Privacy Policy
This explains what personal information JSHW Digital Business Solutions collects, why, who else sees it, and what you can do about it.
Who is responsible for your information
JALTTMM (PTY) LTD T/A JSHW, company registration number 2013/210013/07.
Office Suite 4-E1, York Street Blvd Shopping Centre,George, Western Cape 6529
South Africa
Email: support@jshwsolutions.com
Telephone: +27 68 292 0966
The company named above is the responsible party for the personal information described on this page, as defined by the Protection of Personal Information Act, 2013 (POPIA). Questions about anything here go to our Information Officer, below.
Information Officer
Our designated Information Officer is Jonathan De Graaff. You can reach them at privacy@jshwsolutions.com.
Registered with the Information Regulator (South Africa).
What we collect
When you use the enquiry form
The form on our Reach Out page asks for your name, your email address and your message. All three are required — without them we cannot answer you. You also tick a box confirming you have read this policy, and we record that you did.
We also record when you sent it, which of our web addresses it came from and which form you used, so we can tell real enquiries apart from test submissions. We do not record your IP address with your message.
When you request a consultation
The Request a Consultation form asks for your name, your company's name, who you are asking on behalf of if not yourself, your company email address, your contact and WhatsApp numbers, your industry, the services you are interested in, your business phase, your estimated budget, how urgent your need is, any context or challenges you want to share, and up to three dates and times that suit you for the call. Your name, email address, contact and WhatsApp numbers and industry are required; the rest is optional. We also record your tick-box confirmation, and when you sent it, from which of our web addresses and through which form. We use it only to prepare for and arrange the consultation. Share only what you are comfortable sharing about your business, and please leave out other people's personal details.
When you complete a training needs assessment
The Training Needs Assessment on our AI Training page asks for your company's name; the contact person's name, email address and phone number; your industry; the training topics you are interested in; the number of participants; the level, format and timing you want; your budget; how important customisation is to you; your learning objectives; and any other requirements. We record when you sent it. We use it to recommend training and prepare a quote.
When you become a client
Clients, new and existing, complete a pre-onboarding form that we send directly; it is not linked from the site. It asks for your name, company, phone number, email address and preferred contact method; whether you are a new or existing customer; your main and other goals; the short- and longer-term results you expect; the commitments you are making from your side; and any questions or comments. We record when you sent it. What you give us there becomes part of your client record, kept as section 5 describes.
When you ask for a website quote
The Website quote form asks for your name, your role, your business name and email address, and, if you choose, a phone number. It then asks what your new site should do, who visits it, how enquiries reach you today and roughly how many arrive a month, and what would make the project worth it; whether your current site is online and its address; the domain names you own, who manages their settings and whether you can log in; whether you can get into your hosting account and what else runs on it; your trading name and registered company name; which email addresses should appear on the site and who reads each; and anything else we should know. We record when you sent it. We use it only to prepare your quote. If no project follows, it is kept as an enquiry, as section 5 describes.
When we start building your website
Clients who sign on for a website build complete a website onboarding form that we send directly; it is not linked from the site. It asks for your name, role, business name and email address, and for your agreement to six statements about how the work will be done, which we record with the date. It then asks about your business's data protection: where the business is registered and its registration number, where the people whose details you collect are, who your Information Officer is and whether they are registered, how long you keep enquiries, and who your legal advisor is. It also asks about the outside services and tracking on your current site; where your logos, testimonials, statistics, photos and other content came from, and whether you may use them; where enquiries from the new site should go; and who owns the hosting, signs off content and approves the launch. Some answers may name other people, such as who gave a testimonial or took a photo: give only what we need to check that you may use their work. What you give us becomes part of your client record, kept as section 5 describes.
Saving your answers on this device
The website quote and website onboarding forms are long, so they offer an optional box, Save my answers on this device. It stays unticked until you tick it. Once ticked, your answers are kept in your browser's own storage on that device, and only there: nothing reaches us, or anyone else, until you send the form. Tick boxes that record your agreement (the privacy box, marketing consent and the onboarding statements) are never saved, so you give them afresh when you send. The saved copy is deleted when the form is sent, when you untick the box or press Clear, or after 30 days; if sending fails, it is kept so that nothing you typed is lost. Don't use it on a shared or public computer. It is not a cookie and tells us nothing, so the consent banner does not cover it.
How every form is handled
All six forms work the same way. Each submission is written to a private Google Sheets spreadsheet and a copy is emailed to our mailbox; each asks you to tick the box described above; and none records your IP address with your answers. Each form also has a second, optional box for marketing emails, unticked until you tick it. We record whether you ticked it and when.
When you browse the site
Until you make a choice in the banner about tracking, nothing beyond what the site needs to work is loaded, and no analytics cookie is set.
If you accept analytics, Google Analytics records which pages you view, how you arrived, your device and browser, and an approximate location worked out from your IP address. It runs through Google Tag Manager and sets cookies. The exact list of what each service receives, and the cookies it sets, is under Who else sees your information.
If you also accept marketing, Google Signals is turned on. If you are signed in to Google and allow ad personalisation in your Google account, Google may link your visits across devices and use them in its advertising features. It sets no cookie on this site beyond the analytics ones.
Your choice itself is stored in your browser, under the name consent, together with when you made it and which version of the banner you answered, so that the banner does not ask again on every page — and does ask again if what it asks about changes. It is not stored on our server.
Server logs
Our hosting provider keeps standard web server logs — your IP address, your browser and operating system, the page you asked for, and the time. Every web server does this, and it is how outages and abuse get diagnosed. We do not use these logs to build a picture of you, we do not combine them with anything else, and we do not analyse them for marketing. Our hosting provider keeps them for 7 to 14 days, for security purposes only.
Why we collect it
Your enquiry: only to read and reply to it, and to keep a record that you made it.
Consultation, training and onboarding forms: to understand the needs and goals you describe, so we can recommend and provide the services and products that fit them, and prepare quotes and proposals for you.
Analytics, if you allow it: to count which pages are read and how visitors find the site, so we know which of our content is useful.
Marketing, if you allow it: to let Google recognise visitors who are signed in to Google, so we can understand who visits and show JSHW's services to the businesses most likely to need them.
Server logs: to keep the site working and to diagnose outages and abuse.
We send you marketing emails, about our other services, products, events or news, only if you tick the separate, optional marketing box on a form. Without that, we use your details only to reply to you and to serve you, and we do not add you to a mailing list. We never sell, rent or trade your information to anyone.
Giving us your information is entirely voluntary. The only consequence of not giving it is that we cannot reply.
Our lawful basis
Your enquiry — to answer you. We process it because you asked us to respond, often as a first step towards working together (POPIA section 11(1)(b)), or otherwise in our legitimate interest in answering people who contact us (section 11(1)(f)). Before sending, you tick a box confirming you have read this policy, including that your enquiry is stored with Google, outside South Africa. You can ask us to delete it at any time; see Your rights.
Analytics — your consent. You give or refuse it in the banner on your first visit, where Accept all and Reject all sit side by side. Nothing loads until you choose. You can change your choice at any time with the Change my choices button under Who else sees your information.
Marketing — your consent, given in the banner separately from analytics, and off until you switch it on. You can withdraw it at any time the same way.
Marketing emails — your consent (POPIA section 69), given by ticking the optional marketing box on a form. If you are already a client, we may also email you about services similar to those you use, and you can opt out when we first ask and in every email. You can withdraw at any time with the unsubscribe link in any marketing email, or by emailing us.
Server logs — our legitimate interest in keeping the site secure and working.
How long we keep it
We keep an enquiry, and any other information that does not become client work, for 14 months from your last interaction with us. If you get back in touch before then, the period starts again from that more recent contact. When it lapses with no further contact, we delete it everywhere it is held: our spreadsheet, our mailbox and any server log.
If your enquiry becomes client work, we keep the records of that relationship for 62 months from the end of the engagement, or longer where a law requires it (tax and company records, for example).
Analytics and Google Signals data are kept by Google for 14 months, as shown under Who else sees your information.
You can ask us to delete your information sooner. See Your rights.
Who else sees your information
The following services receive information when you use this site. Each is listed with what it receives and why.
None of them loads until you agree. If you have not made a choice, or you declined, nothing below has run and no cookie it sets exists.
- Google Tag Manager
-
Container for marketing and measurement tags, so tags can be changed without a site deploy.
Receives: your IP address and browser details, as part of loading the container, the address of the page being viewed.
Sets no cookies.
Our basis: consent.
- Google Analytics 4
-
Understanding which pages visitors read and how they arrive, to improve the site.
Receives: your IP address (Google states that GA4 does not log or store it), device and browser, pages viewed, referring source, approximate location derived from IP.
Sets cookies: _ga, _ga_*.
Retained by them for 14 months.
Our basis: consent.
- Google Signals, in Google Analytics
-
Letting Google recognise visitors who are signed in to Google, so we can understand who visits and show JSHW's services to the businesses most likely to need them.
Receives: your IP address and browser details with each request, the Google Analytics identifier for your browser, this site's address, a link to your Google account when you are signed in to Google and allow ad personalisation (made by Google from its own cookies).
Sets no cookies.
Our basis: consent.
Behind the enquiry form
These receive your enquiry because of how the form works, not because of anything you chose in the banner:
- Google — your enquiry is written to a private Google Sheets spreadsheet that only we can open, and the copy emailed to us is delivered to our mailbox, which Google Workspace hosts. Google acts as an operator (a processor) on our behalf: it stores the data, and does not get to use it for its own purposes.
- Our hosting provider, Domains.co.za — runs the server the form is sent to, and keeps the server logs described above. If the spreadsheet cannot be reached, the enquiry is kept in a log on that server so that it is not lost, and we add it to the spreadsheet by hand.
- A mail relay — the email copy of your enquiry leaves our hosting provider through an outgoing mail service operated for them by MailChannels, a Canadian-headquartered company whose data centres are in the United States.
Nobody else receives your information unless the law requires us to hand it over.
Our site links to our LinkedIn page. That is an ordinary link, not an embedded widget — LinkedIn learns nothing about you unless you actually click it, at which point their privacy policy applies rather than ours.
Where your information goes
We would rather say this plainly than bury it: some of your information is stored on, or passes through, servers outside South Africa.
- Your enquiry, in the Google Sheets spreadsheet and in our Google Workspace mailbox.
- The email copy of your enquiry, on its way to that mailbox, through the mail relay described above.
- If you allow analytics, the Google Analytics data described above.
- If you allow marketing, the Google Signals data described above, which Google uses in its advertising features.
Our website itself, the server the form is sent to, and its logs are hosted in South Africa.
Under section 72 of POPIA each of these is a transfer of your personal information out of the country. Your enquiry is protected by Google's binding Cloud Data Processing Addendum (section 72(1)(a)), and its transfer, including through the mail relay, is needed to answer the enquiry you sent us (section 72(1)(c)). You consent to the analytics and marketing transfers by accepting each in the banner; Google's handling of that data is covered by Google's privacy policy.
The form and our email both reach a mailbox Google hosts. If you would rather your information did not leave South Africa, phone us on +27 68 292 0966 instead.
Your rights
Under POPIA you have the right to:
- Ask whether we hold personal information about you, and get a copy of it.
- Ask us to correct anything that is wrong or incomplete.
- Ask us to delete it.
- Object to us using it.
- Withdraw your consent to analytics, marketing or marketing emails at any time. Every marketing email has an unsubscribe link, and when you use it we stop and keep only a record that you opted out, so we do not email you again.
- Complain to the Information Regulator.
To do any of these, email our Information Officer and tell us what you want. To ask whether we hold information about you, a plain email is enough and costs nothing. To get a copy of records, use the prescribed request form; the forms, fees and process are set out in our PAIA manual. We will reply within 30 days.
To withdraw consent to analytics or marketing you do not need to ask us: use the Change my choices button under Who else sees your information.
Withdrawing consent does not undo processing that already, lawfully, happened before you asked.
Complaints
If you think we have mishandled your personal information, please tell us first — we would rather fix it. You are also entitled to complain directly to the Information Regulator of South Africa, whichever you prefer:
Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Complaints by email: POPIAComplaints@inforegulator.org.za
Telephone: 010 023 5200 (toll free 0800 017 160)
How to complain: inforegulator.org.za/complaints
Security, honestly stated
This site is served over HTTPS, the capture spreadsheet is private, and the address it is written to is not published anywhere on this site. We take reasonable steps to protect your information.
We are not going to claim it is impossible to intercept information sent over the internet, because that is not true of any website. Please do not send us anything highly sensitive — financial details, identity numbers, passwords — through the contact form. We will never ask you for any of those by email.
Changes to this policy
If this policy changes, the date at the top of this page changes with it.