← Back to Creativ360

Privacy policy

Last updated 7 November 2026

1. Who we are

This website (creativ360.com) and the services described on it are provided by Creativ360 (Pty) Ltd, a company registered in South Africa under registration number 2018/313314/07, with its registered address at 43 Malva Street, Dana Bay, Mossel Bay, Western Cape, South Africa ("Creativ360", "we", "us"). We are a software consultancy: we design, build, run and secure software for our clients.

For the purposes of the Protection of Personal Information Act 4 of 2013 ("POPIA") and the EU General Data Protection Regulation ("GDPR"):

  • we are the responsible party (POPIA) and controller (GDPR) for the personal information of people who visit our website, contact us, or are our clients, suppliers or their contact persons; and
  • we act as an operator (POPIA) and processor (GDPR) for personal information that a client gives us access to while we work on its systems, data or software (see section 4).

Our Information Officer is Pieter Jordaan. You can reach them at [email protected]. For any privacy question, access request or complaint you can also use the contact details on our website.

2. What this policy covers

This policy applies to the creativ360.com website, to e-mail, telephone and WhatsApp conversations with us, to our consulting and development engagements, and to any software, apps or integrations that Creativ360 itself operates under its own name (for example an app registered with a third-party platform). Software we build for a client and that the client operates is covered by the client's own privacy policy. This policy does not cover third-party websites we link to.

3. The information we hold

Contact and enquiry information. Your name, e-mail address, telephone number, company and role, and what you tell us when you contact us by e-mail, telephone or WhatsApp, together with our replies.

Client and supplier information. For the organizations we work with: the names and contact details of their contact persons, proposals, statements of work, contracts, project correspondence, meeting notes, and invoicing and payment details (such as billing address, VAT number and bank reference). We do not store card numbers.

Client data we work on. During an engagement a client may give us access to its source code, systems, databases, cloud accounts or documents, which can contain personal information of the client's own customers or staff. We use that access only to do the work the client asked for (section 4).

Information from apps we operate. If you sign in to or connect your account to software that Creativ360 operates under its own name, we receive the information that you authorize, such as your name, e-mail address, profile picture and the account or page identifiers needed for the feature you use. We use it only to provide that feature, and you can disconnect at any time.

Technical data. When you visit our website, our hosting and network providers record standard request information (IP address, browser type, the page requested and the time) for security and fault finding. Our website loads fonts from Google Fonts, which means your browser connects to Google and Google receives your IP address.

4. Why we use it, and our legal bases

  • To answer your enquiry and prepare a proposal: steps taken at your request before entering into a contract, and our legitimate interests.
  • To deliver our services and manage the client relationship: performance of a contract.
  • To invoice and keep financial records: contract and legal obligation (tax and company law).
  • To keep our website, systems and apps secure and prevent abuse: our legitimate interests.
  • To provide the features of an app we operate that you choose to use: performance of a contract, or your consent, which you can withdraw by disconnecting.
  • To send you news about our services, if we do: your consent, or for existing clients our legitimate interests as POPIA allows, and you can opt out at any time. We send no unsolicited marketing.

Client data. For personal information in client systems and data, the client decides why and how it is processed. We process it only on the client's documented instructions, keep it confidential, apply appropriate security measures, and return or delete it when the engagement ends. The client is responsible for having a lawful basis for it. Where a client needs a data processing agreement, we sign one as part of the engagement.

5. What we do not do

We do not sell personal information. We do not use client data, client source code or personal information we receive through an app to train any AI model, or for any purpose other than the one it was given to us for. Where we use AI-assisted tools in our engineering work, we use them under business terms that do not allow the provider to train on the data, and only where the client has agreed.

6. Who we share information with

We use a small number of service providers. They may process personal information only on our instructions and under confidentiality and security obligations.

  • Website hosting: Namecheap (servers in Phoenix, Arizona, United States).
  • Network and security: Cloudflare, which sits in front of our website.
  • E-mail and documents: Google Workspace.
  • E-mail delivery: SendGrid (Twilio), for e-mails sent from our website, systems and apps.
  • Messaging: WhatsApp (Meta), if you choose to contact us that way.
  • Accounting and banking providers, for invoicing and payments.
  • Subcontractors who help us deliver an engagement, under written confidentiality obligations and, for client data, only with the client's agreement.

We may also disclose information where the law or a court requires it, to protect our rights or the safety of others, or in connection with a sale or restructuring of our business (the buyer would be bound by this policy). A current list of our service providers is available on request.

7. Transfers outside South Africa and the EEA

Some of our providers process information in other countries, including the United States. Where personal information leaves South Africa we make sure it is protected as section 72 of POPIA requires (a recipient bound by law, binding rules or an agreement that gives substantially similar protection, or with your consent). Where personal information of people in the European Economic Area or the United Kingdom is transferred to a country without an adequacy decision, we rely on the European Commission's standard contractual clauses (and the UK addendum) or another lawful transfer mechanism.

8. How long we keep information

  • Enquiries that do not lead to work: for 2 years after our last contact.
  • Client and supplier records and project correspondence: for the duration of the relationship and 5 years after it ends.
  • Billing and tax records: for 5 years, the period the law requires in South Africa.
  • Client data we work on: only for as long as the engagement needs it; we return or delete it when the engagement ends, unless the client asks otherwise in writing or the law requires us to keep it.
  • Information from apps we operate: for as long as your account stays connected, and deleted within 30 days after you disconnect or ask us to delete it.
  • Server logs: for up to 90 days.

9. Cookies

Our website sets no cookies of its own and uses no analytics, advertising or tracking. Cloudflare may set a strictly necessary security cookie to protect the site from abuse. If we add analytics or any non-essential cookie, we will update this policy and ask for your consent first where the law requires it.

10. Security

We protect information with measures appropriate to the risk, including encryption in transit, access limited to the people who need it, multi-factor authentication on our accounts, and separate, least-privilege access to each client's systems. No system is perfectly secure. If a breach affects your personal information we will notify you and the Information Regulator (and, under the GDPR, the competent supervisory authority) as the law requires and without undue delay; where client data is affected, we notify the client so that it can meet its own obligations.

11. Your rights

Under POPIA and the GDPR you can ask us to:

  • tell you whether we hold your personal information and give you a copy;
  • correct or complete it;
  • delete it, or restrict or object to our processing of it, where the law gives you that right;
  • give you your information in a portable format (GDPR);
  • stop sending you marketing, and withdraw any consent you gave;
  • not subject you to a decision based solely on automated processing that significantly affects you. We do not make such decisions about people.

Write to our Information Officer. We may need to confirm who you are first and will answer within the time the law allows (one month under the GDPR; a reasonable time under POPIA). If your information is in a client's systems, we may refer your request to that client, who controls it.

To delete information we received through an app we operate, disconnect the app in your account settings on the platform concerned, or e-mail our Information Officer with the subject "Data deletion request"; we will confirm when it is done.

You may also complain to a regulator. In South Africa that is the Information Regulator (inforegulator.org.za; complaints e-mail: [email protected]). If you are in the European Economic Area or the United Kingdom you can complain to your local data protection authority. We would appreciate the chance to put things right first.

12. Children

Our website and services are for businesses and professionals and are not directed at children. We do not knowingly collect personal information of children; if you think we have, tell us and we will delete it.

13. Changes to this policy

We may update this policy as our services or the law change. We will change the date at the top and, for material changes, tell our clients before the change takes effect.

14. Contact

Creativ360 (Pty) Ltd, 43 Malva Street, Dana Bay, Mossel Bay, Western Cape, South Africa. Registration number 2018/313314/07. Information Officer: Pieter Jordaan, [email protected]. General enquiries: [email protected].