DRAFT. Have this notice reviewed by a South African attorney before publishing, fill in every highlighted field, then delete this box.
01Who we are
Dynepta (“we”, “us”) is the responsible party for the personal information described in this notice. Our details are:
- Registered name
- [Registered company name]
- Registration number
- [CIPC registration number]
- Physical address
- [Physical business address]
- hello@dynepta.com
- Phone
- [+27 phone number]
- Information Officer
- [Full name], [privacy@ email address]
Our Information Officer is registered with the Information Regulator and is responsible for our compliance with POPIA and the Promotion of Access to Information Act 2 of 2000 (PAIA). Send any question or request about your personal information to them.
02What this notice covers
This notice covers personal information we process for our own purposes, about:
- visitors to this website;
- people who contact us or ask for a discovery call;
- contact people at our clients, prospective clients and suppliers.
Our clients’ data is different. When we build and run a data platform for a client, that client is the responsible party for the personal information in it and we act as their operator, processing it only on their written instructions. That data stays in the client’s own Google Cloud organisation. If your information is held in one of our clients’ platforms, please contact that organisation. See Client data protection for how we handle it.
03What we collect and where it comes from
| Category | Information | Source |
|---|---|---|
| Enquiries | Name, email address, phone number, company, job title and anything you tell us in your message. | You, when you email or call us. |
| Client and supplier relationships | Business contact details, contract records, billing and payment details, meeting notes and correspondence. | You or your employer. |
| Website technical data | IP address, browser and device type, pages requested, date and time of the request. | Collected automatically in the server logs of our website host. |
| Font requests | IP address and browser information. | Sent by your browser to Google Fonts when it loads this site’s typeface. |
| Website analytics (only with your consent) | Pages viewed, how you arrived, approximate location, browser and device type, and cookie identifiers. | Collected by Google Analytics, on our behalf, if you accept analytics cookies. |
We do not ask for special personal information (such as health, religious or biometric information) or information about children through this website. Please do not send it to us.
Is providing information voluntary?
Yes. You choose what to send us. If you do not give us contact details we cannot reply to you, and if you become a client we need certain details to enter into a contract and to invoice you as tax law requires.
04Why we use it, and on what basis
| Purpose | Lawful basis under POPIA section 11 |
|---|---|
| Replying to your enquiry and arranging a discovery call | Steps you asked us to take before entering into a contract, s11(1)(b), and our legitimate interest in responding, s11(1)(f). |
| Providing our services and managing our contract with you | Performance of a contract, s11(1)(b). |
| Invoicing, accounting, tax and company records | Complying with a legal obligation, s11(1)(c). |
| Keeping this website secure and working | Our legitimate interest, s11(1)(f). |
| Understanding how the website is used, through analytics cookies | Your consent, s11(1)(a), which you can withdraw at any time. |
| Sending you news about our services | Your consent, or, if you are an existing client, our similar-services exception under section 69. You can opt out at any time. |
We do not sell personal information, and we do not make decisions about you based solely on automated processing.
05Cookies and tracking
Cookies are small text files a website stores in your browser. We use as few as possible, and nothing optional is set until you agree.
| Cookie | Purpose | Type and duration |
|---|---|---|
dynepta_consent | Remembers whether you accepted or rejected analytics, so we don’t ask on every page. | Strictly necessary. Set by us. 12 months. |
_ga | Google Analytics: tells visits apart so we can count visitors and see which pages are useful. | Analytics, only with your consent. Set by us via Google. 2 years. |
_ga_<id> | Google Analytics: keeps track of the current visit. | Analytics, only with your consent. Set by us via Google. 2 years. |
Your choice
When you first visit, a banner asks whether you accept analytics cookies. Rejecting is as easy as accepting, and the site works the same either way. You can change your mind at any time using , also linked in the footer of every page. If you withdraw consent, we delete the analytics cookies and stop loading Google Analytics.
We use analytics cookies only on the basis of your consent (POPIA section 11(1)(a)). We do not use advertising or social media tracking cookies.
Google services
If you accept analytics cookies, Google Analytics receives information about your visit, such as the pages you view, your approximate location, and your browser and device type. Google Analytics 4 does not log or store IP addresses: it uses them briefly to estimate your approximate location, then discards them. To display our typeface, your browser also requests font files from Google Fonts, which receives your IP address and browser information whether or not you accept cookies; Google Fonts does not set cookies. Google describes how it handles this information in the Google Privacy Policy and explains how it uses information from sites that use its services.
You can also block or delete cookies in your browser settings.
06Who we share it with
We share personal information only where needed for the purposes above:
- Service providers who act as our operators: our website host ([hosting provider]), our email and productivity provider ([email provider, e.g. Google Workspace]), Google Analytics (only if you accept analytics cookies) and our accounting software provider ([accounting provider]). Each processes information only on our instructions under a written agreement, as section 21 of POPIA requires.
- Professional advisers such as our accountants, auditors and attorneys, who are bound by confidentiality.
- Authorities such as the South African Revenue Service or a court, where the law requires us to.
07Transfers outside South Africa
Some of our service providers, including Google Fonts, Google Analytics and [email provider], store or process information on servers outside South Africa. Under section 72 of POPIA, we only transfer personal information outside the country where the recipient is subject to a law, binding corporate rules or a binding agreement that gives a level of protection substantially similar to POPIA, or where the transfer is necessary to perform a contract with you or to take steps you asked for.
08How long we keep it
- Enquiries that do not lead to a contract: up to [24 months] after our last contact with you.
- Client, supplier, financial and tax records: for as long as the law requires, for example under the Companies Act 71 of 2008 and the Tax Administration Act 28 of 2011.
- Website server logs: [number of days], as set by our website host.
- Analytics data: [2 or 14] months in Google Analytics, after which Google deletes it. Cookie durations are listed in section 05.
After that, we delete or de-identify the information, as section 14 of POPIA requires.
09How we protect it
We take appropriate, reasonable technical and organisational measures to protect personal information against loss, damage and unauthorised access, as section 19 of POPIA requires. These include encrypted connections (HTTPS), two-step login on every company account, access limited to the people who need it, and keeping credentials in a secrets manager rather than in documents or code.
If we have reasonable grounds to believe your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible, as section 22 of POPIA requires.
10Your rights
Under POPIA you have the right to:
- ask whether we hold personal information about you and request a copy of it (section 23), using the procedure in our PAIA and POPIA manual;
- ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (section 24);
- object to processing based on our legitimate interests (section 11(3));
- withdraw your consent at any time, and opt out of direct marketing (section 69);
- lodge a complaint with the Information Regulator.
To exercise these rights, email our Information Officer at [privacy@ email address]. We will need to confirm your identity before acting on a request, and we will respond within a reasonable time. The prescribed forms (POPIA Form 1 for objections and Form 2 for correction or deletion) are available on the Information Regulator’s website, but you do not need them to contact us.
11Information Regulator
If you are not satisfied with how we have handled your personal information, you may complain to the Information Regulator (South Africa):
- Address
- Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
- POPIA complaints
- POPIAComplaints@inforegulator.org.za
- General enquiries
- enquiries@inforegulator.org.za
- Phone
- 010 023 5200
- Website
- inforegulator.org.za
We would appreciate the chance to resolve your concern first, so please consider contacting our Information Officer before you complain.
12Changes to this notice
We may update this notice from time to time. The version number and effective date at the top show when it last changed. We will notify clients of material changes.
This website and our services are aimed at businesses and are not directed at children.