In short. We collect only what we need to answer enquiries, work with clients and bill customers, and to tell existing customers about our own similar products unless they opt out. We do not sell personal information. This website sets no cookies and runs no analytics or advertising trackers. Paystack handles card details, and we never see them. Our main servers are in Germany, in the European Union. You can ask to see, correct or delete your information, and you can complain to the Information Regulator.
1. Who is responsible for your information
Stone Bridge Consulting (Pty) Ltd, trading as Stone Bridge Tech (“we”, “us”), is the responsible party, under the Protection of Personal Information Act 4 of 2013 (“POPIA”), for the personal information described in this policy:
- information collected through this website;
- information from enquiries and client engagements;
- billing records for payments made to us.
Our full company details are in section 1 of our Terms of Service.
| Information Officer | Johan Nel |
|---|---|
| privacy@stone-bridge.tech | |
| Telephone | +27 71 614 9238 |
Our products. Each of our products has its own privacy policy, published on its own website. That policy explains what the product collects, who is responsible for the information, and how it is used. This policy does not cover information you store in a product. The product privacy policies are listed in section 2 of our Terms of Service.
2. What we collect
When you send an enquiry on this website
- your name and email address (required, because we cannot reply without them);
- your company name and the type of help you need (optional);
- your message (required);
- the IP address the form was sent from, and the date and time. We collect these automatically and use them only to deal with abuse and spam.
When you pay us
- your name and email address, and your phone number and organisation name if you give them. Your name and email address are required, because we cannot set up or bill a subscription without them;
- transaction records: the amount, the date, what you paid for, the Paystack payment reference and the payment status. Paystack sends us these;
- for recurring payments, a token from Paystack that lets it charge your renewals.
We never receive your card number, expiry date or security code. Paystack collects and processes those directly.
When you contact us or work with us
- the content of your emails and messages, and the contact details you send them from;
- the business contact details of the people we work with on a client engagement, which the client gives us.
Technical information
- The infrastructure that hosts this website may keep standard server logs, such as IP address, page requested, browser type and time. We use these for security and to fix faults.
3. Cookies and tracking
This website sets no cookies, and it does not use analytics, advertising or social-media tracking scripts. Its fonts and images are served from our own domain. When you go to Paystack to pay, Paystack may set the cookies its payment page needs. Those are governed by the Paystack privacy policy.
4. Why we use it and our lawful basis
We process personal information only on a basis that section 11 of POPIA allows:
| Purpose | Lawful basis (POPIA s11) |
|---|---|
| Replying to your enquiry and preparing a proposal | Necessary to take steps towards concluding a contract with you; our legitimate interest in responding to you |
| Carrying out client work and supporting customers | Necessary to perform a contract with you |
| Billing, payments, refunds and renewals | Necessary to perform a contract with you |
| Keeping invoices and transaction records | Required by law: the Companies Act 71 of 2008 and the Tax Administration Act 28 of 2011 |
| Preventing fraud, spam and abuse, and keeping our systems secure | Our legitimate interest, and yours |
| Telling you about service, price and policy changes | Necessary to perform a contract with you |
Marketing
If you are a customer, we may email you about our own similar products or services. We do this only if you did not opt out on the sign-up form or later. Every message lets you opt out, free of charge. We send marketing to anyone else only with their consent, as section 69 of POPIA requires.
We do not make decisions about you based only on automated processing.
5. Who we share it with
We do not sell, rent or trade personal information. We share it only as follows:
| Recipient | Why |
|---|---|
| Amazon Web Services (AWS) | Hosting this website and its database, and sending our transactional email. AWS acts as our operator, under a written data-processing agreement. |
| Our business email provider | Hosts our business email, where your messages to us are received and stored. It acts as our operator, under a written data-processing agreement. |
| Paystack | Processing payments, recurring billing and refunds. Paystack is responsible in its own right for the payment details you give it. |
| Our accountants and professional advisers | Bookkeeping, tax and legal compliance. They are bound by professional confidentiality. |
We may also disclose information where the law requires it, such as in response to a court order or a lawful request from a regulator. We may also disclose it where that is needed to protect our rights or someone’s safety.
6. Information sent outside South Africa
Our database and email-sending service run in AWS’s Frankfurt region in Germany. Some of our providers also process information in other countries, which may include the United States:
- our email provider;
- the content-delivery network that serves this website;
- Paystack, for the payment information you give it. Its privacy policy says where it processes that information.
Section 72 of POPIA lets us send personal information outside South Africa only where one of these applies:
- a law, or a written agreement with us, binds the recipient to protection substantially similar to POPIA. That includes limits on passing the information on to anyone else;
- the transfer is needed to perform our contract with you.
Our agreements with these providers include data-processing terms for this purpose.
7. How long we keep it
| Information | Kept for |
|---|---|
| Website enquiries that do not lead to work | 24 months after our last contact with you |
| IP address and time recorded with an enquiry | As long as we keep the enquiry |
| Invoices and transaction records | 7 years, the longer of the periods the Companies Act and the Tax Administration Act require |
| Client engagement and support correspondence | 24 months after the engagement or matter ends, unless a contract or the law needs it kept longer |
| Server and security logs | Only as long as we need them for security and to fix faults, and longer only while we investigate a specific incident |
When the period ends, we delete the information from our live systems or de-identify it so that it can no longer be linked to you. Backup copies are deleted as our backups are routinely overwritten.
8. How we protect it
- All traffic to this website is encrypted with HTTPS (TLS). Our database connections are encrypted and certificate-verified.
- Only the people who need personal information for their work can access it, and their access is protected by strong authentication.
- Passwords and keys are kept in a managed secrets store, not in code.
- Only Paystack, a PCI DSS Level 1 Service Provider, processes card details, and they never reach our systems. We comply with the PCI DSS requirements that apply to us as a merchant.
- If we have reasonable grounds to believe that an unauthorised person has accessed or acquired your personal information, we will notify you and the Information Regulator as soon as reasonably possible, as section 22 of POPIA requires.
9. Your rights
Under POPIA you have the right to:
- ask whether we hold personal information about you, and ask for a copy of it;
- ask us to correct information that is inaccurate, incomplete or out of date;
- ask us to delete information we no longer have a lawful reason to keep;
- object to processing based on our legitimate interests;
- object to direct marketing at any time;
- withdraw any consent you have given. Withdrawing consent does not affect processing that took place before you withdrew it;
- complain to the Information Regulator.
To use any of these rights, email privacy@stone-bridge.tech. We may first need to confirm who you are. We will respond within 30 days, which PAIA lets us extend once by up to 30 days for complex requests, and we do not charge for reasonable requests. You can also request access to records under the Promotion of Access to Information Act 2 of 2000 (PAIA). Our PAIA manual, which explains how, is available from our Information Officer on request.
The Information Regulator
If you are not satisfied with how we have handled your information, you may complain to the Information Regulator (South Africa):
- Website: inforegulator.org.za
- POPIA complaints: through the Regulator’s eServices portal
- General enquiries: enquiries@inforegulator.org.za
10. Children
This website and our billing are intended for adults and organisations. We do not knowingly collect personal information from anyone under 18 through this website. If you believe a child has sent us their information, contact us and we will delete it.
11. Changes to this policy
We may update this policy as our services or the law change. The “last updated” date at the top of this page shows when it last changed. If a change materially affects how we use your information, we will email active subscribers and clients at least 30 days before it takes effect.
12. Contact
Send privacy questions and requests to privacy@stone-bridge.tech. For anything else, email hello@stone-bridge.tech.