Privacy Policy

This Privacy Policy explains how The Think Tank (Pty) Ltd (registration number 2022/514260/07), trading as The Web Department ("we", "us" or "our"), collects, uses and protects personal information when you visit thewebdepartment.co.za, contact us, become a client, or receive a business communication from us.

We process personal information in accordance with the Protection of Personal Information Act, 4 of 2013 ("POPIA") and, where applicable, the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 ("PECR").

1. What information we collect

Information you give us directly

When you submit our contact form, book a call or otherwise contact us, we may collect:

• Your name
• Your email address
• Your company or organisation
• Your website URL
• The type of support or services you are interested in
• Any additional information you choose to provide
• Whether you have opted in to marketing updates, and the date of that consent

Business contact information from public and professional sources

We may collect professional contact information about people working at businesses that may reasonably be interested in our services. This may include:

• Your name
• Your job title or professional role
• The company or organisation you work for
• Your business email address
• Your company's website
• Publicly available information about your professional role or business that is relevant to our services

We may obtain this information from sources such as:

• Company websites
• Companies House
• Public professional profiles
• Professional and industry directories
• Publicly available business records
• Business contact and data providers

We use this information for relevant business-to-business prospecting and marketing. We limit this research to professional and business information and do not intentionally collect information about people's private lives for marketing purposes.

Information collected automatically

When you visit our website, our hosting provider records standard technical information for security, troubleshooting and traffic analysis. This may include:

• Your IP address
• Your browser type and operating system
• The pages you visit and the time you visit them
• The website that referred you to ours, if any

Cookies and analytics

This website does not set tracking cookies of its own.

We may use Google Analytics 4 to understand which pages visitors view and how the site is performing. Google Analytics uses cookies and a small amount of pseudonymous data for this purpose. We do not use Google Analytics for advertising.

We use Cloudflare Turnstile on our contact form to help prevent spam submissions. Turnstile analyses browser signals to confirm that a submission is being made by a real person and is not used by us to track you across other websites.

When you first visit the site, you can accept all cookies, reject non-essential cookies, or choose individually by category. You can change your choice at any time using the Cookie settings link in the footer.

Strictly necessary cookies used to remember your cookie preferences remain active because they are required for the site to function correctly.

2. How we use your information

We may use personal information to:

• Respond to enquiries
• Provide information about our services
• Arrange calls or meetings
• Provide services to our clients
• Send occasional updates, tips and other marketing communications where you have opted in to receive them
• Identify and contact relevant business decision-makers where business-to-business marketing is legally permitted
• Research whether our services may reasonably be relevant to a business
• Maintain records of people who have asked not to receive marketing from us
• Keep our website secure
• Understand and improve how our website performs
• Comply with our legal and regulatory obligations

We do not sell personal information or provide it to other organisations for their own marketing.

Where permitted by law, we may contact relevant people at businesses about The Web Department's services where we reasonably believe those services may be relevant to their business or professional role.

Where UK electronic marketing rules apply, we only send unsolicited business-to-business electronic marketing where PECR permits us to do so. We do not treat the fact that someone's contact information is publicly available as consent where consent is legally required.

You can object to direct marketing from us at any time.

3. Lawful basis for processing

The lawful basis we rely on depends on why we are processing your information and which data protection laws apply. These may include:

Consent

Where you have actively chosen to receive optional marketing communications from us, we may rely on your consent. You can withdraw that consent at any time.

Legitimate interests

We may process personal information where it is necessary for our legitimate business interests and those interests are not overridden by your rights and interests. These legitimate interests may include:

• Operating and protecting our website
• Responding to business enquiries
• Developing and improving our services
• Identifying businesses and relevant decision-makers who may reasonably benefit from our services
• Carrying out targeted business-to-business marketing where this is legally permitted
• Maintaining suppression records so that we can respect marketing opt-outs

When we rely on legitimate interests for business-to-business marketing, we consider the purpose of the processing, whether it is necessary, the nature of the information involved, the professional context in which it was obtained, and the likely impact on the individual.

Contract and steps before entering a contract

We may process information where this is necessary to provide services under a contract or to take steps you have requested before entering into a contract.

Legal obligations

We may process or retain information where this is necessary to comply with legal, tax, regulatory or other obligations that apply to us.

4. Business-to-business marketing

The Web Department may contact relevant owners, founders, directors, managers and other business decision-makers about services that we reasonably believe may be relevant to their organisation.

Where we use named professional contact information obtained from public or third-party sources, we:

• Use professional and business information rather than private-life information
• Seek to contact people whose roles are relevant to the services being offered
• Use the information only for relevant business purposes
• Provide access to this Privacy Policy
• Provide a clear way to opt out of further marketing
• Respect objections to direct marketing
• Maintain suppression records so that people who have opted out are not inadvertently contacted again

Where UK PECR applies, unsolicited electronic marketing is sent only where the relevant rules allow it.

5. Who we share your information with

We share personal information only where necessary to operate our business or provide our services. Service providers may include:

• Afrihost for website hosting, email and server infrastructure
• Google Analytics 4 for website analytics
• Cloudflare for website security and spam protection
• Calendly when you use our scheduling service
• Email delivery, customer relationship management, prospecting or business data platforms that we use to manage relevant business communications

These providers process information only for the purposes for which we use their services and subject to their applicable data-protection obligations.

We do not sell or rent personal information to third parties for their own marketing.

6. International processing and transfers

The Web Department is operated by The Think Tank (Pty) Ltd in South Africa.

Some of the service providers we use may process personal information in South Africa, the United Kingdom, the European Economic Area, the United States or other countries.

Where applicable data-protection law requires safeguards for an international transfer of personal information, we take reasonable steps to ensure that an appropriate legal mechanism or safeguard is in place.

7. How we keep your information secure

We take reasonable technical and organisational measures to protect personal information. These include:

• Serving our website over HTTPS
• Using access controls for systems containing personal information
• Restricting access to people who need the information for legitimate business purposes
• Using trusted hosting and technology providers
• Using security and spam-prevention services
• Taking reasonable steps to keep prospect and client information accurate and up to date

No method of transmission or electronic storage is completely secure, but we take measures appropriate to the nature and risk of the information involved.

8. How long we keep your information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected.

Enquiries

We retain enquiry information for as long as necessary to respond, develop a potential business relationship or comply with our legal obligations. If you do not become a client and there has been no meaningful contact for 24 months, we will normally delete or anonymise the information unless we have a legitimate reason to retain it.

Business prospect information

We periodically review business prospect information and retain it only while it remains reasonably relevant for legitimate business-to-business marketing. Prospect information will normally be deleted or refreshed where it is no longer accurate, relevant or necessary.

Marketing suppression information

If you ask us not to contact you for marketing purposes, we may retain the minimum information needed to identify you on a suppression or do-not-contact list. This allows us to respect your request and helps prevent your details from being inadvertently added to a future marketing campaign.

Technical information

Server log information is typically retained for up to 12 months for security and troubleshooting purposes.

9. Your rights

Depending on where you are located and which data-protection law applies, you may have the right to:

• Access personal information we hold about you
• Correct information that is inaccurate, outdated or incomplete
• Request deletion of personal information where applicable
• Request restriction of certain processing where applicable
• Object to certain uses of your personal information
• Withdraw consent at any time where we rely on consent
• Request information about where we obtained your personal information
• Lodge a complaint with the relevant data-protection regulator

Your right to object to direct marketing

If we use your personal information for direct marketing, you have the right to object at any time. If you tell us that you do not want to receive direct marketing from us, we will stop using your information for that purpose. We may retain the minimum information required on our suppression list to make sure that your preference continues to be respected.

You can exercise your rights or opt out of marketing by using the unsubscribe option provided in our marketing emails or by contacting info@thewebdepartment.co.za. We will respond to requests within the timeframes required by applicable law.

10. Children's information

Our website and services are intended for businesses and adults. We do not knowingly collect personal information from children for marketing purposes.

If you believe that a child has submitted personal information to us, please contact us so that we can investigate and, where appropriate, delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our services, technology, business practices or legal obligations.

The "Last updated" date at the top of this page will show when the policy was most recently changed.

12. Contact us

If you have questions about this Privacy Policy, the information we hold about you, or how we use personal information, please contact:

13. Complaints

South Africa

If you are not satisfied with how we have handled your personal information, you have the right to lodge a complaint with:

United Kingdom

Where UK data-protection law applies to the processing of your personal information, you may also lodge a complaint with the: