Privacy Policy
Privacy Policy
Web Changes (Pty) Ltd
Effective date: 28 October 2026
Last updated: 28 October 2026
1. About this policy
Web Changes respects your privacy. This policy explains, in plain language, what personal information we collect, why we collect it, how we look after it and what your rights are. It follows the Protection of Personal Information Act 4 of 2013 (POPIA) and its regulations.
It applies to visitors to webchanges.co.za, people who contact us or join our referral programme, and our web design, hosting, maintenance, SEO, digital marketing and AI services clients.
2. Who we are
Web Changes (Pty) Ltd (registration number 2020/648370/07) is the "responsible party" under POPIA for the personal information described here.
- Physical and postal address: 113B 12th Avenue, Randburg, 2170
- Email: info@webchanges.co.za
- Phone: +27 (0)11 476 9020
- Website: https://webchanges.co.za
Information Officer: Leon Keyter. Deputy Information Officer: Freudel Keyter. Leon Keyter is registered as our Information Officer with the Information Regulator. Contact them at info@webchanges.co.za (subject line "Privacy request") or +27 (0)11 476 9020.
3. What personal information we collect
Information you give us
- Contact details: your name, surname, email address, phone or WhatsApp number, company name and job title.
- Enquiry details: what you tell us in contact forms, quote or free assessment requests, emails, phone calls and WhatsApp messages.
- Client details: billing contacts, billing address, VAT number, order and invoice history, and service agreements.
- Website access details: logins and access you give us to your website, hosting, domain, Google or social media accounts so we can do the work.
- Referral programme details: your name and contact details, the details of the person you refer, and, if a referral earns a reward, your banking details so we can pay the reward in rand (ZAR). Please only refer someone who has agreed to us contacting them.
- Job applications sent to careers@: your CV and contact details.
Information we collect automatically
- Usage data such as your IP address, browser, device, pages visited, time on page and how you reached our site, through cookies and similar technologies (see section 6).
Information on our clients' websites
When we host, build or maintain your website, we may have access to personal information stored on it, such as form entries, customer accounts and online store orders. For that information you (our client) are the responsible party and we act as your "operator": we process it only on your instructions and to deliver our services (see section 9).
We do not intentionally collect special personal information (such as health, religion or biometric data) or information about children. Please don't send us any.
4. Why we use it and our lawful grounds
We only process personal information for specific purposes and on a lawful ground under section 11 of POPIA:
| Purpose | Lawful ground |
|---|---|
| Replying to enquiries, quotes and free assessments | Your request / our legitimate interest in replying |
| Providing web design, hosting, maintenance, SEO, digital marketing and AI services | Performing our contract with you |
| Invoicing, payments, accounting and tax records | Contract and legal obligations |
| Securing our website and systems and preventing fraud or abuse | Legitimate interests |
| Measuring and improving our website | Legitimate interests or your consent (for non-essential cookies) |
| Sending news and marketing about our services | Your consent, or as an existing client (section 69) |
| Running the referral programme and paying rewards | Your consent, our agreement with you and legal (tax) obligations |
| Assessing job applications | Your consent / steps before an employment contract |
We will not use your information for a new purpose that doesn't fit the reason we collected it, unless the law allows it or we ask you first.
5. How we collect it
Mostly directly from you: through our website forms, email, phone, WhatsApp and meetings. Sometimes from others, such as a person who refers you to us, a client who gives us access to their systems, or public sources like your business website or LinkedIn profile.
6. Cookies and analytics
Our website uses cookies: small files stored on your device.
- Essential cookies make the site work and keep it secure.
- Analytics cookies from Google Analytics show us how visitors use the site (for example, which pages are visited and for how long) so we can improve it. Google Analytics reports to us in aggregated form, and we do not use it to identify you.
We do not use advertising or tracking pixels on our website.
You can manage cookies in your browser settings: most browsers let you see, block or delete cookies, or warn you before a cookie is stored. You can also opt out of Google Analytics on all websites with Google's browser add-on at https://tools.google.com/dlpage/gaoptout. Blocking essential cookies may affect how the site works.
7. Direct marketing
We send electronic marketing (email, SMS or WhatsApp) only:
- with your consent, or
- if you are an existing client, about similar services of ours, and only if you were given the chance to opt out when we collected your details.
Every marketing message includes our contact details and an easy way to opt out. You can also unsubscribe at any time by emailing info@webchanges.co.za. We won't contact someone you refer to us without a lawful basis, and we never sell your personal information.
8. AI tools
We may use AI tools to help with general work such as drafting website copy or ideas. We do not put our clients' or website visitors' personal information into AI tools, and a person reviews anything AI helps produce before it is used. We do not make decisions about you based solely on automated processing.
Our website does not use a chatbot.
9. Who we share it with
We share personal information only when needed, with:
- Operators (service providers) who process it for us, such as Xneelo (our website hosting, email and newsletter provider, based in South Africa), Xero (our invoicing, payment and accounting system), Google (Google Analytics and, for client work, tools such as Search Console), and WhatsApp (Meta), if you message us there. We require them by written agreement to keep the information confidential and secure, as section 21 of POPIA requires.
- Our professional advisers, such as accountants, auditors and lawyers.
- Authorities, when the law requires it.
- A buyer or successor, if our business is sold or restructured, under the same protections.
When we act as an operator for a client's website, we process that information only on the client's instructions, keep it confidential and secure, and tell the client promptly if we believe it has been accessed without authorisation.
10. Cross-border transfers
Our website, email and newsletter are hosted by Xneelo on its South African servers in Cape Town and Johannesburg, so that hosting does not involve sending your information outside South Africa. Some other providers may store or process information outside South Africa, including Google (Google Analytics), Xero (invoicing and accounting) and Meta (WhatsApp). Under section 72 of POPIA, we only transfer personal information outside South Africa when:
- the recipient is bound by a law, binding corporate rules or agreement giving protection substantially similar to POPIA; or
- you consent; or
- it is needed to perform our contract with you or take steps you asked for.
11. How we protect it
Under section 19 of POPIA we take reasonable technical and organisational measures to protect personal information against loss, damage and unauthorised access, including:
- SSL encryption on our website;
- firewalls, malware scanning and security updates;
- strong passwords and two-factor authentication where available;
- access only for staff who need it, with confidentiality obligations;
- regular backups and secure storage of client access details;
- regular reviews of risks and safeguards.
No system is completely secure, but we keep improving our safeguards.
12. If there is a data breach
If we have reasonable grounds to believe your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible, as section 22 of POPIA requires, unless the law or a law enforcement agency says we must delay. We will tell you what happened, the possible consequences, what we are doing about it and what you can do to protect yourself. If the breach involves a client website we operate, we will tell the client so they can meet their own obligations.
13. How long we keep it
We keep personal information only as long as we need it for the purpose we collected it, or as the law requires (section 14 of POPIA). Retention periods:
- Enquiries that don't become work: 2 years after last contact.
- Client records, contracts and correspondence: 5 years after the end of the relationship.
- Invoices, accounting records and referral reward payment records (including the banking details used): 5 years, as financial records under the Tax Administration Act and Companies Act.
- Website access logins: deleted or changed at the end of the service.
- Client website backups: up to 90 days on a rolling basis.
- Marketing lists: until you opt out (we keep a record of the opt-out).
- Analytics data: 14 months.
- Unsuccessful job applications: 12 months, unless you agree to longer.
After that, we securely delete, destroy or de-identify it.
14. Your rights
Under POPIA you have the right to:
- Access (section 23): ask whether we hold your personal information and for a copy or description of it. We may charge a prescribed fee for some requests and will tell you first.
- Correction and deletion (section 24): ask us to correct, update or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, or that we no longer may keep.
- Objection (section 11(3)): object, on reasonable grounds, to processing based on legitimate interests, and object at any time to direct marketing.
- Withdraw consent at any time, without affecting processing before that.
- Not to be subject to decisions based solely on automated processing with legal or similar effects.
- Complain to the Information Regulator (section 15).
To use these rights, email info@webchanges.co.za with the subject "Privacy request" or use the forms prescribed in the POPIA regulations (Form 1 for objections, Form 2 for correction or deletion). We may need to confirm your identity first. We aim to reply within 30 days.
Access requests may also be made under the Promotion of Access to Information Act 2 of 2000 (PAIA), as section 25 of POPIA provides. Our PAIA manual is available on request from the Information Officer.
15. Children
Our website and services are aimed at businesses and adults. We don't knowingly collect information about children (under 18). If you believe we have, contact us and we will delete it.
16. Other websites
Our site links to other websites, including our clients' sites. We are not responsible for their privacy practices, so please read their policies.
17. Complaints
Please contact our Information Officer first so we can try to fix the problem. You also have the right to complain to the Information Regulator:
Information Regulator (South Africa)
- Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
- Postal: P.O. Box 31533, Braamfontein, Johannesburg, 2017
- Phone: 010 023 5200 | Toll-free: 0800 017 160
- General enquiries: enquiries@inforegulator.org.za
- POPIA complaints: POPIAComplaints@inforegulator.org.za, or the eService Portal at https://eservices.inforegulator.org.za
- Website: https://inforegulator.org.za
18. Changes to this policy
We may update this policy from time to time. The latest version will always be on this page with its effective date. If we make important changes, we will tell clients by email or put a notice on our website.
19. Contact us
For any privacy question or request:
- Email: info@webchanges.co.za
- Phone: +27 (0)11 476 9020
- Post: 113B 12th Avenue, Randburg, 2170