Privacy Policy
Effective: 20 June 2025 · Last Updated: 24 October 2026
TL;DR - Your Privacy at a Glance
The Design Hammock collects only the data needed to deliver our web development services and improve your browsing experience. We never sell your personal information. Analytics are collected only with your consent. You can access, correct, or delete your data at any time via WhatsApp, email, or in person. We comply with POPIA, GDPR, and CCPA.
Responsible Party
Under the Protection of Personal Information Act, 2013 (POPIA), the responsible party (equivalent to "data controller" under GDPR) for this website is:
Registered Entity
The Design Hammock PTY (Ltd)
Information Officer (POPIA §55)
Graeme Ford
Privacy Email
privacy@thedesignhammock.co.zaPhysical Address
159 Maria Bronkhorst Road, Ashlea Gardens,
Pretoria, 0081, South Africa
What We Collect
Information You Provide Directly
- •Contact information: name, work email address, phone number, company/project name
- •Project details: your answers to the three Start a Project questions (what you need help with, your industry and your team size), and your website's address if you want help with it
- •Communication records: messages sent via WhatsApp, email, or the Start a Project form
Information Collected Automatically
- •Device and browser data: IP address (Google Analytics does not store it; Google reCAPTCHA receives it on the Start a Project form, see Data Processors), browser type and version, operating system, screen resolution
- •Usage data: pages visited, session duration, click interactions, scroll depth, referral source
- •Quote, invoice and email activity: when you open a quote, revision or payment link we sent you, we note when and how often, so we know you've seen it. We also keep a record of each email we send you and whether it was delivered, for 12 months. Neither uses a cookie or a tracking pixel. If an address bounces or marks our emails as spam, we keep it until the hold is lifted, so we stop emailing it.
- •Cookies and similar technologies: see our Cookie Policy for a full inventory
Purpose of Collection
Under POPIA §13, we process personal information only for specific, explicitly defined, and lawful purposes. Our lawful bases for processing under POPIA, GDPR, and CCPA are:
| Purpose | Lawful Basis (POPIA) | GDPR Basis |
|---|---|---|
| Respond to enquiries and deliver services | Contract (§11(1)(b)) | Art. 6(1)(b) - Contractual necessity |
| Process payments and invoices | Contract (§11(1)(b)) | Art. 6(1)(b) - Contractual necessity |
| Website analytics | Consent (§11(1)(a)) | Art. 6(1)(a) - Consent |
| Advertising conversion tracking | Consent (§11(1)(a)) | Art. 6(1)(a) - Consent |
| Improve website performance and UX | Legitimate interest (§11(1)(f)) | Art. 6(1)(f) - Legitimate interest |
| Legal compliance (tax, regulatory) | Legal obligation (§11(1)(c)) | Art. 6(1)(c) - Legal obligation |
Voluntary vs Mandatory Information
In line with POPIA §18(1)(c), we distinguish between information you must provide and information that is optional:
Required Fields
Your name, work email, and phone number are required to process your enquiry via the Start a Project form.
Consequence of non-provision: If you do not provide these fields, we will be unable to respond to your enquiry or deliver our services.
Optional Fields
Your website's address is optional: it is asked only when you want help with a site you already have. Providing it helps us prepare for your call, but it is not required.
How We Use Your Data
- Service delivery: to scope your project, generate proposals, onboard you as a client, and deliver agreed-upon web development services.
- Communication: to respond to enquiries via WhatsApp, email, or the contact form, and to provide project updates.
- Website improvement: to analyse anonymous usage patterns (with consent), identify UX bottlenecks, and optimise page performance.
- Advertising measurement: to measure the effectiveness of Google Ads campaigns and attribute conversions (with consent).
- Legal and regulatory: to comply with South African tax law, Companies Act requirements, and respond to lawful requests from regulatory bodies.
We never sell your personal information to third parties.
Third-Party Processors
We share personal information with the following sub-processors (referred to as "operators" under POPIA §1). Each operates under a data processing agreement and implements appropriate safeguards:
Google (Analytics, Consent Mode v2 & Google Ads)
Consent signal management, website analytics, advertising conversion measurement, and - where you consent and we run a campaign - matching an enquiry to the advertising click that produced it
United States
EU-U.S. Data Privacy Framework, Standard Contractual Clauses
Google reCAPTCHA
Telling people from automated spam on the Start a Project form only. Google receives your IP address and information about your browser and how you use that page, and returns a score; we keep the score's verdict, not the information
United States
EU-U.S. Data Privacy Framework, Standard Contractual Clauses
Cal.com
Booking your enquiry call: when you book a time, Cal.com keeps the booking with your name and email (filled in from Start a Project), sends the confirmation, and tells us the call is booked. It never receives your answers or your phone number
United States
Cal.com's Data Processing Agreement, Standard Contractual Clauses
Google Workspace (Calendar and Meet)
Holding your call: the booking appears in our calendar, and the video call is on Google Meet
United States
EU-U.S. Data Privacy Framework, Standard Contractual Clauses
Google Firebase
Performance monitoring, A/B testing (future planned integration)
United States
EU-U.S. Data Privacy Framework, ISO 27001, SOC 2 certified
Paystack (a Stripe company)
Processing client invoice and subscription payments. Card details are entered on Paystack's own secure page and tokenised there. We never see or store card numbers.
South Africa
PCI DSS Level 1 certified
Your Google Analytics identifier, kept with an enquiry
If you have accepted analytics cookies and send us a request through Start a Project, we keep the Google Analytics identifier from your browser with your request. We use it for one thing: to tell Google Analytics when that enquiry later becomes a quote, an accepted project or a declined one, so we can see which pages lead to real work.
- It is a random number, not your details. Google Analytics sets it in a cookie. What we send with it is the stage the enquiry reached, the page that sent you to us, the answers you picked to the three Start a Project questions (the kind of help, your industry and your team size, as set categories), and the value of a quote we issued: never your name, contact details or anything you typed.
- It only happens with your consent. If you have declined analytics cookies, we don't read it and don't keep it, and nothing about your enquiry reaches Google Analytics.
- It is deleted with your enquiry. It is kept only as long as the enquiry record itself (see Data Retention, below).
Cross-Border Transfers
The Design Hammock is based in South Africa. Some of our third-party processors operate servers in the United States, meaning your personal information may be transferred outside of the Republic of South Africa.
Under POPIA §72, cross-border transfers are permitted where the recipient country has adequate data protection laws, or where appropriate safeguards exist. We ensure compliance through:
- •Standard Contractual Clauses (SCCs) approved by the European Commission
- •Data processing agreements with all sub-processors
- •Encryption in transit (TLS 1.2+) and at rest where applicable
- •Regular review of processor compliance certifications (SOC 2, ISO 27001)
Data Retention
We retain personal information only as long as necessary to fulfil the purposes outlined in this policy, or as required by law (POPIA §14):
| Data Category | Retention Period |
|---|---|
| Form submissions and enquiries | Duration of business relationship + 2 years |
| Client project records and invoices | 5 years (SA Tax Administration Act requirement) |
| Analytics data | 14 months (Google Analytics data retention) |
| Cookie consent preferences | 12 months (re-consent then required) |
When data is no longer required, it is securely deleted or anonymised so it can no longer be linked to you.
Your Rights
Under POPIA (All South African Data Subjects)
POPIA §23-25 grant every data subject the following rights:
- •Access (§23): request confirmation of whether we hold your data and obtain a copy
- •Correction (§24): request correction or deletion of inaccurate, irrelevant, excessive, out-of-date, incomplete, misleading, or unlawfully obtained information
- •Deletion (§24): request destruction of personal information that is no longer needed
- •Objection (§11(3)): object to processing based on legitimate interest or for direct marketing purposes
Additional Rights Under GDPR (EEA/UK Residents)
If you are located in the European Economic Area or United Kingdom, you additionally have the right to:
- •Data portability (Art. 20): receive your data in a structured, commonly-used, machine-readable format
- •Restriction of processing (Art. 18): request that we limit how we use your data while a dispute is being resolved
- •Withdraw consent (Art. 7(3)): withdraw consent at any time without affecting the lawfulness of prior processing
- •Lodge a complaint: file a complaint with your local supervisory authority
California Residents (CCPA/CPRA)
If you are a California resident, the CCPA and CPRA grant you the following rights:
- •Right to know: request disclosure of the categories and specific pieces of personal information we have collected
- •Right to delete: request deletion of personal information we have collected from you
- •Right to opt out of sale: we do not sell personal information - this right is already satisfied
- •Right to non-discrimination: we will not discriminate against you for exercising any CCPA rights
How to Exercise Your Rights
In accordance with POPIA's 2025 multi-channel compliance guidelines, you may exercise any of the rights listed above via the following channels:
WhatsApp (Preferred)
Send a message to our Information Officer via WhatsApp. This is the fastest channel, with a typical response inside one business day.
Send a written request to privacy@thedesignhammock.co.za. We will respond within 30 days as required by POPIA.
In Person
Visit our office at 159 Maria Bronkhorst Road, Ashlea Gardens, Pretoria, 0081 during business hours (Monday to Thursday, 08:00-16:00, and Friday, 08:00-14:00 SAST, by appointment).
We may require proof of identity before processing your request to protect the security of your personal information.
Cookies
Our website uses cookies and similar tracking technologies to provide essential functionality and, with your consent, to measure website performance and advertising effectiveness. We implement Google Consent Mode v2 to ensure that no optional cookies are set before you provide explicit consent.
For a detailed breakdown of all cookies used, their purposes, and retention periods, please refer to our Cookie Policy.
Changes to This Policy
We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes:
- •We will update the "Last Updated" date at the top of this page
- •For significant changes affecting your rights, we will notify you via email (if we have your address) or through a prominent notice on our website
- •Where required by law, we will obtain fresh consent before applying new processing activities
We encourage you to review this policy periodically. Continued use of our website after changes are posted constitutes your awareness of those changes.
Complaints
If you believe we have violated your privacy rights, we encourage you to first contact our Information Officer (details above) so we can attempt to resolve the issue directly. If you are not satisfied with our response, you have the right to lodge a complaint with:
The Information Regulator (South Africa)
EEA/UK residents may also lodge a complaint with their local supervisory authority. California residents may contact the California Attorney General's office.