Version 1.0, effective 10 Oct 2026
RSA Web Design is committed to protecting your privacy and complying with the Protection of Personal Information Act (POPIA), Act 4 of 2013. This Privacy Policy explains how we collect, use, store, and protect your personal information.
We collect the following types of personal information:
| Information Type | Purpose | Legal Basis |
|---|---|---|
| Name and contact details | Service delivery, communication | Contract performance, consent |
| Business information | Website development, customization | Contract performance |
| Payment information | Processing payments via PayFast | Contract performance, legal obligation |
| Website usage data | Service improvement, analytics | Legitimate interest |
| Communication records | Support, service quality | Legitimate interest |
When you visit our website, we automatically collect:
We use your personal information to:
With your consent, we may send you:
You can unsubscribe from marketing communications at any time by clicking the unsubscribe link in our emails or contacting us directly.
We process your personal information based on the following lawful grounds under POPIA:
Processing is necessary to provide the services you have contracted for, including website design, hosting, and support.
You have given explicit consent for specific processing activities, such as marketing communications.
Processing is necessary to comply with South African legal requirements, including tax laws and financial record-keeping obligations.
Processing is necessary for our legitimate business interests, such as improving services, fraud prevention, and maintaining security.
We share personal information with trusted third-party service providers who assist in delivering our services:
| Service Provider | Purpose | Data Shared |
|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting infrastructure | Website content, files |
| PayFast | Payment processing | Name, email, payment details |
| Email hosting provider | Professional email services | Email addresses, messages |
| Google Analytics | Website usage measurement | IP address, device and browser type, pages visited |
| Google reCAPTCHA | Contact form spam protection | IP address, browser interaction signals |
| YouTube (Google) | Our videos, when you press play | IP address, device and browser type, viewing activity |
| WhatsApp (Meta) | Messages you choose to send us on WhatsApp | Phone number, WhatsApp profile name, message content |
All third-party providers are required to maintain appropriate security measures and use your information only for the specified purposes.
We may disclose personal information if required by law, court order, or government authority, or to protect our rights, property, or safety.
In the event of a merger, acquisition, or sale of assets, your personal information may be transferred to the new owner, subject to POPIA requirements.
Your personal information is stored on secure servers within South Africa and in AWS data centers. Website files are hosted on AWS infrastructure with South African edge locations for optimal performance.
We implement appropriate technical and organizational measures to protect your personal information:
We retain personal information for as long as necessary to:
When personal information is no longer needed, it will be securely deleted or anonymized.
As a data subject under POPIA, you have the following rights:
You have the right to request access to your personal information we hold and receive a copy of it.
You have the right to request correction of inaccurate or incomplete personal information.
You have the right to request deletion of your personal information, subject to our legal obligations to retain certain records.
You have the right to object to processing of your personal information for direct marketing purposes or based on legitimate interests.
You have the right to request restriction of processing in certain circumstances, such as while disputing accuracy of data.
You have the right to receive your personal information in a structured, commonly used format and transfer it to another service provider.
Where processing is based on consent, you have the right to withdraw consent at any time.
To exercise any of these rights, contact us at:
We will respond to your request within 30 days as required by POPIA.
When you collect personal information through your website (e.g., via contact forms), you are the responsible party under POPIA. You must:
RSA Web Design acts as an operator (processor) of data collected through client websites. We provide the technical infrastructure but do not control how clients use the data collected.
Our website uses the following types of cookies:
You can control cookies through your browser settings. Disabling cookies may affect website functionality.
Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.
While we primarily store data in South Africa, some data may be processed by international service providers (e.g., AWS, Google and WhatsApp). We ensure appropriate safeguards are in place for any international data transfers as required by POPIA.
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of significant changes by:
Continued use of our services after changes constitutes acceptance of the updated Privacy Policy.
For POPIA compliance purposes, our Information Officer is:
If you believe we have violated your privacy rights or POPIA requirements, you may:
If you have questions about this Privacy Policy or our data practices, please contact us:
Visitor statistics (Google Analytics) only run on this site if you allow them. Your choice is stored on your own device and nowhere else, and you can change it here at any time.
Three other features involve Google and are not part of this choice: the map on our home page is loaded from Google Maps, which receives your IP address when it displays; our video plays from YouTube's privacy enhanced service only when you press play, and YouTube then receives your IP address and may store information on your device to play it; and the spam check on our contact form (reCAPTCHA) is what lets the form accept a message at all. It loads only on the page that has the form and identifies itself with a visible badge.