1. Who we are
Adeptus Web (“Adeptus”, “we”, “us”) designs, builds and manages websites for businesses in Johannesburg and across South Africa. We are the responsible party under the Protection of Personal Information Act 4 of 2013 (“POPIA”) for the personal information described in this policy.
Information Officer: James
Jullies
Email:
info@adeptus.co.za
Based in: Johannesburg, South
Africa
This policy covers our website (adeptus.co.za) and our online intake form and plan tool (intake.adeptus.co.za).
2. What we collect
We only collect what we need to respond to you and to scope and deliver your website. Depending on how you use our sites, that is:
When you use the contact form on adeptus.co.za
- Your name, email address and business name
- The service you are interested in and your message
The form is sent to HubSpot, our customer-relationship (CRM) system.
When you use the intake form at intake.adeptus.co.za
- Your contact details (such as name, email, phone and business name)
- Your answers about your business, goals, audience, style preferences and current website
- Any files you choose to upload (for example a logo or brand material)
- The website plan we generate from your answers (see “AI processing” below)
Please do not include sensitive personal information (such as ID numbers, health or financial account details) in free-text answers or uploads. We do not need it.
When you book a call
Bookings are made through Cal.com. We receive your name, email address, the time you booked and any notes you add, and we link that to your intake submission so we can prepare for the call.
When you visit our site (only if you accept analytics)
- Pages viewed, clicks, form interactions, device and browser type, approximate location and referral source
- For a sample of visits, a session replay (a reconstruction of how the page was used, with text masked by default)
- Cookie and device identifiers set by HubSpot and Amplitude
These analytics tools load only after you press “Accept” on our cookie banner. See Cookies and analytics.
When you email or call us
We keep the details you send us and our replies, so we can help you.
3. Why we use it, and our legal basis
POPIA allows us to process personal information on specific grounds. We rely on these:
| Purpose | Legal basis (POPIA s11) |
|---|---|
| Replying to your enquiry, preparing your website plan and quote, and scheduling and holding a consultation call | Steps you ask us to take before entering into a contract with you, and your consent |
| Delivering and managing your website if you become a client; invoicing and keeping records | Performing our contract with you, and legal obligations (for example tax and accounting records) |
| Sending you the emails you triggered (confirmation, resume link, your plan) | Your request and our contract steps |
| Understanding how visitors use our site and improving it (analytics and session replay) | Your consent, given through the cookie banner and withdrawable at any time |
| Keeping our systems secure, preventing abuse and spam, and keeping an internal record of enquiries | Our legitimate interests (which do not override your privacy rights) |
We do not sell your personal information. We do not use it for marketing newsletters unless you ask for them, and every marketing message will include a way to opt out.
AI processing
To draft your website plan, the answers you submit in the intake form (and the business details you enter) are sent to an AI service provided by Anthropic. It is used to generate text and structure for your plan, which we then review. No decision about you with legal or similarly significant effect is made solely by automated means.
5. Sending information outside South Africa
Many of the providers above store or process information on servers outside South Africa, including in the United States and the European Union. When we transfer your personal information across the border we do so in line with section 72 of POPIA: only where the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection similar to POPIA; or you consent; or the transfer is necessary to perform a contract with you or to carry out steps you asked for before a contract. By submitting our forms and using our services you understand that this happens.
6. How long we keep it
We keep personal information only as long as we need it for the purposes above, unless the law requires or allows us to keep it longer.
- Enquiries and intake submissions (including uploads and generated plans): up to 24 months after our last contact with you, unless you become a client.
- Clients: for the duration of our relationship, and after that for as long as the law requires (for example, accounting and tax records are kept for five years).
- Analytics and session replays: up to 12 months.
- Booking records: up to 24 months after the call, in line with enquiries.
When we no longer need information we delete it or de-identify it. You can ask us to delete it sooner (see Your rights).
7. How we protect it
We take reasonable technical and organisational measures to keep your information safe, including:
- Encrypted connections (HTTPS) on all our sites
- Access controls: only people who need the information to help you can see it, and our databases are not open to the public
- Uploaded files kept in private storage, not publicly listed
- Reputable infrastructure and service providers with their own security programmes
- Keeping secrets such as API keys out of our public code
No system is perfectly secure. If a security compromise affects your personal information, we will notify the Information Regulator and you as POPIA requires.
9. Your rights
Under POPIA you have the right to:
- Access: ask whether we hold personal information about you and request a copy
- Correction: ask us to correct or update information that is inaccurate or incomplete
- Deletion: ask us to delete or destroy information we are no longer entitled to keep
- Objection: object to us processing your information, on reasonable grounds, and to direct marketing at any time
- Withdraw consent: withdraw consent you gave us (for example for analytics) at any time. This does not affect processing that happened before you withdrew
- Complain: lodge a complaint with the Information Regulator (see below)
To use any of these rights, email our Information Officer at info@adeptus.co.za. We may need to verify your identity first. We aim to respond within 30 days.
10. Complaints
We would like the chance to fix any concern first, so please contact us at info@adeptus.co.za. You also have the right to complain to the Information Regulator of South Africa:
- Website: inforegulator.org.za
- Complaints email: complaints.IR@inforegulator.org.za
11. Children
Our services are for businesses and are not directed at people under 18. We do not knowingly collect personal information from children. If you believe a child has given us their information, please email us and we will delete it.
12. Changes to this policy
We may update this policy from time to time, for example if we add a new service or provider. The “Last updated” date at the top shows when it last changed. If we make a significant change, we will take reasonable steps to let you know.