Privacy notice
Draft, for legal review before publication. This text has not been approved. Items in square brackets are placeholders to be completed, and the technical statements should be confirmed against the live hosting configuration.
1. Who we are
This notice explains how [registered company name] (“ecosphere”, “we”, “us”) processes personal information when you visit this website at https://ecosphere.africa. For the purposes of the Protection of Personal Information Act 4 of 2013 (POPIA) we are the responsible party; where the EU or UK General Data Protection Regulation (GDPR) applies, we are the controller. Our information officer is [name], reachable at info@ecosphere.africa.
This notice covers the public website only. The ecosphere console, which clients sign in to separately, is covered by [the console privacy notice and the client agreement].
2. The short version
- The website is a set of static pages. It has no user accounts, sets no cookies, and uses no analytics, advertising or tracking tools.
- The contact form does not send anything to us. When you press its button, it opens your own email program with a message filled in; nothing is stored by the website. We only receive what you choose to send by email.
- Like any website, the servers that deliver it receive technical information such as your IP address in order to send you the pages.
3. What we process and why
| Information | Why | Basis |
|---|---|---|
| Emails you send us, including your name, work email, organisation and message | To reply to you, arrange a demo or pilot, and keep a record of our correspondence | Your consent and our legitimate interest in responding to enquiries; steps before entering into a contract |
| Technical request data: IP address, browser type, page requested, date and time | To deliver the website securely and to detect and prevent abuse | Legitimate interest in operating a secure website |
We do not use this information for automated decision-making or profiling, and we do not sell it.
4. Hosting and server logs
The website, including its typefaces, is served from our own domain; it loads nothing from other sites. It is hosted on Amazon Web Services (Amazon S3 and Amazon CloudFront). To deliver pages, these services process your IP address and request details. [Confirm whether CloudFront or S3 access logging is enabled. If it is: access logs are kept for [period] for security and troubleshooting and are then deleted. If it is not: we do not keep access logs.]
5. The contact form
The form on the contact page runs entirely in your browser. It checks that the required fields are filled in and then opens your email program with a message addressed to info@ecosphere.africa. Nothing is transmitted to us or stored by the website unless you send that email. Please do not include client or portfolio data in an email to us.
6. Sharing and international transfers
We share personal information only with service providers who help us run the website and our email, such as Amazon Web Services and [email provider], under contracts that require them to protect it. These providers may process information outside South Africa and outside your own country. Where that happens we rely on [adequate protection in the receiving country, binding agreements or your consent, as POPIA section 72 and the GDPR’s transfer rules require].
7. How long we keep it
We keep enquiry emails for [period, for example 24 months after our last contact] unless they become part of a client relationship, in which case the client agreement applies. Server logs, if kept, are deleted after [period].
8. Security
The website is served only over HTTPS, and the storage behind it is not publicly accessible. Access to our email and hosting accounts is restricted to the people who need it. No method of transmission or storage is completely secure, but we take reasonable technical and organisational measures appropriate to the information involved.
9. Your rights
Under POPIA you may ask whether we hold personal information about you, request access to it, ask us to correct or delete it, and object to its processing. Where the GDPR applies you also have rights to restrict processing, to data portability, and to withdraw consent at any time. To exercise any of these rights, write to info@ecosphere.africa; we may need to confirm your identity first.
If you are not satisfied with our response, you may complain to the Information Regulator (South Africa) at [Information Regulator contact details], or, where the GDPR applies, to the data protection authority in your country.
10. Children
The website is intended for professionals at financial institutions, companies and public bodies. It is not directed at children, and we do not knowingly collect information about them.
11. Changes
If the website starts to use cookies, analytics or a form that sends information to our servers, we will update this notice before that change goes live. The date at the top of this page shows when it last changed.