Privacy policy

Draft for professional review. This policy has been drafted around the Protection of Personal Information Act, 2013 (POPIA) and the website as built. It must be reviewed by a South African legal professional and completed with Crescio's registered details and Information Officer before publication. Items marked [TO CONFIRM] require input.

Effective date: [TO CONFIRM] Responsible party: Crescio Technologies [registered entity and registration number TO CONFIRM] Information Officer: [name and contact TO CONFIRM] Contact: info@cresciotech.co.zw

1. Who we are and what this policy covers

This privacy policy explains how Crescio Technologies ("Crescio", "we", "us") processes personal information collected through the website at cresciotech.co.za and through enquiries made by WhatsApp or email in connection with this website.

Under POPIA, Crescio is the responsible party for personal information processed in connection with this website. Where we build or host systems for clients, the client is usually the responsible party and Crescio acts as an operator; that processing is governed by the agreement with the client and not by this policy.

2. The personal information we collect

We only collect what we need to respond to you and to run the website.

When you contact us (through the contact form, WhatsApp or email) we collect: your name, business name, email address, WhatsApp or telephone number, city, the nature of your enquiry, your project description, an optional budget range, and your consent choices. The contact form also records the time of submission and the IP address from which it was sent, for security and abuse prevention.

When you browse the website, our hosting provider processes technical information such as your IP address, browser type and the pages requested, in server logs used for security, performance and abuse prevention. The website does not set tracking cookies by default. See section 7.

We do not knowingly collect personal information from children under 18 through this website.

3. Why we process your information and on what basis

Purpose	Lawful basis under POPIA
Responding to your enquiry and discussing a potential project	Your consent, and steps taken at your request prior to entering into a contract
Preparing a scope, proposal or quotation	Steps taken at your request prior to entering into a contract
Sending occasional insights for South African businesses	Your explicit, opt-in consent (section 69 of POPIA), which you may withdraw at any time
Keeping the website secure, preventing spam and abuse	Our legitimate interests in protecting the website and its users
Complying with legal obligations	Compliance with a legal obligation

We do not sell personal information. We do not use it for automated decision-making that has legal or similarly significant effects on you.

4. Direct marketing

We will only send you marketing communications if you have ticked the optional marketing consent box or otherwise given explicit consent. Every message will include a simple way to opt out. You may also opt out at any time by emailing us.

5. Who we share information with

We share personal information only with service providers who help us run the website and respond to enquiries, under terms that require them to protect it:

• Hosting and content delivery: Cloudflare, Inc. (website hosting, security and the contact form function). [Confirm hosting provider at launch]
• Email delivery: the transactional email provider used to deliver contact-form submissions to Crescio. [Confirm provider, e.g. Resend]
• Messaging: if you contact us on WhatsApp, your messages are processed by WhatsApp (Meta Platforms) under its own terms.

We may also disclose information where required by law, regulation or a lawful request from a public authority.

6. Transfers outside South Africa

Some of the providers above store or process information on servers outside South Africa. Where that happens, we take steps required by section 72 of POPIA, including using providers bound by laws or binding agreements that provide substantially similar protection to POPIA. [Legal review: confirm transfer mechanism per provider.]

7. Cookies and analytics

The website is designed to work without tracking cookies. Strictly necessary technical storage may be used by the hosting provider for security (for example, bot protection). If privacy-conscious, cookie-free analytics are enabled, they measure aggregate page views and conversion events without identifying individual visitors. We will update this section if any technology that requires consent is introduced, and will ask for consent before it is used.

8. How long we keep information

• Enquiries that do not lead to a project: deleted or anonymised within 12 months of our last contact with you, unless you ask us to keep them. [TO CONFIRM]
• Enquiries that lead to a project: retained for the duration of the relationship and thereafter as required for legal, accounting and contractual purposes.
• Marketing consent records: retained for as long as the consent is active, plus a record of withdrawal.
• Server and security logs: retained for a short rolling period by the hosting provider.

9. How we protect information

We apply appropriate, reasonable technical and organisational measures as required by section 19 of POPIA, including HTTPS on all pages, security headers, spam and bot protection on forms, restricted access to enquiry data, and reputable providers with their own security certifications. No method of transmission or storage is completely secure, and we will notify you and the Information Regulator of a data breach as required by section 22 of POPIA.

10. Your rights

Under POPIA you have the right to:

• be told what personal information we hold about you and to request access to it (section 23);
• request correction or deletion of inaccurate, irrelevant, excessive, out-of-date or unlawfully obtained information (section 24);
• object to processing on reasonable grounds, and to object to direct marketing at any time (section 11(3) and section 69);
• withdraw consent where processing is based on consent, without affecting processing that took place before withdrawal;
• lodge a complaint with the Information Regulator (South Africa).

To exercise any of these rights, contact our Information Officer at the details above. We may need to verify your identity before acting on a request. We aim to respond within a reasonable time and in any event within the periods required by POPIA.

Information Regulator (South Africa) JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 Email: complaints.IR@justice.gov.za / inforeg@justice.gov.za Website: https://inforegulator.org.za

11. Changes to this policy

We may update this policy as the website or the law changes. The effective date at the top will be updated and material changes will be noted on this page.