a request for correction or deletion on Form 2, both under the POPIA Regulations. We will not turn you away for using the wrong form. Write to the Information Officer at hello@widbrook.net and we will help.

We will respond within [period] and in any event within the period the law allows.

The Regulator

Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
PO Box 31533, Braamfontein, Johannesburg, 2017
Complaints: [complaints email, to be confirmed against the Regulator’s current published address]
General: [email]
www.inforegulator.org.za

You may complain to the Regulator at any time, whether or not you have raised the matter with us first. We would rather you told us first, but that is a preference and not a requirement.

Cookies

See our cookie notice, which forms part of this policy.

Changes

We review this policy at least annually and whenever we change how we handle personal information. The version and review date are at the top. Material changes will be notified on this page before they take effect.