Privacy Policy

This Privacy Policy explains how JWD Website Design (Pty) Ltd ("JWD", "we", "us") collects, uses, stores and protects your personal information when you use our website and services. We are committed to protecting your privacy in accordance with the Protection of Personal Information Act, 2013 (POPIA).

Who we are

• Responsible party: JWD Website Design (Pty) Ltd
• Registration number: 2026/436461/07
• Information Officer: Shane Michiel Snyman (contact via info@jwd.co.za)
• Physical address: 50 Buitendag Street, Monte Vista, Western Cape, 7460
• Contact: info@jwd.co.za · +27 72 821 0139

What information we collect

We may collect the following personal information. Where it relates to a company, POPIA protects it too.

• Information you give us: name, email, phone, company, billing/address details and any message content when you enquire, request a quote, create an account or place an order.
• Domain registrant details: when you buy, renew or transfer a domain name, the registrant's full legal name (or company name), contact person, email address, phone number and physical address, as required by the domain registry.
• Account & order data: login credentials (passwords are stored hashed, never in plain text), order history, billing details and the outcome of your enquiries and orders.
• How you found us: when you send an enquiry or order, we record the website that referred you (the site's address only, never the full link), the first page you visited and any campaign tag in the link. We also keep simple counts of actions on our site, such as domain searches and clicks on our phone, email and WhatsApp links, together with the page and that referring site. These records contain no name, email, IP address or cookie identifier.
• Technical & usage data: with your consent, analytics such as pages visited, device and browser type, collected via cookies (see below). Our hosting and security providers also process technical data such as IP addresses and browser details to deliver the website and protect it from attacks.
• Payment data: card payments are processed by our payment processors. We never see or store your full card number. If you choose to save a card for future renewals (when this option is available), the card is stored by the payment processor, and we keep only a reference to it, never the card number.

How we use your information

• To respond to enquiries and quote requests.
• To provide, manage and bill for our website design, hosting, domain and SEO services.
• To register, renew, transfer and manage domain names on your behalf, including DNS and nameserver changes you ask for.
• To send you service messages, such as order confirmations, renewal reminders and notices about changes to your domains or hosting.
• To process orders and payments and manage your account.
• To understand which channels bring us enquiries, and to improve our website and services (analytics only with consent).
• To prevent fraud and abuse, and to keep our systems and your account secure.
• To meet legal, tax and regulatory obligations.

We process your information on the lawful bases of the performance of a contract with you (or steps to conclude one), your consent where we ask for it, our legitimate business interests, and compliance with the law.

Domain names: registrars, registries and public WHOIS

We resell domain names through an accredited domain registrar. To register, renew or transfer a domain name, we must send the registrant details listed above to that registrar, which sends them to the registry that runs the domain ending:

• .co.za: the ZA Registry Consortium (ZARC), the registry operator for .co.za.
• .com: the .com registry operator, through an ICANN-accredited registrar.

Supplying these details is mandatory. Without them, a domain name cannot be registered, renewed or transferred. The registry rules require the details to be accurate and kept up to date, and a domain may be suspended or withdrawn if they are not, or if consent to this processing is withdrawn.

What is public. Domain registries publish some registrant details in their public WHOIS/RDAP look-up service. For .co.za, this currently includes the registrant organisation, province and country, while the registrant's name, address, phone number and email are withheld from the public look-up but may be released to the registry, the registrar, people with a demonstrated legal claim to a domain name, courts and law enforcement. For .com, what is published depends on the registrar's policy, and we will tell you on request.

Registry backups outside South Africa. Registries keep secure backup (escrow) copies of registration data. ZARC lodges its escrow deposits with DENIC in Germany. The .com registry and the registrars that serve it may process registration data in the United States and elsewhere.

The registrar and the registries process this information for their own purposes as well, under their own policies, and are not simply acting on our instructions. You can ask us to correct your registrant details at any time.

Websites, email and forms we host or build for our clients

When we host or build a website, email service or online form for a client, the personal information of that client's visitors and customers belongs to the client. The client is the responsible party and JWD acts as its operator under section 21 of POPIA: we process that information only on the client's instructions, keep it confidential and secure, tell the client immediately if we suspect unauthorised access to it, and delete or return it when the service ends. Questions about that information should go to the client whose website it is.

Cookies & tracking

We use essential cookies needed for the site to function (for example, your shopping cart and login session). With your consent we also use analytics and marketing cookies, including Google Analytics and the Meta (Facebook) Pixel, to understand traffic and improve our marketing. These non-essential cookies only load after you click "Accept" on our cookie banner. You can change your choice at any time:

Change my cookie choice

Who we share information with

We share personal information only where needed to provide our services, run our business or meet the law:

• Payment processors: Yoco, and Paystack once enabled, to process payments and refunds (and, where you choose it, to store a card for renewals).
• Domain registrar and registries: as described in the domain names section above.
• Hosting and email infrastructure providers: South African data centres that host our website, our clients' websites and email, and send our service emails.
• Cloudflare: content delivery and security services that sit in front of our website and process technical data such as IP addresses.
• Google (Analytics): website analytics (with consent).
• Meta (Facebook Pixel): advertising measurement (with consent).
• Tawk.to: live chat support.
• Professional advisers and authorities: our accountants, attorneys and auditors, and courts, regulators or law enforcement where the law requires it.

We do not sell your personal information. Where a provider processes personal information on our behalf, we use providers whose terms commit them to process it only on our instructions and to keep it secure, in line with section 21 of POPIA. Some recipients, such as payment processors, domain registrars and registries, also process information for their own purposes under their own privacy policies.

Cross-border transfers

Some recipients process data on servers outside South Africa, including the domain registry escrow and .com registration services described above, our security and content delivery provider, and our analytics, advertising and live chat providers. We transfer personal information across borders only where section 72 of POPIA allows it, for example where the recipient is bound by laws, binding corporate rules or an agreement giving adequate protection, where the transfer is necessary to perform a contract with you (such as registering the domain name you ordered), or with your consent.

Automated decision-making

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

Children

Our services are not directed at children under 18, and we do not knowingly collect personal information from children. If you believe we have inadvertently done so, please contact us and we will delete it.

Consent

Where we rely on your consent, for example for analytics and marketing cookies, saving a card for renewals, or the domain registry processing described above, we ask for it clearly and you may withdraw it at any time by contacting our Information Officer. Withdrawing consent does not affect processing that already took place, and some processing continues where we have another lawful basis, such as a contract with you or a legal obligation. Withdrawing consent for domain registry processing may mean the domain name cannot be kept registered.

Data breaches

In the event of a security compromise affecting your personal information, we will notify the Information Regulator and any affected persons as soon as reasonably possible, in accordance with section 22 of POPIA. We notify you by email to the address on your account, or by another method the Regulator approves.

Marketing

We may email existing clients about our own services that are similar to the ones they already use, as section 69(3) of POPIA allows. Every such email has a free, one-click way to opt out. We do not send marketing to anyone else without their consent, and we never sell or rent our client list.

How long we keep it

We keep personal information only for as long as necessary for the purposes set out above, or as the law requires:

• Invoices, orders and payment records: 5 years, for tax purposes.
• Account details: while your account is active. Ask us to close your account and we delete your details, except the order and invoice records the law requires us to keep.
• Domain registrant details: while we manage the domain for you, and then for 5 years as part of the transaction record. Registrars and registries keep their own records under their own policies.
• Enquiries and quote requests that did not lead to work: 24 months.
• Security and server logs: kept by our hosting and security providers under their own retention policies, for a limited period.
• Website files and email on hosting: 30 days after the hosting service ends, as set out in our Terms.

How we protect it

We apply reasonable technical and organisational safeguards, including encrypted (HTTPS) connections, hashed passwords, access controls, a web application firewall and security filtering in front of our website, and backups. No method of transmission over the internet is completely secure, but we take all reasonable steps to protect your data.

Your rights under POPIA

You have the right to:

• Request access to the personal information we hold about you.
• Request correction or deletion of your information.
• Object to processing or withdraw consent.
• Lodge a complaint with the Information Regulator.

To exercise any of these rights, contact our Information Officer at info@jwd.co.za. We respond within 30 days. Requests for access to records may also be made under the Promotion of Access to Information Act, 2000: see our PAIA manual.

Information Regulator (South Africa): enquiries@inforegulator.org.za · inforegulator.org.za

Changes to this policy

We may update this Privacy Policy from time to time. The current version is always published on this page with the date it was last updated. Where a change materially affects how we use personal information we already hold, we will also tell account holders and active clients by email before it takes effect.