Privacy / POPIA Policy

01Who this notice covers

This notice covers personal information associated with visitors to the DevForge website, prospective and existing clients, their representatives, suppliers and people who contact us. Under POPIA, personal information can relate to an identifiable living person and, where applicable, an identifiable existing juristic person.

DevForge may act as the responsible party when deciding why and how enquiry, relationship and business-administration information is processed. When handling a client’s information solely on that client’s instructions, DevForge may act as an operator; the client’s notice and the relevant written agreement also apply.

The registered responsible-party name, physical address and designated Information Officer’s details are awaiting confirmation. The business contacts below can receive privacy enquiries and requests for routing to the appropriate person.

02Information we may process

The information needed varies by purpose. Please share only what is relevant. Do not send identity documents, banking credentials, passwords, medical records or production datasets in an initial enquiry.

03Where information comes from

Information may come directly from you through email, calls, meetings, contracts and service interactions; from an authorised representative of your organisation; or from client systems and service providers where access is lawful and necessary for an agreed task.

Some technical information is generated when a device requests a website resource. Where information is collected from another source, the applicable POPIA requirements for lawful collection and notice still apply.

Basic enquiry details are voluntary, but we may be unable to respond meaningfully without a way to contact you. Information necessary to conclude or perform a contract, verify an authorised request or meet a legal duty may be required for that specific purpose. We will explain a material requirement and the consequence of not providing it where applicable.

04Purposes and lawful grounds

Personal information should be processed only where there is a lawful ground and a specific purpose. Depending on the circumstances, grounds under POPIA may include your consent, steps requested before a contract or performance of a contract, a legal obligation, or a legitimate interest that is compatible with your rights.

• Enquiries and proposals: understanding a request, communicating with you and preparing a relevant quotation.
• Service delivery: planning, developing, testing, administering and supporting an agreed solution.
• Business administration: managing contracts, invoices, records and professional relationships.
• Security and reliability: investigating faults, preventing abuse and protecting systems and information.
• Legal obligations and disputes: meeting applicable duties, responding to lawful requests and establishing or defending legal rights.

Consent is not assumed merely because you visit the website or send an enquiry. Further processing must be compatible with the original purpose or otherwise permitted under section 15 of POPIA, with any required notice. Before adoption, identify any particular law that authorises or requires a relevant collection and disclose it where required by section 18.

05Website technology, cookies and external services

The current DevForge website provides information and direct email and telephone links. Its own application code does not set cookies, store visitor profiles, run advertising pixels or include an analytics service. Clicking an email or telephone link opens your chosen application; it does not submit an enquiry through this website.

Fonts: the site requests its typefaces from Google Fonts. Your browser therefore connects to Google’s font servers, which may receive your IP address, browser/request details and information about the requesting website. Google’s handling is described in its Privacy Policy.

Hosting and access: the site is delivered through the Sites hosting service and its infrastructure providers. These services may process technical logs and use essential security or authentication cookies, particularly when a site requires sign-in. Their processing is separate from the absence of cookies in DevForge’s own page code. See the hosting platform’s privacy information.

Your browser settings can restrict cookies or external requests, although doing so may affect sign-in, display or access. If optional analytics, marketing technologies or new forms are introduced, this notice and any legally required choices must be updated before those technologies are used.

06Who may receive information

Where relevant to the stated purpose, recipients may include authorised team members, contracted technical specialists, hosting and cloud providers, email and communication providers, professional advisers, accounting providers, and competent authorities where disclosure is required or lawfully justified.

Information should be limited to what each recipient needs. Where a provider acts as an operator, the responsible party must have the written security and confidentiality arrangements required by POPIA. A provider that determines its own purposes may instead act as an independent responsible party.

The proposed DevForge policy is not to sell personal information or disclose it to unrelated parties for their own direct marketing. The actual provider inventory and operator agreements must be checked as part of adopting this notice.

07Processing outside South Africa

Cloud, communications and other technology services may involve processing or access from outside South Africa. A transfer must meet an applicable basis under section 72 of POPIA, such as adequate protection through applicable law, binding corporate rules or a binding agreement, or another permitted basis in that section.

Consent is only one possible basis and is not a substitute for evaluating a transfer. Relevant onward-transfer restrictions and any additional authorisation requirements must also be considered. The international recipients, intended transfers and protection afforded must be confirmed for this website’s Google Fonts and hosting/access providers as well as for each client engagement. Hosting regions and safeguards must not be assumed from a provider’s brand or headquarters.

08Security and incident handling

POPIA requires appropriate, reasonable technical and organisational measures to protect information against loss, damage, unauthorised destruction and unlawful access or processing. Measures must reflect the information, risks and systems involved, and be reviewed as risks change.

Access restrictions, confidentiality obligations, secure communication, credential management and recovery arrangements should be specified and implemented for the relevant service. This draft does not certify a particular security standard or guarantee that every system uses a stated control.

If there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, the responsible party must follow section 22 of POPIA, including notification to the Information Regulator and affected data subjects where required, as soon as reasonably possible after discovery, subject to lawful qualifications. POPIA does not impose a universal 72-hour notification deadline.

An operator must notify the responsible party immediately when it has the relevant reasonable grounds. Report a suspected DevForge-related privacy incident to the contacts below, without sending exposed credentials or unnecessary copies of the affected information.

09How long information is kept

Information should be retained only as long as necessary for the purpose for which it was collected, unless a law, lawful contractual requirement, permitted research purpose or another basis allowed by POPIA justifies longer retention.

Relevant factors include whether an enquiry remains active, the duration of a client relationship, support requirements, accounting and tax duties, prescription periods and an actual or reasonably anticipated dispute. A record subject to a lawful preservation duty may need to be kept after other records are deleted.

When retention is no longer justified, information should be securely destroyed, deleted or de-identified as required. Backups and archived copies must be addressed under an appropriate retention process. A detailed retention schedule and actual provider retention periods still need to be confirmed; this draft does not invent a fixed deletion deadline.

10Your rights under POPIA

Subject to applicable legal requirements and exceptions, you may:

• Ask, free of charge, whether we hold personal information about you, and request access to that information subject to the applicable records-access requirements.
• Request correction or deletion of inaccurate, irrelevant, excessive, outdated, incomplete, misleading or unlawfully obtained information, or destruction/deletion where retention is no longer authorised.
• Object to processing on grounds and in circumstances permitted by POPIA, including applicable direct marketing objections.
• Withdraw consent where processing relies on consent; withdrawal does not invalidate lawful processing that took place beforehand.
• Ask about a decision based solely on automated processing that produces legal or similarly substantial effects, and exercise the protections in section 71 where applicable.
• Lodge a complaint with the Information Regulator or pursue another available legal remedy.

Rights are not absolute. For example, a lawful retention duty may prevent immediate deletion. Where a request cannot be fulfilled, the applicable reason and available next steps should be explained. POPIA rights relating to access also interact with the Promotion of Access to Information Act (PAIA).

11How to make a privacy request

Email peter@devforge.co.za or jp@devforge.co.za with the subject “Privacy request”. Describe your relationship with DevForge, the relevant information and the action you would like us to take.

Only proportionate identity and authority checks should be requested. Do not attach a full identity document unless its necessity and a suitable secure channel have been established. If a prescribed form or additional information is needed, that should be explained. Confirmation of whether information is held is free of charge; a prescribed fee may apply to access to records where the law permits it and must be explained before it is charged.

Requests must be handled within the applicable legal framework and time periods. If DevForge holds information solely for a client, we may need to refer or assist the request through that responsible party. This notice is not a PAIA manual; any separately required manual, forms and records-access procedures must be provided as applicable.

12Direct marketing

An enquiry or service relationship does not provide unrestricted permission for electronic marketing. Any unsolicited electronic direct marketing must comply with section 69 of POPIA, including valid consent or the limited existing-customer provisions where their conditions are met.

Marketing communications must identify the sender and provide a simple way to object or opt out. An objection must be respected. Necessary project, billing, security and service messages may continue where there is an independent lawful reason to send them.

The current website has no newsletter subscription form or automated marketing sign-up.

13Children and special personal information

This website is intended for business enquiries and is not directed at children. Do not provide a child’s information, health information, biometric information or other special personal information through a general enquiry.

If an agreed project requires processing children’s information or special personal information, the parties must first establish a lawful basis, any required authorisation and suitable additional safeguards. Sector-specific obligations may also apply. Describing work in the insurance or emergency-response industries does not authorise unrestricted collection of that information through this site.

14Complaints and the Information Regulator

You may raise a concern with DevForge, and you may also contact the Information Regulator without first obtaining our permission. For current complaint instructions and the eServices route, use the Regulator’s official website:

• Information Regulator — complaints
• Information Regulator — contact details
• POPIA complaints: POPIAComplaints@inforegulator.org.za
• Telephone: +27 10 023 5200

The Regulator may require the prescribed form or submission through its current complaints platform. Follow the instructions on its official website.

15Contact and updates

Privacy enquiries can be addressed to Peter de Jongh at peter@devforge.co.za / +27 84 255 7521, or JP Roelofse at jp@devforge.co.za / +27 83 378 2681. These are confirmed business contacts, not a representation that either person has been appointed as Information Officer.

Before adoption, confirm the responsible party’s legal identity and address, Information Officer details, provider list, retention schedule and actual processing practices. Material changes to those practices should be reflected in a revised notice and communicated where required. A policy update does not retrospectively create consent.