Collect less. Keep it bounded.

Information collected

The enquiry form collects the contact name, work email, company or project, optional public links, target path, decision, timing, consent and submission time supplied by the sender. A one-way network fingerprint limits repeated submissions; it is not intended to reveal the raw IP address. The hosting provider may process essential service and security logs.

During an accepted engagement, records may include supplier and buyer details, authorization, scope, versions, test identity and permissions, invoices, correspondence, observations and the minimum evidence needed for the report. Payment-card or bank credentials are not collected by this site.

Purpose and lawful use

Information is processed only to assess and answer an enquiry; form and perform a requested agreement; verify authority; safely run the named cases; invoice and keep transaction records; protect systems; handle objections or disputes; and meet legal duties. Consent is not treated as the only possible lawful basis. Information is not sold or used to train a public model.

Service providers and transfers

Necessary providers may process limited information for website hosting, email, secure file transfer, payment, storage or professional advice. These providers may operate outside South Africa. Before customer production data is introduced, the engagement must record the provider, location or transfer basis where known, purpose, access and retention. Operators must be contractually required to protect the information and notify relevant compromises.

Retention

• Unqualified or inactive enquiries: normally up to 90 days.
• Raw private test evidence: normally deleted within 30 days after delivery.
• Temporary credentials and tokens: deleted or allowed to expire immediately after the relevant test.
• Final report and redacted evidence index: normally up to 12 months.
• Contracts, invoices, payment and delivery records: retained for the lawful accounting, tax and dispute period, normally at least five years.
• Opt-out records: the minimum required to prevent repeat marketing.

The engagement schedule records exceptions. Legal holds and mandatory record duties may extend a period.

Security and compromises

Reasonable technical and organisational safeguards include access limitation, separated engagement folders, least-privilege credentials, redaction, controlled transfer and scheduled deletion. No internet service can promise absolute security. If there are reasonable grounds to believe personal information was accessed or acquired by an unauthorized person, the response follows POPIA and the Information Regulator’s current reporting process.

Your rights

Subject to applicable law, a data subject may ask whether information is held, request access or correction, request lawful deletion, object to processing or direct marketing, withdraw consent where processing depends on it, and complain to the Information Regulator. Identity may be verified proportionately. Requests and complaints receive a written record.

Cookies and analytics

This site currently uses no advertising tracker, marketing pixel, customer account or mailing-list sign-up. Essential hosting or security technology may still operate. If optional analytics or new processors are introduced, this notice and any required consent controls must be updated before collection begins.

Keep secrets out of enquiries

Do not submit passwords, API keys, access tokens, private keys, OTPs, customer exports, production credentials or private test evidence through the enquiry form or ordinary email. The accepted engagement provides a separate access route where one is necessary.