Last updated: 28 September 2026
This policy is written around the Protection of Personal Information Act 4 of 2013 (POPIA). It explains what we collect, why, who sees it, how long we keep it and what you can ask us to do with it.
- Who is responsible for your information
- What we collect
- Why we collect it
- Our lawful basis
- Who we share it with
- Sending information outside South Africa
- How long we keep it
- How we protect it
- Your rights under POPIA
- Cookies and analytics
- Children
- Information belonging to our clients' customers
- Proposal and demo work
- Changes to this policy
- Contact and complaints
1. Who is responsible for your information
Vytal is the responsible party for the personal information described here. We are a web design and development studio operating in South Africa, founded and run by Boikarabelo Tshabalala, who is also our Information Officer. Reach the Information Officer at hello@getvytal.co.za.
2. What we collect
| Where it comes from | What we collect |
|---|---|
| The free audit form | Your name, business name, email address, WhatsApp number, website address, and your answers about your business and how customers find you. |
| The contact form | Your name, a way to reach you, your business name and your message. |
| Email, WhatsApp and phone | Whatever you choose to send us, including the content of messages and any files attached. |
| Becoming a client | Billing details, invoicing information, and account access you give us so we can do the work. |
| Automatically, when you visit | Standard technical information such as IP address, browser type, device type, pages viewed and referring page, as recorded by our hosting provider. |
We do not ask for and do not want special personal information, and we never ask for your banking passwords or one time PINs. Nobody from Vytal will ever request those.
3. Why we collect it
- To carry out the free audit you asked for and send you the report.
- To reply to your enquiry.
- To quote for work, and to deliver, host and support that work.
- To invoice you and keep proper accounting records.
- To keep our own record of who we have spoken to, so we do not contact you twice by mistake.
- To improve the website and understand which pages are useful.
We do not sell your personal information. We do not rent it, trade it, or hand it to advertisers.
4. Our lawful basis
We process personal information because you consented by submitting a form or contacting us, because it is necessary to perform a contract with you, because we have a legal obligation such as tax record keeping, or because we have a legitimate interest in running and improving the business, balanced against your rights.
5. Who we share it with
We share personal information only where it is needed to run the service, and only with providers who are bound to protect it:
- Hosting and deployment providers that serve this website and the websites we build.
- Email providers that carry our correspondence and send form confirmations.
- Payment and accounting providers that process invoices.
- Professional advisers, and authorities where the law requires it.
Our current providers are Vercel for hosting, Resend for sending form emails, Titan for our mailbox, WhatsApp for messaging, and Yoco where card payments are set up on a client site.
6. Sending information outside South Africa
Some of the providers above store data outside South Africa. Where that happens we rely on the provider being subject to laws or binding agreements that give protection substantially similar to POPIA, as section 72 requires.
7. How long we keep it
| Type | Kept for |
|---|---|
| Audit submissions that do not become clients | Up to 24 months, then deleted |
| Enquiries and correspondence | Up to 24 months from the last contact |
| Client project records | For the life of the relationship and 5 years after |
| Invoices and financial records | 5 years, as tax law requires |
You can ask us to delete your information sooner. See your rights below.
8. How we protect it
We take reasonable technical and organisational steps to protect personal information, including encrypted connections, access controls on accounts, and limiting who can see what. No system is perfectly secure, and we cannot guarantee absolute security.
If a breach occurs that creates a real risk to you, we will notify you and the Information Regulator as POPIA requires.
9. Your rights under POPIA
- Ask what personal information we hold about you.
- Ask us to correct anything that is wrong or incomplete.
- Ask us to delete information we no longer have a reason to keep.
- Object to processing based on legitimate interest.
- Withdraw consent at any time, which does not affect processing already carried out.
- Complain to the Information Regulator.
To exercise any of these, email hello@getvytal.co.za. We will respond within a reasonable time and may need to confirm your identity first.
10. Cookies and analytics
This site does not set tracking or advertising cookies and does not run third party analytics. The forms on this site keep no data in your browser. If we add an analytics tool in future, this policy will be updated first and any cookie that needs consent will ask for it.
11. Children
This website and our services are aimed at businesses and are not directed at children under 18. We do not knowingly collect personal information from children. If you believe we have, contact us and we will delete it.
12. Information belonging to our clients' customers
When we build or host a website for a client, that client is the responsible party for the personal information their customers submit through it. In that situation we act as an operator on the client's instructions, we process that information only to provide the service, and we do not use it for our own purposes.
13. Proposal and demo work
Work labelled "Proposal" may include a business name and publicly available information solely to identify the proposal that was prepared. The label does not state or imply a client relationship, approval or endorsement. Work labelled "Studio demo" is a fictional brand created by Vytal; any names, products or reviews on it are invented and no real person or business is described. Rights in third party names, trade marks and existing material remain with their respective owners.
14. Changes to this policy
We may update this policy. The date at the top shows when it last changed. Where a change materially affects how we handle your information, we will take reasonable steps to tell you.
15. Contact and complaints
Information Officer: Boikarabelo Tshabalala
Email: hello@getvytal.co.za
WhatsApp: 067 268 2310
If you are not satisfied with our response, you can complain to the Information Regulator of South Africa at inforegulator.org.za.