Privacy Policy

This policy explains how Koda Technology Solutions (Pty) Ltd, trading as Koda Tech Solutions ("Koda", "we", "us"), collects, uses, shares and protects personal information. We are the responsible party for the personal information described here, as defined in the Protection of Personal Information Act 4 of 2013 ("POPIA").

• Registration number: 2026/656291/07
• Address: Johannesburg, Gauteng, South Africa
• Email: info@kodatechsolutions.co.za
• Phone: +27 79 199 6476

We have an Information Officer registered with the Information Regulator of South Africa. You can reach our Information Officer at info@kodatechsolutions.co.za for anything relating to your personal information.

This policy applies to:

• visitors to kodatechsolutions.co.za;
• people and businesses who contact us or ask for a quote;
• our clients and the people we deal with at our clients; and
• businesses we contact about our services (see section 5).

Under POPIA, personal information includes information about identifiable businesses (juristic persons), not only individuals, so this policy covers both.

Information you give us. When you use our contact form we collect your name, business name, the service you need, phone number, email address, your message and, if you tell us, how you heard about us. When you become a client we also collect billing and contact details, project and service information, support requests and our correspondence with you, and access details for systems we manage on your behalf. If you ask us to tell you when we launch, we collect your email address and the time you agreed.

Information collected automatically. When you browse our website our hosting and analytics tools record technical information such as pages viewed, referring site, approximate location, browser and device type. Vercel Analytics and Speed Insights measure visits and page speed in aggregate without setting cookies. Google Analytics only runs if you accept analytics cookies (see section 7).

Information from public sources. To find businesses that may benefit from our services we collect business information that is publicly available, such as a business name, physical address, phone number, website, published business email address and public business listing details (for example on Google Maps).

We do not ask for, and ask you not to send us, special personal information such as health or religious information.

We only process personal information for a lawful reason, as required by section 11 of POPIA:

• To respond to your enquiry and prepare quotes, because you asked us to.
• To deliver our services, including building websites, setting up and running WhatsApp ordering stores, providing IT support, invoicing and support, because this is needed to perform our agreement with you.
• To meet legal obligations, such as keeping financial and tax records.
• To run, secure and improve our website and services, which is in our legitimate interest. Google Analytics is only used with your consent.
• To tell businesses about our services, in line with the direct marketing rules in section 5.
• To email you when we launch, because you asked us to. We send one confirmation and one launch email, and nothing else unless you agree to more.

We never sell, rent or trade personal information.

Section 69 of POPIA limits electronic direct marketing (email, WhatsApp, SMS). We follow these rules:

• We send marketing about our services to existing clients about services similar to the ones they use.
• We send marketing to anyone else only if they have agreed to receive it.
• A business we have not dealt with before may receive one message from us asking whether it would like to hear more. If it does not reply or says no, we do not contact it again for marketing.
• Every marketing message identifies us and tells you how to opt out.

You can opt out at any time by using the unsubscribe link in our email, replying "unsubscribe" or emailing info@kodatechsolutions.co.za. We keep a minimal record of opt outs, and of businesses we have already written to, so that we do not contact you again.

We use AI tools (Google Gemini) to help us research public business information and draft messages. We do not make decisions that have legal or similarly significant effects on you based solely on automated processing.

When you first visit, a banner asks for your cookie choice. We use:

• Essential storage: small values in your browser that remember your cookie and privacy choices and whether you have already seen the opening animation. These do not track you.
• Analytics: Google Analytics, Vercel Web Analytics and our own count of page visits and button clicks (stored with a scrambled, one-way version of your IP address, never the address itself). These run only if you allow analytics.
• Performance: Vercel Speed Insights, which measures how fast pages load using anonymised data. This runs only if you allow performance.
• Choosing "Reject Non-Essential", or leaving the banner unanswered, keeps analytics and performance off.
• Third party embeds: the map on our contact page is provided by Google Maps, which may set its own cookies when it loads.

You can change or withdraw your choice at any time with the "Cookie settings" link at the bottom of every page. When you turn analytics off, we remove the Google Analytics cookies and reload the page. You can also block cookies in your browser, although some features may not work.

We share personal information only with service providers ("operators") that help us run our business, and only what they need. They must keep it confidential and secure:

• Vercel: website hosting, analytics and speed monitoring.
• Supabase: our database for enquiries, client records and support requests.
• Resend and Google Workspace: sending and receiving email.
• Meta (WhatsApp): messaging and enquiry notifications.
• Our ordering platform provider: the platform behind our WhatsApp ordering stores.
• Google: Analytics (with consent), Maps, business listing data and Gemini AI tools.
• Our bank, accountants and professional advisers, where needed.

We may also disclose information where the law requires it, for example to a regulator or under a court order. Payments are made by EFT, so we do not collect or store card details. You can ask us for the full list of providers at any time.

Several of our providers store or process information outside South Africa, for example in the United States, Europe or Singapore. Under section 72 of POPIA we only use providers that are subject to data protection laws, binding agreements or policies that give a level of protection substantially similar to POPIA.

When we build or run something for you that collects information about your own customers, such as orders through your WhatsApp ordering store or enquiries through your website, you are the responsible party for that information and we act as your operator.

• We process it only on your instructions and to provide the service.
• We keep it secure and confidential, as required by sections 20 and 21 of POPIA.
• We tell you without delay if we suspect it has been accessed by an unauthorised person.
• You are responsible for telling your customers how you use their information, for example with a privacy notice on your store or website.

We take reasonable technical and organisational measures to protect personal information, including:

• encryption in transit (HTTPS) on our website and systems;
• access limited to people who need it, with passwords stored in hashed form;
• reputable providers with their own security programmes; and
• limits on how many times forms can be submitted, to prevent abuse.

No system is completely secure. If we believe your personal information has been accessed or acquired by an unauthorised person, we will notify you and the Information Regulator as required by section 22 of POPIA.

• Enquiries that do not lead to work: up to 12 months after our last contact.
• Client records, agreements and invoices: for 5 years after our relationship ends, as tax law requires.
• Public business information used for outreach: until you opt out or it is no longer needed, after which we keep only an opt out record.
• Launch notification sign-ups: until 30 days after we send the launch email, or until you unsubscribe if sooner.
• Analytics data: for the period set in our analytics tools, at most 14 months.

Under POPIA you have the right to:

• ask whether we hold personal information about you and request a copy;
• ask us to correct or delete information that is inaccurate, out of date, incomplete or unlawfully held;
• object to us processing your information, including for direct marketing;
• withdraw consent you have given, at any time; and
• complain to the Information Regulator at inforegulator.org.za.

To use any of these rights, email info@kodatechsolutions.co.za. We may ask you to confirm your identity first, and we will respond within 30 days. Requests for records can also be made under the Promotion of Access to Information Act (PAIA).

Our website and services are meant for businesses and are not directed at children under 18. We do not knowingly collect their information.

We may update this policy as our services or the law change. The date below shows the latest version. If a change materially affects how we use your information, we will tell our clients by email before it takes effect.

Questions about this policy or your personal information can be sent to our Information Officer at info@kodatechsolutions.co.za or by phone on +27 79 199 6476.