Privacy notice

Who is responsible

Legacy Live Web (Pty) Ltd, registration number 2019/034831/07, based in Bloemfontein, South Africa, runs this website and is responsible for the personal information collected through it. POPIA calls this the 'responsible party'. In this notice, 'we' and 'us' mean Legacy Live Web (Pty) Ltd.

Our physical address is 10 Werda Crescent, Uitsig, Bloemfontein, South Africa.

This notice covers what you send us through this website and the messages you send us directly. Other websites we link to have their own privacy notices.

Who to contact

Our Information Officer is Ryan Mayne. You can reach them at [email protected]. Contact them to ask what we hold about you, to use any of the rights in this notice, or with any question about it.

What we collect, and why

We collect only what you choose to send us, plus the technical details every website receives. Here is each way information reaches us.

The contact form

What we keep: your name, email address, message and the topic you chose, and if you give them, your phone number and organisation. We add the date and time, a reference number, the page you sent it from, and a record of your consent: when you sent the form, and which version of the consent wording you agreed to.

Why: to reply to you and deal with what you asked about, with your consent. A copy of each enquiry is emailed to our team.

The cost estimator

While you choose options on the estimate page, your choices are sent to our server to work out the range. Your choices are not stored at that point; only the spam-protection count described below is.

What we keep if you send it to us: your choices, the figures and the version of our price list they came from; your name and email address, and if you give them, your phone number, organisation and message; a reference number, the page, the date and time, and your consent record, as for the contact form.

Why: to talk your project through with you. A copy of each request is emailed to our team. If you ask for a copy, we email you the figures and the reference number only.

Anonymous feedback

What we keep: your message, your rating if you choose one, and the date you sent it, without the time.

What we do not keep: your name, email address, IP address or browser details. The form does not ask for them. If you write your name in the message, it is kept as part of the message.

Why: to learn what we do well and what to improve. Each message is also emailed to our team, so the copy in our inbox shows the time it arrived. Feedback is not stored with your name or email address, so we cannot look it up by them. If you wrote your name or other details in a message, tell us roughly what it said and when you sent it, and we will find and delete it.

Spam and abuse protection

To stop automated abuse, our forms count how often they are used from the same connection in a short time. They count with a scrambled code made from your IP address, a secret key and the date (a 'salted hash'), which changes every day. The code is held in a temporary store and deleted within about a day after the counting period ends (at most two days). It is never stored with what you send, and your IP address itself is not stored.

If spam protection by Cloudflare Turnstile is switched on, a short check runs in your browser when you open a page with one of our forms (contact, feedback or estimate). Cloudflare receives technical details from your browser, including your IP address, to tell people from bots, and handles them under its own privacy policy. Our server sends Cloudflare only the result of that check, not your form or your IP address.

Bookings

We manage consultation bookings in IBIS, a system we make and run. Whether you book online or we agree a time with you, IBIS holds the booking: your name, your contact details, the time, and anything you tell us about the meeting. We use it to arrange and hold the consultation.

WhatsApp and email

If you message us on WhatsApp or email us, we receive your phone number or email address, the name on your account, and what you write. We use it to reply. WhatsApp is run by WhatsApp, part of Meta, and its own privacy policy covers how it handles your messages.

Member accounts

If you have an account in our member area, we hold the details of that account, such as your username and email address, and your password in a scrambled form that we cannot read. We use them to let you log in.

Technical data and server logs

Like every website, ours receives technical details each time a page loads: your IP address, the date and time, the page you asked for, the page you came from and your browser type. Our hosting provider's web server records these in access logs, for security and to fix problems. This happens on every page, the anonymous feedback form included. If the site is served through Cloudflare, Cloudflare keeps similar logs.

Cookies

Cookies are small files a website stores in your browser.

• Our pages and forms do not set cookies.
• WordPress sets cookies only when someone logs in, for example to the member area. They keep you signed in and expire after a set time.
• If the site is served through Cloudflare, Cloudflare may set a security cookie that helps it filter out bots.
• If Turnstile spam protection is switched on, its check runs on pages with a form.

We do not use analytics, advertising or tracking cookies. You can block or delete cookies in your browser settings; the site still works without them, apart from logging in to the member area.

How long we keep it

After these periods the website deletes enquiries, estimate requests and feedback automatically, once a day. We delete them sooner if you ask us to.

The automatic deletion does not reach copies that arrived by email or WhatsApp, spreadsheets of enquiries we export from the website, booking records in IBIS, member accounts or our host's server logs. We keep those only as long as we need them for the reason we have them, and delete them when you ask us to, unless the law requires us to keep them.

Who we share it with

We do not sell, rent or trade personal information. We share it only with service providers that process it on our behalf (POPIA calls them 'operators'), or when the law requires us to.

• Our hosting provider, which stores this website, its database and its server logs.
• Our email provider, which delivers the notifications from our forms and our replies to you.
• The provider that hosts IBIS, where booking records are kept, if that is not our own hosting provider.
• Cloudflare, if the site is served through it, and for Turnstile spam protection if that is switched on.

Operators may use the information only to do work for us, and must keep it secure.

Some operators, Cloudflare among them, may process information on servers outside South Africa. Section 72 of POPIA allows this when the recipient is bound by law or by an agreement that protects the information at least as well as POPIA does. We use operators whose terms give that protection.

How we protect it

• The site uses an encrypted connection (HTTPS), so what you type in a form is encrypted on its way to us.
• Only people at Legacy Live who need them can see enquiries, estimate requests and feedback, behind a login.
• Our forms store no IP addresses or browser details, and the estimate copy we email you contains only figures, never your message.
• We keep WordPress and its plugins up to date.

If a security breach puts your personal information at risk, we will tell you and the Information Regulator, as POPIA requires.

Your rights

Under POPIA you may:

• ask whether we hold personal information about you, and for a copy of it (asking whether we hold it is free);
• ask us to correct it if it is wrong or out of date (we may do this by deleting the entry and asking you to send it again);
• ask us to delete it;
• object to how we use it;
• withdraw your consent at any time (this does not undo what we did before, but we will stop using it);
• complain to the Information Regulator.

To use any of these rights, contact our Information Officer and tell us the email address you used. We find enquiries and estimate requests by email address, with WordPress's tools for exporting and erasing personal data, and may ask you to confirm the address is yours before we send or delete anything. Anonymous feedback cannot be found by email address; to remove a message, tell us roughly what it said and when you sent it.

Complaints

If you are unhappy with how we handle your information, please tell us first so we can put it right. You also have the right to complain to the Information Regulator (South Africa):

• Website: inforegulator.org.za
• Complaints email: [email protected]
• Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

Children

This website is not aimed at children, and we do not knowingly collect information about anyone under 18. If you are under 18, please ask a parent or guardian to contact us for you. If we find that we hold a child's information without a parent's or guardian's consent, we delete it.

Changes to this notice

We update this notice when what we collect, or how we use it, changes. The date at the top shows when it last changed. Each enquiry and estimate request records which version of the consent wording you agreed to.