PRIVACY POLICY

UKUTHULA SALES SOLUTIONS

PRIVACY POLICY

Effective Date: 25 September 2026

Last Updated: 25 September 2026

Version: 2.0

1. Who We Are and What This Policy Covers

1.1  Ukuthula Sales Solutions ("Ukuthula", "we", "us") is a web design and digital marketing agency based in Brits, North West, South Africa. We build websites, run online advertising and set up CRM and automation systems for businesses in South Africa, the United States and other countries.

1.2  This Privacy Policy explains how we collect, use, share and protect personal information about visitors to https://ukuthulasalessolutions.co.za/, people who contact us, our prospective and current clients and their staff, and people who sign up to hear from us.

1.3  We follow the Protection of Personal Information Act 4 of 2013 ("POPIA") in South Africa. For people in the United States, we follow the privacy laws that apply to us, which may include the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), the California Online Privacy Protection Act ("CalOPPA"), comparable laws in other US states, and federal laws such as the CAN-SPAM Act, the Telephone Consumer Protection Act ("TCPA") and the Children's Online Privacy Protection Act ("COPPA").

1.4  This Policy does not cover personal information we handle on behalf of our clients, such as their customers, website visitors and leads. For that information we act as an "operator" under POPIA and a "service provider" or "processor" under US state laws. We follow our client's instructions, and our client's own privacy policy applies. If you are one of our client's customers, contact that business directly. We will help them respond to your request.

2. Information Officer

2.1  Our Information Officer under POPIA is Jan Hendrik Myburgh, Founder and CEO. You can reach him at [email protected] or +27 63 260 2023.

2.2  Our manual under the Promotion of Access to Information Act 2 of 2000 ("PAIA") is available on request.

3. Personal Information We Collect

3.1  Identity and contact details: name, email address, phone and WhatsApp number, job title, business name and billing address.

3.2  Business and account details: company registration and VAT numbers, quotations, agreements, invoices and payment records. We do not store full card numbers. Card payments are handled by our payment providers.

3.3  Access details: logins and access you give us to your website, hosting, advertising and social media accounts so we can deliver our services.

3.4  Communications: emails, messages, meeting notes and call notes. Where we record a call, we tell you at the start of the call.

3.5  Website and device data: IP address, browser type, device type, pages visited, referring website, approximate location based on IP address, and information from cookies and similar technologies (see clause 7).

3.6  Marketing data: your answers on our forms, and whether you open our emails or respond to our ads.

3.7  We do not ask for special personal information under POPIA or sensitive personal information under US law, such as health information, religious beliefs, race, biometric data, precise geolocation or government ID numbers. If you send us this kind of information, we delete it unless we need it for the service you asked for.

4. How We Collect Personal Information

4.1  Directly from you: when you fill in a form, call us, send a WhatsApp message or email, meet with us, sign an agreement or pay an invoice.

4.2  Automatically: through cookies, pixels and analytics tools on our website.

4.3  From third parties: lead forms on Meta (Facebook and Instagram), Google and LinkedIn, referrals from people who know you, and public business sources such as company websites, business directories and professional profiles.

5. How We Use Personal Information and Why

5.1  We use personal information only for these purposes, each with a lawful reason under section 11 of POPIA:

(a) to answer enquiries and send quotations, because you asked us to (steps before a contract);

(b) to deliver our services, manage your account and send invoices (performance of a contract);

(c) to contact you about projects, support and changes to our services (performance of a contract);

(d) to send you marketing about our own services (your consent, or our existing client relationship as allowed by section 69 of POPIA);

(e) to run and measure our own advertising, including showing ads to people who visited our website (your consent through our cookie banner where required, and our legitimate interest in promoting our business);

(f) to improve our website and services, keep our systems secure and prevent fraud (legitimate interest);

(g) to meet tax, accounting and other legal obligations (legal obligation); and

(h) to establish, exercise or defend legal claims (legitimate interest).

5.2  We will not use your personal information for a new purpose that does not fit the purpose we collected it for, unless we tell you first and, where needed, get your consent.

5.3  We do not make decisions about you that have legal or similarly significant effects based only on automated processing.

6. Direct Marketing

6.1  South Africa: we send electronic marketing (email, SMS or WhatsApp) only if you have given consent, or if you are a client and the marketing is about similar services, as section 69 of POPIA allows. Every message gives you a way to opt out.

6.2  United States: our marketing emails follow the CAN-SPAM Act. They identify us, include our postal address and have a working unsubscribe link, and we process opt-outs within 10 business days.

6.3  We send marketing text messages or automated calls to US phone numbers only with your prior express written consent, as the TCPA requires. Reply STOP to any text message to opt out. Message and data rates may apply.

6.4  You can opt out of marketing at any time by clicking unsubscribe, replying STOP, or emailing [email protected]. We keep a record of your opt-out so we do not contact you again.

7. Cookies and Tracking Technologies

7.1  Our website uses:

(a) strictly necessary cookies, which the website needs to work and which cannot be switched off;

(b) analytics cookies, such as Google Analytics, which show us how visitors use the website; and

(c) advertising cookies and pixels, such as the Meta Pixel, Google Ads tags and the LinkedIn Insight Tag, which measure our ads and let us show ads to people who visited our website.

7.2  When you first visit our website, a cookie banner lets you accept or reject analytics and advertising cookies. You can change your choice at any time through the cookie settings link in the website footer.

7.3  You can also block or delete cookies in your browser settings, and control ad personalisation in your Google, Meta and LinkedIn account settings or at https://optout.aboutads.info/.

7.4  Global Privacy Control: where US state law requires it, we treat a Global Privacy Control (GPC) signal from your browser as a request to opt out of the sale or sharing of your personal information and of targeted advertising for that browser.

7.5  Do Not Track: there is no common industry standard for Do Not Track browser signals, so our website does not respond to them. We do respond to GPC signals as described in clause 7.4.

8. Sharing Personal Information

8.1  We do not sell personal information for money.

8.2  We share personal information only with:

(a) website hosting and website building platforms;

(b) CRM and marketing automation platforms, including GoHighLevel;

(c) email, SMS and messaging providers;

(d) payment processors and our bank;

(e) advertising and analytics platforms, including Google, Meta and LinkedIn;

(f) AI tools we use to draft content and automate tasks, under settings or agreements that limit their use of the data where the provider offers them;

(g) our accountants, auditors and lawyers;

(h) government bodies, courts and law enforcement, where the law requires it; and

(i) a buyer or successor if our business is sold or restructured, under the same privacy protections.

8.3  Service providers that process personal information for us must keep it confidential and secure under a written agreement, as sections 20 and 21 of POPIA require.

8.4  Under some US state laws, using advertising cookies and pixels to show you ads on other websites counts as "sharing" personal information for cross-context behavioural advertising, or as a "sale" or "targeted advertising". In the last 12 months we have shared identifiers and internet activity data with advertising platforms in this way. You can opt out as described in clause 10.4. We do not knowingly sell or share personal information of anyone under 16.

9. International Transfers

9.1  Our service providers store and process data in several countries, including South Africa, the United States and countries in the European Union. If you are in the United States, your personal information is transferred to and processed in South Africa.

9.2  We transfer personal information outside South Africa only where section 72 of POPIA allows it, for example where the recipient is bound by law, binding corporate rules or an agreement that gives adequate protection, where the transfer is needed to perform our contract with you, or where you consent.

10. Your Privacy Rights

10.1  South Africa. Under POPIA you have the right to:

(a) know whether we hold personal information about you and ask for access to it (PAIA may allow a fee for some requests);

(b) ask us to correct, update or delete it;

(c) object to our processing of it, including for direct marketing at any time;

(d) withdraw your consent, where we rely on consent;

(e) not be subject to a decision based only on automated processing that significantly affects you; and

(f) lodge a complaint with the Information Regulator (see clause 17).

10.2  United States. If you live in a state with a comprehensive privacy law that applies to us (such as California, Colorado, Connecticut, Oregon, Texas or Virginia), you may have the right to:

(a) know the categories and specific pieces of personal information we have collected about you, where it came from, why we use it and who we share it with;

(b) ask us to delete it;

(c) ask us to correct it;

(d) receive a copy in a portable format;

(e) opt out of the sale or sharing of your personal information, targeted advertising and profiling;

(f) appeal if we refuse your request; and

(g) not be treated differently, such as by being charged more, for using these rights.

10.3  How to make a request. Email [email protected] with the subject "Privacy Request", or call +27 63 260 2023. We will confirm your identity by matching details we already hold. An authorised agent may make a request for you with your signed permission. We respond within 30 days for South African requests and within 45 days for US requests. Where the law allows us more time, we will tell you why.

10.4  Opting out of sale, sharing and targeted advertising. Use the "Your Privacy Choices" or cookie settings link in our website footer, turn on Global Privacy Control in your browser, or email us.

10.5  Appeals. If we refuse a request, you can appeal by replying to our decision with "Appeal" in the subject line within 60 days. We will respond in the time your state law requires. If we deny your appeal, you can contact the Attorney General of your state.

11. How We Protect Personal Information

11.1  We use reasonable technical and organisational measures, including encrypted connections (SSL/TLS), two-factor authentication on key accounts, access limited to people who need it, and reputable service providers.

11.2  No system is completely secure. If a security breach affects your personal information, we will notify the Information Regulator and you as section 22 of POPIA requires, and follow the breach notification laws of the US states that apply.

12. How Long We Keep Personal Information

12.1  Client records, agreements and invoices: 5 years after our relationship ends, to meet tax and accounting laws, including the South African Tax Administration Act.

12.2  Enquiries and leads that do not become clients: up to 24 months after our last contact.

12.3  Marketing lists: until you unsubscribe. After that we keep only what we need to make sure we do not contact you again.

12.4  Website analytics data: no longer than 14 months, based on the retention settings in our analytics tools.

12.5  After these periods we delete or de-identify the information, unless the law requires us to keep it longer or we need it for a legal claim.

13. Children

13.1  Our services are for businesses, and our website is not aimed at children. We do not knowingly collect personal information from anyone under 18 (a child under POPIA) or under 13 (under COPPA). If you believe a child has given us personal information, contact us and we will delete it.

14. Portfolio and Case Studies

14.1  We may show work we did for clients in our portfolio as set out in our Terms and Conditions. We do not publish personal information about our clients' customers. We publish names, photos or testimonials of client staff only with their permission.

15. Third-Party Websites

15.1  Our website and messages may link to other websites and platforms. Their own privacy policies apply, and we are not responsible for how they handle your information.

16. Changes to This Policy

16.1  We may update this Policy when our services or the law change. We will post the new version on this page with a new "Last Updated" date and version number. If a change materially affects how we use personal information, we will also email our clients before it takes effect.

17. Contact Us and Complaints

17.1  Ukuthula Sales Solutions, Brits, North West, South Africa. Email: [email protected]. Phone: +27 63 260 2023. Website: https://ukuthulasalessolutions.co.za/

17.2  Please contact us first so we can try to resolve your concern. You can also complain to the Information Regulator (South Africa) at https://inforegulator.org.za/ or [email protected]. US residents may contact the Attorney General or privacy regulator of their state.