Privacy policy

Who is responsible

The responsible party for the personal information described here is:

Trading name

KODA

Email

hello@heykoda.co.za

Our Information Officer can be reached at hello@heykoda.co.za. Use this address for any privacy question or request.

What we collect, and why

We collect personal information only when you give it to us, plus basic technical data needed to run the site.

• Contact form. Your name and email address, and optionally your phone number, business name and message. The form prepares an email addressed to us in your own email app (or Gmail on a computer). Nothing reaches us until you press send in that email. We use it to reply to your enquiry and, if you go ahead, to prepare a quote.
• Free website check. The website address you enter, your email address and, optionally, your business name. We use them to run the check, produce your report and email it to you. You consent to this by ticking the box before you submit.
• Specialist audit request. If you ask for a detailed audit by a specialist: your email address, website address, business name if given, and optionally your phone number and a note. We use it to contact you about the audit.
• Emails and messages you send us. We keep them to answer you and to keep a record of what we agreed.
• Clients. If we work together, the contact, billing and business details and the content you supply (text, images, logos) so we can deliver and invoice the work.
• Monthly plans. To run a monthly plan we also need access to the accounts we manage for you, such as your website, Google Business Profile, Search Console, analytics, social media and advertising accounts. Wherever possible we ask you to give us access through each platform's own sharing or manager permissions, rather than sharing a password.
• Technical data. Our hosting provider records your IP address, browser and the pages requested in server logs, for security and to keep the site running. To prevent misuse of the free check, requests are limited per IP address; this count is kept briefly in the server's memory and is not saved to a database.

We do not use analytics, advertising or tracking tools on this website. We do not collect special personal information (such as health, religion or children's information), and this website is not directed at anyone under 18.

Our lawful basis

We process personal information because you ask us to (for example, to reply to an enquiry or send a report you requested), to take steps toward or perform an agreement with you, with your consent where you give it, and for our legitimate interests in running and securing the website, as POPIA allows. You may withdraw consent at any time; this does not affect what we did before.

Who we share it with

We do not sell personal information. We use these service providers to run the website and the free check, and they process information on our behalf:

• Vercel Inc. hosts the website and runs the program that performs the free check. It sees technical data such as IP addresses.
• Resend delivers the report and notification emails, so it handles your email address and the report content.
• Google (PageSpeed Insights) receives the website address you entered, to measure its speed. Google also receives data if you choose to load the map on our contact section, or if you use Gmail to send us a message.
• Anthropic, only if switched on, helps write the short summary at the top of your report. It receives the technical findings of the check, but not your name, email address or website address.

We may also disclose information where the law requires it, or to protect our rights.

Monthly plans and your customers' information

When we manage a client's website, search visibility, social media, campaigns or reporting, we may come across personal information about that client's own customers, website visitors, leads and followers. For example, names, email addresses and phone numbers in enquiries, messages and comments, website analytics, and advertising audiences.

• The client is responsible for it. For that information, the client is the responsible party under POPIA and we act as an operator. We process it only to deliver the services the client has asked for, and only on the client's instructions, under a written agreement.
• We keep it confidential and secure. We use it for no other purpose, and we do not use it to market our own services.
• Marketing rules. Email marketing and similar campaigns are sent only to people the client is entitled to contact, with a clear way to opt out, as POPIA requires. Clients remain responsible for having permission to use the people, images and content they ask us to publish.
• Tools. We may use tools such as Google Search Console, Google Analytics, Google Ads, Meta Business Suite and similar platforms, as the plan needs. Each has its own privacy terms, and information may be processed outside South Africa.
• If you are a client's customer. To see, correct or delete your information, please contact the business first. We will help them respond.

Sending information outside South Africa

These providers store and process information in other countries, including the United States. When we send personal information abroad, we use providers that are contractually bound to protect it, as section 72 of POPIA requires. By submitting a form you understand that your information may be processed in this way.

How long we keep it

We keep personal information only as long as needed for the purpose it was collected for. Enquiries that do not lead to work are deleted once they are no longer needed. Records about work we do and invoices are kept for as long as the law requires (for example, tax records are kept for five years). When a monthly plan ends, we stop using the access you gave us, and we delete or hand back the information we hold for you within a reasonable time, unless the law requires us to keep it. The free check is not stored in a database: your report is sent by email and we keep the email copy only as long as we need it to follow up.

How we protect it

We use reasonable technical and organisational measures: encrypted connections (HTTPS), access limited to people who need it, and providers with their own security controls. No system is perfectly secure. If a breach affects your personal information, we will notify you and the Information Regulator as POPIA requires.

Your rights

You can ask us to confirm whether we hold your personal information and to give you a copy, to correct it, or to delete it. You can object to our processing and withdraw consent. To do any of this, email hello@heykoda.co.za. We may need to confirm your identity first.

Marketing

We do not send marketing emails unless you have asked for them or have agreed to receive them. Every marketing message will have a simple way to opt out. Replying to your enquiry or sending the report you asked for is not marketing.

Complaints

If you think we have handled your information unlawfully, please tell us first so we can put it right. You may also complain to the Information Regulator (South Africa): inforegulator.org.za, email POPIAComplaints@inforegulator.org.za, JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001.

Cookies

See our cookie policy. In short, this website does not set tracking or advertising cookies.

Changes to this policy

If we change how we handle personal information, we will update this page and the date at the top.