Legal
Privacy Policy
Last updated 2 November 2026
Draft for legal review. This policy is a starting point written for Data Rhythm’s website. Have it reviewed by a qualified South African privacy practitioner before launch, and update the bracketed details.
1. Who we are
Data Rhythm (Pty) Ltd (“Data Rhythm”, “we”, “us”), registration number [CIPC reg. no.], is the responsible party for personal information collected through datarhythm.co.za, as defined in the Protection of Personal Information Act 4 of 2013 (POPIA).
Information Officer: [Information Officer name] Email: [email protected] Address: [Registered address], South Africa
2. What we collect
When you use our contact form we collect:
- your name, company name and email address;
- your phone number, if you choose to provide it;
- the service you’re interested in and the content of your message;
- a record of your consent and the date and time you submitted the form.
Our hosting provider automatically processes technical data such as IP address, browser type and request logs to deliver and secure the site. We do not use advertising or tracking cookies. If we add privacy-friendly analytics later, we will update this policy first.
3. Why we collect it
We use your information only to:
- respond to your enquiry and discuss how we can help;
- prepare proposals you have asked for;
- keep a record of our communication with you;
- protect the website against abuse and spam.
Our lawful basis is your consent (POPIA section 11(1)(a)) and, where you ask us for a proposal, steps linked to concluding a contract with you (section 11(1)(b)). We will not use your information for direct marketing unless you separately opt in, as required by POPIA section 69.
4. Who we share it with
We share personal information only with operators who process it on our behalf under written agreements (POPIA sections 20–21):
| Operator | Purpose | Location |
|---|---|---|
| Formspree, Inc. | Receives contact-form submissions and forwards them to our inbox | United States |
| [Email provider] | Business email hosting | [Location] |
| Cloudflare, Inc. | Website hosting, security and content delivery | Global network |
Some operators are outside South Africa. We transfer information across borders only where the recipient is subject to laws, binding corporate rules or agreements that provide an adequate level of protection, or with your consent (POPIA section 72). We never sell personal information.
5. How long we keep it
- Enquiries that don’t lead to work: deleted within 12 months of our last contact.
- Enquiries that lead to an engagement: kept for the duration of the relationship and for up to 5 years afterwards to meet legal, tax and contractual obligations.
- Form submissions held by Formspree: deleted from Formspree within 90 days, once forwarded to our inbox.
6. How we protect it
We apply reasonable technical and organisational measures (POPIA section 19), including encrypted connections (HTTPS), multi-factor authentication on all business accounts, least-privilege access and regular review of who can access personal information. If a security compromise affects your information, we will notify you and the Information Regulator as required by section 22.
7. Your rights
Under POPIA you may:
- ask whether we hold personal information about you and request a copy (section 23);
- ask us to correct or delete it (section 24);
- object to processing, or withdraw consent at any time (section 11(2)–(3));
- lodge a complaint with the Information Regulator.
To exercise any of these rights, email [email protected]. We will respond within a reasonable time and may ask you to verify your identity.
8. Complaints
If you are unhappy with how we handle your information, please contact our Information Officer first. You also have the right to complain to the Information Regulator (South Africa) — see inforegulator.org.za for current contact details.
9. Changes
We will post any changes on this page and update the date above.