Last updated: September 2026
1. Introduction & Scope
This Privacy Policy explains how ByTheodore collects, uses, discloses, and protects personal information in connection with this website (bytheodore.co.za), our enquiry and contact processes, and our client engagements. It is written to align with South Africa's Protection of Personal Information Act (POPIA), and, where relevant to international clients, with the principles of the EU General Data Protection Regulation (GDPR).
2. Responsible Party & Information Officer
ByTheodore is the "responsible party" (POPIA) / "data controller" (GDPR) for personal information collected through this website and our own business operations. For client engagement data processed on a client's behalf, the client is typically the responsible party and ByTheodore acts as an "operator" (POPIA) / "processor" (GDPR) — see Section 8. Our designated Information Officer can be reached at info@bytheodore.co.za.
3. Information We Collect
When you book a consultation, submit a contact or newsletter form, or otherwise get in touch, we collect your name, email address, phone number (where provided), company name (where provided), and the details of your enquiry. We may also collect browsing data through cookies to understand how the site is used — see our Cookie Policy for detail. Where you become a client, we collect further information necessary to scope and deliver the engagement.
4. Legal Basis for Processing
We process personal information on the following grounds: your consent (e.g. submitting an enquiry or newsletter form), the necessity of processing to take steps toward or perform a contract with you, and our legitimate interests in operating and improving our website and business, balanced against your rights.
5. How We Use Your Information
We use your information to:
- Respond to consultation requests and enquiries
- Scope, deliver, invoice, and support client engagements
- Improve our website and service offering
- Communicate important updates about work in progress
- Send newsletter updates, only where you have opted in, and you may unsubscribe at any time
6. Data Sharing & Sub-Processors
We do not sell, trade, or rent your personal information to third parties. We share data with service providers who help operate our website and services — including hosting and cloud infrastructure (AWS), email delivery, and analytics providers — under contractual confidentiality and security obligations, and only to the extent needed to provide their service to us.
7. Cross-Border Data Transfers
Some of our service providers, including AWS, may process or store data outside South Africa. Where personal information is transferred across borders, we take reasonable steps to ensure it receives a level of protection consistent with POPIA, including through contractual safeguards with our providers and, where practical, selecting data residency options within South Africa or comparable jurisdictions.
8. Client Data Confidentiality
Where an engagement involves access to a client's systems or data, that data is handled under the confidentiality terms agreed for that engagement and, where applicable, a signed Data Processing Agreement, and is not used for any purpose beyond delivering the work.
9. Data Retention
We retain enquiry and contact-form data for as long as reasonably necessary to respond to your enquiry and for a limited period afterward in case you follow up, after which it is deleted or anonymised if no engagement results. Client engagement data is retained for the duration of the engagement and thereafter as required by our contractual, tax, and legal obligations (commonly up to 5 years for financial records under South African law).
10. Data Security
We implement reasonable technical and organisational security measures to protect your personal information against loss, unauthorised access, and misuse. However, no method of transmission over the internet or electronic storage is 100% secure.
11. Data Breach Notification
If we become aware of a security compromise that has led, or may lead, to unauthorised access to or disclosure of personal information, we will notify the Information Regulator and affected data subjects as soon as reasonably possible, in line with POPIA's requirements, and take reasonable steps to contain and remediate the incident.
12. Automated Decision-Making
ByTheodore builds AI and automation systems for clients, but does not itself make solely automated decisions about you (a website visitor or enquirer) that produce legal or similarly significant effects, without the opportunity for human review.
13. Children's Privacy
Our website and services are directed at businesses and professionals. We do not knowingly collect personal information from children as defined under POPIA.
14. Your Rights
Subject to applicable law, you have the right to: access the personal information we hold about you; request correction of inaccurate information; request deletion or destruction of information we no longer have a lawful basis to hold; object to processing based on legitimate interest; and withdraw consent at any time where processing is based on consent. To exercise these rights, contact us at info@bytheodore.co.za. You also have the right to lodge a complaint with South Africa's Information Regulator (inforeg@justice.gov.za) if you believe your rights under POPIA have been infringed.
15. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be reflected by an updated "Last updated" date at the top of this page.
16. Contact
If you have questions about this Privacy Policy or how your data is handled, email us at info@bytheodore.co.za.