1. Our commitment to privacy
Subtle Consulting (Pty) Ltd (“Subtle Consulting”, “we”, “us”, or “our”) is committed to protecting the privacy of every person whose personal information we handle. This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, and the rights you have under the Protection of Personal Information Act 4 of 2013 (POPIA).
We collect only the personal information we need to respond to enquiries and deliver our services. We do not sell personal information, and we do not share it with third parties for their own marketing purposes.
2. Who we are (the responsible party)
The responsible party for the processing of your personal information is:
- Entity: Subtle Consulting (Pty) Ltd
- Registration number: [Confirm registration number — placeholder for company secretarial records]
- Information Officer: The Information Officer, Subtle Consulting (Pty) Ltd
- Physical address: Johannesburg, Gauteng, South Africa (full street address on file with the Information Officer)
- Email: info@subtleconsulting.co.za
For any privacy-related query, please contact our Information Officer using the details above.
3. What personal information we collect
We collect personal information only when you choose to provide it to us, or as a natural consequence of your use of our website. The categories are:
3.1 Information you provide via our contact form
- Your name
- Your email address
- The project lifecycle stage that best describes your enquiry (selected from a dropdown of six options)
- Free-text context about your project or enquiry
This information is submitted to our web server, validated, and forwarded by email (using a SMTP service) to our internal team inbox for review and response.
3.2 Server logs
Our web server records standard access log entries for every request. These entries typically include your IP address, the date and time of the request, the page or resource requested, the HTTP status code, and your user agent string. Server logs are used for security monitoring, fraud prevention, and operational diagnostics. They are retained only as long as reasonably necessary for those purposes.
3.3 What we do NOT collect
We do not use analytics services, advertising pixels, social-media trackers, session-replay tools, or any other third-party tracking technology on this website. We do not place advertising cookies, and we do not profile visitors for advertising purposes.
4. Purpose of processing
We process personal information for the following purposes:
- Responding to enquiries you submit via our contact form
- Providing the cost and commercial advisory services you have requested
- Maintaining records of past and current engagements
- Operating, securing, and improving our website
- Complying with applicable legal, regulatory, and professional obligations
5. Lawful basis for processing (POPIA Section 11)
We rely on the following lawful bases under POPIA:
- Consent: For personal information you provide via the contact form, we rely on your consent, which you give by actively submitting the form. You may withdraw your consent at any time by contacting our Information Officer, although this will not affect the lawfulness of processing carried out before withdrawal.
- Legitimate interest: For standard server logs, we rely on our legitimate interest in operating a secure and reliable website. Server logs are retained only as long as reasonably necessary.
- Legal obligation: Where we are required to retain or disclose information to comply with applicable law or professional regulatory requirements.
6. How we share your information
We do not sell your personal information. We share it only as follows:
- Email service provider: When you submit the contact form, the information is forwarded by email through an SMTP provider to our internal team inbox. The SMTP provider processes the message in transit and does not use the contents for any other purpose.
- Hosting and infrastructure providers: Our website is hosted with a third-party infrastructure provider that processes server logs in the ordinary course of providing the service.
- Professional advisers: Where reasonably necessary to deliver our services (for example, where a matter requires input from a specialist consultant under confidentiality obligations).
- Legal and regulatory authorities: Where required to comply with a legal obligation, court order, or regulatory request.
We do not transfer your personal information to countries outside the Republic of South Africa except where necessary to comply with a legal obligation or where the recipient is bound by adequate confidentiality and data-protection obligations.
7. Cookies
Our website does not use tracking cookies, analytics cookies, or advertising cookies. If we ever introduce cookies that are not strictly necessary for the operation of the site, we will update this Privacy Policy and obtain any consent required by POPIA before doing so.
8. Data retention
We retain personal information only for as long as reasonably necessary for the purposes described in this policy, or as required by law. Indicative retention periods:
- Contact-form enquiries that do not progress to an engagement: up to 12 months from the date of submission, after which the record is securely deleted.
- Engagement records: retained for the duration of the engagement and for a reasonable period thereafter, generally 5 to 7 years, to satisfy professional, contractual, tax, and audit requirements.
- Server logs: retained for up to 90 days, unless required for an active security investigation.
9. Your rights under POPIA
Subject to POPIA, you have the right to:
- Access the personal information we hold about you
- Request correction of personal information that is inaccurate, incomplete, or outdated
- Request deletion of your personal information, subject to our legal and professional retention obligations
- Object to processing of your personal information on reasonable grounds
- Withdraw consent where processing is based on consent
- Lodge a complaint with the South African Information Regulator
To exercise any of these rights, please contact our Information Officer using the details in section 2. We will respond within a reasonable period and in any event within the timeframes required by POPIA.
10. Information Regulator contact details
If you are unsatisfied with our response to a privacy concern, you may lodge a complaint with the South African Information Regulator:
- Physical address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
- Postal address: P.O. Box 31533, Braamfontein, Johannesburg, 2017
- Telephone: +27 10 023 5200
- Email: enquiries@inforegulator.org.za
- Website: inforegulator.org.za
11. Security measures
We take reasonable organisational and technical measures to protect personal information against loss, theft, unauthorised access, disclosure, alteration, or destruction. These measures include:
- HTTPS encryption for all data submitted via our contact form
- Restricted access to internal systems that store enquiry and engagement records
- Use of reputable hosting and email infrastructure providers
- Periodic review of access permissions and retention practices
No method of transmission over the internet, however, is completely secure. We cannot guarantee absolute security.
12. Cross-border data transfers
Our operations are based in the Republic of South Africa. We do not routinely transfer personal information outside South Africa. Where a third-party service provider processes data on our behalf and stores it in another country, we take reasonable steps to ensure that the recipient is bound by adequate confidentiality and data-protection obligations.
13. Changes to this policy
We may revise this Privacy Policy from time to time to reflect changes in the law, our website, or our business. The updated version will be posted on this page with a revised “Last updated” date. Material changes that affect your rights will, where reasonable, be highlighted on the site’s home page for a reasonable period before they take effect. Your continued use of the website after changes are posted constitutes your acceptance of the revised policy.
14. Contact for privacy queries
For any questions about this Privacy Policy, or to exercise any of your rights under POPIA, please contact our Information Officer:
- By email: info@subtleconsulting.co.za
- By post: The Information Officer, Subtle Consulting (Pty) Ltd, Johannesburg, Gauteng, South Africa
Our Terms of Use are described separately in our Terms of Use.