Legal

Privacy Policy

Last updated: 3 September 2026

This policy explains what personal information Digital Fold collects, why we collect it, who we share it with and what you can do about it. It is written to meet our obligations under the Protection of Personal Information Act 4 of 2013 (POPIA) and the Electronic Communications and Transactions Act 25 of 2002 (ECTA).

We have tried to write it in plain language. If anything here is unclear, email us at hello@digitalfold.co.za and we will explain it.

1. Who is responsible for your information

Digital Fold is the responsible party for the personal information described in this policy. That means we decide what is collected and why.

2. What we collect

Information you give us

We only ask for what we need to reply to you and do the work.

  • Contact and project enquiries: your name, email address, telephone number, company name, the service you are interested in, and whatever you write in the message field.
  • Newsletter signup: your first name and email address.
  • Client work: if you become a client, the information needed to run the project and invoice you — billing details, account logins you choose to share with us, and the content you supply for your website.

Information collected automatically

Our website is a set of static pages, and it sets no cookies of its own. It runs no advertising or tracking software of any kind. What is collected automatically is limited to:

  • Server logs kept by our host, Netlify — your IP address, browser type and version, the pages you requested and when. These are used to serve the site, diagnose faults and detect abuse.
  • Reviews widget: if you scroll to the Google reviews on our site, the widget provider (Elfsight) receives your IP address and browser information and sets two cookies.
  • Analytics, if you accept: we use Google Analytics to see which pages get visited and roughly how people find us — pages viewed, referring site, device and browser type, and approximate location from your IP address, never the address itself. It does not run unless you accept cookies, and it sets two cookies of its own.

Both of the above are opt-in through the cookie banner on first visit. See our Cookie Policy for the full detail, including exactly which cookies are set and how to control them.

What we do not collect

We do not knowingly collect special personal information as defined in POPIA section 26 — such as your race, health, religious or political beliefs, biometric data, or criminal record — and we ask that you do not send it to us. We do not collect the personal information of children under 18 (POPIA section 34). If you believe a child has given us their information, contact us and we will delete it.

3. Why we process it, and on what legal basis

POPIA requires a lawful justification for every use of your information. Ours are:

  • To answer your enquiry — you gave us the information for exactly this purpose, so we rely on your consent, and on the steps needed to enter into a contract with you.
  • To deliver work you have engaged us for — necessary to perform our contract with you.
  • To send you marketing you asked for — your consent, which you can withdraw at any time.
  • To keep the site secure and working — our legitimate interest in running a website that is not being attacked or abused.
  • To meet legal duties — for example keeping invoices and tax records for the periods the law requires.

4. Direct marketing

Section 69 of POPIA is strict about unsolicited electronic marketing. We follow it:

  • We only send marketing emails to people who have asked to receive them, or who are existing clients.
  • Every marketing email has a working unsubscribe link, and we act on it.
  • We do not sell, rent or trade your details to anyone for their own marketing.
  • You can opt out at any time by clicking unsubscribe or emailing hello@digitalfold.co.za. Opting out of marketing does not stop necessary emails about work we are doing for you.

5. Who we share it with

We do not sell your personal information. We share it only with the service providers we need to run the business. POPIA calls these operators, and section 21 requires each of them to be under a written contract to keep your information confidential and secure.

  • Netlify — Website hosting and content delivery.
    Receives: IP address, browser type, pages requested, timestamps (standard server logs).
    Processed in: United States, with edge servers worldwide. Privacy policy
  • Resend — Delivers the emails generated by our contact, project and newsletter forms.
    Receives: Everything you type into a form — typically your name, email address, phone number and message.
    Processed in: United States. Privacy policy
  • Sender — Runs our newsletter — stores subscribers and sends the emails.
    Receives: Your first name, surname and email address when you subscribe, plus whether you opened or clicked an email.
    Processed in: European Union (Lithuania). Privacy policy
  • Elfsight — Displays our Google reviews widget.
    Receives: IP address and browser information, collected by Elfsight when the widget loads.
    Processed in: United States / European Union. Privacy policy
  • Google — Source of the review content and reviewer profile images shown in the reviews widget.
    Receives: Requests for reviewer profile images made by your browser.
    Processed in: United States and globally. Privacy policy
  • Google Analytics (GA4) — Measures site traffic — pages viewed, how you arrived, device and rough location — via Google Tag Manager (container GTM-WMMFVC4).
    Receives: Pages visited, referring site, device/browser info, and an identifier stored in the _ga cookies below. Only runs if you accept cookies..
    Processed in: United States and globally. Privacy policy

We may also disclose information where the law requires it, to a court or regulator, or to establish or defend a legal claim.

6. Sending information outside South Africa

Several of the providers above are based outside South Africa, mainly in the United States, so your information is transferred across borders. Section 72 of POPIA permits this where one of a set of conditions is met. We rely on the following:

  • the provider is bound by a written contract that upholds standards of protection substantially similar to POPIA; and
  • where the transfer follows from your enquiry or your contract with us, that the transfer is necessary to perform it.

If you would like to know which providers hold your information and where, email us and we will tell you.

7. How long we keep it

POPIA section 14 says we may not keep information longer than we need it. In practice:

  • Enquiries that do not become projects — kept for up to 24 months, then deleted, in case you come back to us.
  • Client records and project files — kept for the life of the relationship and then for 5 years, so we can support work we built and defend any claim about it.
  • Invoices and financial records — kept for 5 years, as tax law requires.
  • Newsletter subscribers — kept until you unsubscribe.
  • Server logs — kept for the short retention period set by our host.

8. How we protect it

Section 19 of POPIA requires appropriate technical and organisational safeguards. Ours include serving the entire site over HTTPS, keeping form submissions encrypted in transit, limiting access to client information to the people who need it, using reputable providers with their own security programmes, running no advertising trackers at all, and gating even our own analytics behind explicit consent — the information we never collect, or never collect without your say-so, cannot leak.

No system is perfectly secure. If a breach occurs that creates a real risk of harm to you, section 22 requires us to notify both the Information Regulator and you, and we will.

9. Your rights

Under POPIA you may:

  • Ask what we hold about you and be given a copy (sections 23 and 25);
  • Ask us to correct or delete information that is wrong, misleading, irrelevant, excessive, out of date or obtained unlawfully (section 24);
  • Object to processing based on legitimate interest, on reasonable grounds (section 11(3));
  • Withdraw consent at any time, which stops future processing that relied on it;
  • Object to direct marketing at any time (section 69);
  • Complain to the Information Regulator.

To exercise any of these, email caitlin@digitalfold.co.za. We will respond within a reasonable time and normally within 30 days. We may need to confirm your identity first, so that we are not handing your information to someone else. Access requests are handled under the Promotion of Access to Information Act 2 of 2000 (PAIA); a fee may apply for copies, as prescribed by that Act.

10. Complaining to the regulator

If you are not satisfied with how we have handled your information or your request, you may complain to the Information Regulator (South Africa):

11. Links to other websites

Our site links to other places — client work, our social profiles, articles we reference. Once you follow a link you are on someone else's site, governed by their privacy policy, not this one. We are not responsible for how they handle your information.

12. Changes to this policy

We update this policy when what we do changes — for example if we add analytics, a booking tool or a new provider. The date at the top always reflects the current version. Where a change materially affects your rights, we will tell subscribers and active clients directly rather than relying on you to notice.

13. Contact

Questions, requests or complaints about this policy or your information: hello@digitalfold.co.za, or write to us at 84 Bree Street, Cape Town, 8001, South Africa.

This policy describes our actual practices and is written to meet POPIA and ECTA. It is not legal advice, and it is not a substitute for having it reviewed by an attorney against your specific circumstances before you rely on it.

Let’s talk

Got a project in mind?

Start a project