Privacy notice
Last updated: [DATE: the day v11 is published]
1. Who we are
This notice covers the website https://techwarrior.co.za. Tech Warrior is a trading name of 5th Place Consciousness (Pty) Ltd (registration number 2017/524743/07), and the company is responsible for your personal information. Our address is 102 2nd Street, Linden, Randburg, 2195, South Africa.
We look after your personal information in line with the Protection of Personal Information Act 4 of 2013 (POPIA).
Information Officer: Matthew Green
5th Place Consciousness (Pty) Ltd, trading as Tech Warrior
102 2nd Street, Linden, Randburg, 2195, South Africa
Email: [email protected]
We don’t take calls, so email is the way to reach us, for privacy questions and for help with a website we look after.
2. The short version
- We collect only what we need to reply to you, build and look after your website, take your monthly payment, keep this site working and secure, count visits from our emails, or send you our newsletter if you ask for it.
- We don’t sell your personal information, and we don’t rent or trade mailing lists.
- You can ask us at any time to show you what we hold about you, correct it or delete it. Section 11 tells you how.
3. When you fill in a form on our site
The contact form (Contact us page) asks for your first and last name, your email address and your message. We use them to reply to you, and for nothing else.
The Website Armour forms ask for your full name, email address and business name. We use them to reply to you about our Website Armour care plans.
Logging in. Clients log in to the site’s client area on a login page run by ProfilePress. We keep a record of each login to keep the site secure.
Why we’re allowed to. When you send a form, you agree to us using your details to reply, and we have a fair business reason to answer a message sent to us. For login records, the reason is keeping the site secure.
The website deletes form messages and login records after 12 months.
The free website check form asks for your first and last name, your email address, your business name, what your business does, your town and your website address. Your mobile number is optional: give it only if you’d like a WhatsApp message from us. We use these details to test your site and email you what we found.
4. The Memory Bank, our monthly newsletter
The Memory Bank is our monthly email about looking after your website, keeping it safe and being found online. You can sign up on the home page or the Learning Hub page.
What we collect. Your name and email address, and a record of when you signed up and what you agreed to.
What we use it for. Only to send you The Memory Bank. An issue may also mention our own services.
Who sends it. Brevo sends the newsletter for us and keeps the list (see section 8).
Why we’re allowed to. You ask for it, by ticking the box on the signup form. We never tick it for you.
Leaving the list. Every issue has an unsubscribe link. One click and you’re off, any time, and you don’t have to tell us why. We keep a note that you left, so that we don’t add you again by mistake.
Clients. If you’re a client, we may send you The Memory Bank as part of looking after your website, because it’s about the kind of work we already do for you. We tell you before the first issue, and you can leave at any time with the link in every issue.
5. When you email us
We keep the conversation, so we have a record of what was discussed and agreed. Email to an @techwarrior.co.za address is stored with our host, Xneelo, in South Africa. Some of our addresses also forward to Google’s Gmail, so Google holds copies of those emails.
We keep these records because a business needs a record of its own conversations. If you’re a client, we also need them to do the work you asked for.
6. If you’re on one of our care plans
What we keep about you. To look after your website, we keep:
- your name, business name, email address and phone number, and your website address;
- your plan, your fee and when it started, your invoices and payments, and the renewals we track for you (domain, hosting, security certificate and paid add-ons), with who pays each one;
- the access details you give us for your website, hosting and domain;
- a monthly record of the work: updates, backups, security scans and blocked login attempts, and whether your site stayed up;
- our emails with you, and a short log of each report, check-in, renewal reminder and incident.
Your customers’ details. To keep your site safe, we take regular backups of it. A backup is a full copy of your site, including its database, so it holds whatever your site holds about your own visitors and customers: form entries, comments, orders and user accounts. Your site’s security logs also record the internet (IP) addresses of visitors and the usernames tried at your login page. For all of this you’re the responsible party under POPIA, and we’re your operator. We handle it only to host, update, back up and protect your site, only as you ask us to, and we keep it confidential and secure (POPIA section 20).
When a plan lapses or ends. We keep what we hold for your plan for 90 days after it lapses or ends, so that nothing is lost if you carry on. Then we delete it: the access details you gave us, our backups of your site, the monthly records and our emails with you. Invoices and payment records are the one exception. Tax law says how long we must keep those, and we keep them for that long.
If we find a break-in that may have exposed personal information on your site, we tell you as soon as we reasonably can, so that you can meet your own duties under section 22.
6a. If you’re on one of our website plans (Outpost, Fort or Stronghold)
What we keep about you. To build your website and run your plan, we keep:
- your name, business name and address, email address and mobile number;
- your plan, when it started, your invoices, and the last four digits, type and expiry month of your card;
- the photos, logo, opening hours, WhatsApp number and words you send us for your site;
- the record of your web address, which we register in your full legal name, with your own email address.
Your card. Paystack takes your payment and keeps your card details. We never see your full card number.
Where it’s kept. Your client record is on our own server in Johannesburg (Vultr). Your website’s files are kept on GitHub and delivered by Cloudflare. Your web address is registered through Domains.co.za, and the .co.za registry (ZARC) keeps its record.
Emails about your plan. Invoices, failed-payment notices and the reminder before your first 12 months end are part of your plan, not marketing.
Your customers’ details. When a customer taps an Order or Ask button on your site, the WhatsApp message goes from their phone to yours. It never reaches us. If your site has an order form, the form sends the details straight to you by email. We pass them on for you and keep no copy. For your customers you’re the responsible party under POPIA, and we’re your operator only while the details pass through.
When your plan ends. We send you a zip file with your images, your words (as a Word document and a plain text file) and a data file of your site. We keep what we hold for your plan for 90 days after it ends, then we delete it. Invoices and payment records are the one exception: tax law says how long we keep those.
7. Cookies, the cookie banner and server logs
Cookies are small text files a website stores on your device, so the site can remember things from one page to the next. A cookie doesn’t hold your name. It holds a code linked to your browser.
When you first visit, a cookie banner (CookieYes) asks for your choice. The site sets only these cookies, and all of them just remember that choice:
| Cookie | What it does |
|---|---|
| viewed_cookie_policy | Remembers that you’ve seen the cookie banner |
| CookieLawInfoConsent | Remembers the choice you made |
| cookielawinfo-checkbox-necessary | Remembers your choice for necessary cookies |
| cookielawinfo-checkbox-non-necessary | Remembers your choice for non-necessary cookies |
We don’t use analytics or tracking cookies. You can block or delete cookies in your browser’s settings, but some parts of the site may then stop working, logging in for example.
The map on our Contact us page. The map comes from Google Maps. When it loads, your browser connects to Google, which receives your internet (IP) address and may set its own cookies, under Google’s terms. If you’d rather not, our address is written on the page too.
Server logs. Like every web server, the one that runs this site (our host Xneelo’s, in South Africa) keeps a log of each visit: your internet (IP) address, the pages you opened, the date and time, the page you came from, and the kind of browser and device you used. We use these logs to keep the site working and secure.
We also use them to count how many people visit our site from the emails we send to businesses. The links in those emails carry a short tag, so the log shows which of our emails, and so which business, a visit came from. We note that visit in our record of the businesses we’ve written to. That’s the only way we count them: there’s no tracking script, no analytics and no tracking cookie, and we don’t use the logs to build a profile of anyone.
Why we’re allowed to. We have a fair business reason to keep our site secure and to know whether our emails are useful.
8. Who else handles your information
These companies handle personal information for us (they’re our operators under POPIA). Each one gets only what it needs:
| Company | What it does for us | What it receives |
|---|---|---|
| Xneelo (South Africa) | Hosts this website and our email, in South Africa | The website and its data, form messages, email and server logs |
| Cloudflare (United States) | Protects the site and makes it faster. Every visit passes through it. On our website plans it also delivers your site and passes your order form to you | Visit details, including your IP address; order form details in passing, with no copy kept |
| Paystack | Takes card payments for our website plans | Your name, email address and card details |
| Vultr (Johannesburg, South Africa) | Our server for client records and a standby copy of client websites | Your client record and your website |
| GitHub (outside South Africa) | Keeps the files of the websites we build | Your website’s words, photos and logo |
| Domains.co.za and ZARC (South Africa) | Register your web address and keep the .co.za record | Your name, email address and contact details |
| Wordfence (Defiant Inc., United States) | The website’s firewall and login protection | Visit details, including your IP address |
| Brevo (France) | Sends The Memory Bank. Its servers are in France and Belgium | Your name, email address and signup record |
| Google (Gmail) | Holds copies of email sent to the addresses that forward to Gmail | Those emails, and who sent them and to whom |
| Google (Maps) | Shows the map on our Contact us page | Your IP address and browser details, when the map loads |
| Our accountants, and our attorneys if ever needed | Accounts, tax and legal advice | Only what’s necessary |
We only hand information to anyone else where the law makes us, or where we have to defend a legal claim.
9. Information sent outside South Africa
Your information is stored in South Africa, with Xneelo. Cloudflare, Wordfence and Google are based in the United States, so visit details and some emails go to them outside South Africa. Brevo keeps its data on servers in France and Belgium, in the European Union. On our website plans, your website’s files are kept on GitHub, outside South Africa, and Paystack may keep payment records outside South Africa.
POPIA (section 72) allows this where the company receiving it is bound by rules that protect your information about as well as POPIA does, where you agree to it, or where it’s needed to carry out a contract with you. We rely on the data protection terms these companies publish and sign up to.
10. How long we keep your information
- Form messages and login records: 12 months. The website deletes them automatically after that.
- Email: 2 years after our last contact with you. If you’re on a care plan, section 6 applies instead.
- The Memory Bank: for as long as you stay on the list. After you leave, we keep only your email address and the date, so that we don’t email you again.
- Care-plan records: as set out in section 6.
- Website-plan records: 90 days after the plan ends, as set out in section 6a.
- Free website check requests: 12 months, like other form messages.
- Invoices and financial records: for as long as tax law requires.
11. Your rights
Under POPIA you can:
- ask whether we hold personal information about you, and ask to see it;
- ask us to correct it or delete it;
- object to us using it, including for marketing, at any time;
- take back your consent at any time (this doesn’t undo what we did before);
- complain to the Information Regulator.
To use any of these rights, email our Information Officer at [email protected], or write to us at the address in section 1. It’s free. We’ll reply in writing within 30 days, and we may ask you to show us who you are first.
The Information Regulator (South Africa): https://inforegulator.org.za
12. Keeping your information safe
We protect personal information with sensible technical and practical measures, including Cloudflare and Wordfence protection, regular updates and limits on who can get in. If a break-in affects your personal information, we tell you and the Information Regulator, as POPIA section 22 requires.
13. Changes to this notice
We may update this notice. The date at the top shows when it last changed, and the version on this page is the one that applies.
