Privacy Policy

This policy is published by SOFT DEVELOPMENT SOLUTIONS (Pty) Ltd, registration number 2023/165773/07, trading as Soft Development Solutions, a software development business based at 57 Camborne Road, New Redruth, Alberton, Gauteng, TODOpostal code, South Africa.

In this policy “I” and “my” mean that business, which is run by Abrie Els.

“Personal information” has the meaning given to it in the Protection of Personal Information Act 4 of 2013 (POPIA).

• Visitors to this website.
• People who send an enquiry through the form on this site, or by email or phone.
• Clients, and the people at a client's business I deal with while doing the work.
• Personal information inside a client's own systems that I necessarily see while building or maintaining software for them.

It does not cover other websites or services you reach from links here, or a client’s own privacy practices in software I have handed over to them.

The Information Officer for this business is Abrie Els, contactable at [email protected]. Under POPIA the head of a private body is its Information Officer by default, and the Information Officer must be registered with the Information Regulator.

POPIA distinguishes between the party that decides why information is processed (the responsible party) and one that processes it on that party’s instructions (the operator). Which one I am depends on whose information it is.

I am the responsible party for

• Information about visitors to this website.
• Enquiries sent to me, and the correspondence that follows.
• My own client records, quotes, invoices and accounting records.

I am an operator for

Personal information inside a client’s system that I see or handle while building, migrating, debugging or maintaining their software — their customers, their staff, their suppliers. The client decides why that information is processed; I act on their instructions. In that role:

• I process it only as needed to do the work agreed with that client.
• I do not use it for any purpose of my own, and I never use one client's data in another client's project.
• I keep it confidential and treat it with the security measures in section 11.
• I tell the client immediately if I become aware of unauthorised access to it.
• I return or delete it when the work is done, at the client's instruction.
• Where the work needs it, that arrangement is recorded in a written operator agreement with the client, as POPIA requires.

Where possible I avoid handling live personal information at all, working against anonymised or sample data instead. That is not always possible — a data migration is exactly the real thing — but it is the default I aim for.

When you send an enquiry

Only what you type into the form or put in your email. The form asks for:

• Your name and email address (required, because I cannot reply without them).
• Your phone number and business name (optional).
• What you are building, how you would prefer to pay, and your timeline.
• Your description of what you need.

Please do not put anything sensitive in that form. It is for describing a project, and email is not a suitable channel for passwords, ID numbers or confidential records.

When you visit this website

The site has no accounts, no login and no analytics installed. The hosting provider keeps standard server logs, which include your IP address, the page requested, the time and your browser’s user agent. Those exist to serve the site and to protect it from abuse, and I do not use them to build a profile of you.

When you become a client

• Contact details for you and the people at your business I work with.
• Business details needed to invoice you - registered name, registration number, VAT number, address.
• Records of our correspondence, quotes, scopes and project notes.
• Payment records: amounts, dates, references and payment method. NOT your card number - see section 7.

What is never collected

• Card numbers, expiry dates or CVVs. Card details go to Payfast, never to this site or to me.
• Online banking credentials.
• Special personal information under POPIA - health, biometrics, religious or political belief, race, sexual life, criminal behaviour, trade union membership - unless a client's own data unavoidably contains it and I am handling it as their operator.
• Information about children, knowingly. See section 14.

Each purpose below has a lawful basis under POPIA, which is either the performance of a contract with you, a legal obligation on me, my legitimate interests in running the business, or your consent.

• To reply to your enquiry. You asked me a question; answering it is the purpose.
• To quote, scope and do the work. Performance of our contract.
• To invoice and get paid, and to keep the accounting and tax records the law requires.
• To support and maintain software I have built for you.
• To keep this website working and defend it against abuse.
• To comply with the law, including tax law and POPIA itself.

Marketing

I do not run a mailing list and do not send marketing email. If that ever changes you will be asked to opt in first, and every message will carry a way out. Replying to your enquiry is not marketing.

Automated decisions

None. Nothing about you is decided by a machine, and no profiling is done.

I do not sell personal information, and I do not share it for anyone else’s marketing. It is shared only with the service providers below, only as far as each one needs, and only to deliver the services described in this policy.

Payment details

When you pay by card or instant EFT, those details go directly to Payfast by Networkand are processed under their own terms and privacy notice. I receive only the result of the transaction — amount, currency, date and reference. I never receive your card number. The payment security statement sets this out in full.

Other disclosures

• My accountant or auditor, where they need records to do their work.
• A lawyer, where I need advice or have to enforce or defend a claim.
• SARS or another authority, where the law requires it.
• A court, in response to a valid order.

• Enquiries that do not become work: kept for 12 months in case you come back, then deleted.
• Client records and correspondence: kept for the duration of the engagement and then for as long as needed to defend a claim or meet a legal obligation.
• Invoices and accounting records: kept for at least five years, as South African tax law requires. This is one period I cannot shorten on request.
• Client data I hold as operator: kept only while the work needs it. After a subscription ends, data is retained for 30 days and then deleted, as set out in the refund and cancellation policy.
• Server logs: retained by the hosting provider on its own short rolling schedule.

Some providers in section 7 operate outside South Africa, mainly in the United States and Europe. POPIA permits this where the recipient is bound by rules providing comparable protection, or where the transfer is necessary to perform a contract with you. These providers operate under their own data-protection commitments and standard contractual terms.

Where a client requires that their data stays in South Africa, say so at the start and I will choose infrastructure accordingly. It is a constraint I can design around if I know about it before the build, not after.

This website sets no analytics cookies, no advertising cookies and no tracking pixels. No Google Analytics, no Meta pixel, no session recording. That is why there is no cookie banner — there is nothing to ask you to consent to.

The hosting provider may set a strictly necessary cookie for security or load balancing. Those are not used to track you across sites.

If analytics is added later, this section will be updated and — where consent is required — it will be asked for before anything is set.

• This website is served only over an encrypted HTTPS connection.
• Multi-factor authentication on the accounts that hold anything sensitive - hosting, repositories, email, domain registrar.
• Separate credentials per client, with no password reuse between them.
• Access to a client's systems only for as long as the work requires, revoked afterwards on request.
• No card data held anywhere, which removes the single highest-risk category entirely.
• Client data kept off local machines beyond what the work requires, and not retained afterwards.

No system is perfectly secure, and I am not going to claim otherwise. If personal information I hold is accessed or lost without authorisation, POPIA section 22 requires me to notify the Information Regulator and, where I can identify you, to tell you. I will, and I will tell you what happened rather than issue a statement designed to minimise it.

More detail is in the payment security statement.

Under POPIA you have the right to:

• ask whether I hold personal information about you, and ask for a copy;
• ask me to correct information that is inaccurate, irrelevant, excessive, out of date, incomplete or misleading;
• ask me to delete or destroy information I am no longer entitled to keep;
• object, on reasonable grounds, to my processing of your information, and object at any time to direct marketing;
• withdraw consent you previously gave, where consent was the basis for processing;
• not be subject to a decision based solely on automated processing (I make none); and
• complain to the Information Regulator - see section 13.

To use any of these, email [email protected]. I may need to confirm your identity first, so that I do not hand your information to someone pretending to be you. I respond within 30 days.

Two limits worth stating honestly. I cannot delete records I am legally required to keep, such as invoices inside the tax retention period. And where the information is inside a client’s system and I hold it as their operator, the decision is theirs — I will pass your request to them and tell you I have done so.

There is no charge for any of this.

Please raise it with me first, at [email protected]. I would rather fix something than have you escalate it.

You also have the right to complain to the Information Regulator at any time:

This is a business-to-business service and is not directed at children. I do not knowingly collect personal information about anyone under 18. If you believe a child’s information has reached me, email [email protected] and I will delete it.

This policy may change as the business changes. The current version is always on this page, and the date at the top shows when it last changed. Where a change materially affects how your information is handled and I have a way to contact you, I will.

• Information Officer: Abrie Els
• Email: [email protected]
• Telephone: 060 640 1905
• Address: 57 Camborne Road, New Redruth, Alberton, Gauteng, TODOpostal code, South Africa

Related documents: the terms and conditions, the payment security statement, and the refund and cancellation policy.