Privacy

WebOn Digital Solutions (“WebOn”) is the responsible party for personal information described in this notice. WebOn is based in Johannesburg, South Africa, and operates webon.africa.

The Information Officer is Ethan Olivier, the head of the business. Reach him directly at ethan.olivier@webon.africa or 072 769 7117. There is no privacy department to be routed through; the person accountable is the person who answers.

This site loads no advertising pixels and no social-media embeds. It has no user accounts and no database of visitors, and nobody here builds a profile of you.

Two background tools do run. The first is Google Analytics, which tells us how many people reach the site, which pages they open, how they got here and roughly whereabouts in the world they are. It also records a few things you do on a page rather than only the page you landed on: that a quote form was sent and which of the six business types it named, how far through that form people get before they stop, and whether a WhatsApp, phone, email or booking link was pressed and which one on the page it was. None of that carries anything you typed — not your name, not your business name, not your number or email address. It is counted, not attributed. It is the one thing on this site that places anything on your device: small files called cookies, named _ga and _ga_ followed by a code for this site. Their only job is to let Google tell a returning browser from a new one, so that one person opening four pages is not counted as four people. Google uses your IP address to work out an approximate location and does not store it in Analytics. We have not switched on Google’s advertising or remarketing features, so nothing here follows you to other websites and none of this is used to target ads at you.

You can refuse these cookies in your browser settings, or install Google’s official opt-out add-on, and the site will work exactly as it does now — nothing on it depends on them.

The second is Sentry, an error-reporting service that tells us when a page on webon.africa breaks. It is deliberately configured to send us the technical fault alone — not your IP address, not anything you have typed, and never a recording of your screen. Session replay is switched off. If nothing breaks, it sends nothing.

The quote form is the one place this site takes information from you. Nothing leaves your device while you are filling it in: your answers are held in the page as you type, and if you close it before the last step they are discarded with it. When you press send on that last step, your answers are submitted to this site and emailed to us. It asks for four things:

• your name, so we know who we are replying to;
• your business name, so the preview is built for the right business;
• your WhatsApp number or email address, so we can send you the preview link; and
• what kind of business it is and what you want the site to do, so that the preview is relevant rather than generic.

Giving us any of this is entirely voluntary. No law requires you to supply it, and you are under no obligation to use the form at all. Every field is needed to submit the form, so the only consequence of not supplying it is that we cannot build your free preview or prepare a quote. Nothing else is withheld from you, and you can still reach us on WhatsApp, by phone, or by email instead. The next section covers what happens to what you do send.

When you email, WhatsApp, or phone us — or send the quote form — we receive what you chose to send: typically your name, a contact number or email address, your business name, and whatever you tell us about your situation. That information lives in ordinary business tools: the email account and WhatsApp of the person you contacted. This site has no central customer database and no user accounts.

A quote form submission takes one extra step to reach that inbox. It is sent to this site, which passes it to Resend, our email provider, to deliver. If Resend cannot be reached, the submission is written to this site’s server log instead, so that an enquiry is never silently lost — those logs belong to Vercel, our host, and are deleted in the ordinary course. Nothing from the form is stored anywhere else, and none of it is used for marketing.

We use that information to:

• reply to you and answer your questions;
• build the free working preview you asked for;
• prepare a quote for your actual scope;
• run the project, if you decide to go ahead; and
• keep the ordinary records a business must keep of its work.

The legal grounds under POPIA are straightforward: processing is necessary to respond to and carry out what you asked for, and to pursue our legitimate interest in running the business. We do not rely on consent except where we ask for it expressly — and where we do, you may withdraw it at any time.

• We do not sell or rent personal information to anyone.
• We do not add you to a newsletter or marketing list. The quote form says “no newsletter, no sharing” and that is a promise, not copy.
• We do not share your details with third parties for their own marketing.
• We make no automated decisions about you and build no profiles of you.

Running a website means using other companies’ infrastructure. These are the only five that touch anything of yours, what each one receives, and where it is:

• Vercel hosts the site and processes connection data — IP address, browser type, pages requested — in routine server logs. South African visitors are served from Vercel’s Cape Town location. Vercel is a United States company.
• Cloudflare provides DNS and network security, and sees the same connection data in transit. A United States company.
• Resend delivers your quote-form submission to our inbox, and so processes what you typed. It is used for that delivery alone — never for marketing, and never to build a list. A United States company.
• Sentry receives error reports, configured to contain no personal information. Our account is in Sentry’s European Union region, in Germany.
• Google receives website usage measurements through Google Analytics: the pages you open, the site or search that sent you, your approximate location, and the type of device and browser. It is used to understand how the site is found and read, never to advertise to you. A United States company, and it processes this data across its global infrastructure.

WebOn does not use any of these logs to identify visitors, and none of these providers may use your information for their own purposes.

On the level of protection, plainly: South Africa has published no list of countries it treats as adequate, so we do not rely on any country’s laws alone. Section 72 of POPIA permits a transfer across the border where a binding agreement obliges the recipient to uphold protections effectively similar to POPIA’s conditions. We have such an agreement with each of the five above, and each is also bound by a written operator agreement as section 21 requires.

The honest qualification is this. The United States has no single national privacy law equivalent to POPIA, so the protection covering Vercel, Cloudflare and Resend is contractual rather than statutory — those agreements are what bind them, and they are enforceable. Sentry sits in the European Union, where the General Data Protection Regulation applies on top of the contract, which is a higher level of protection. If you would rather nothing of yours left South Africa at all, use WhatsApp or the phone instead of the form and nothing passes through Resend.

If you go on to become a client, we tell you which tools your project itself will use before anything is set up.

When WebOn builds and runs systems for a client business, we may process information belonging to that business and its customers on the client’s instructions — as an operator under POPIA. What we may do with it is governed by the written agreement for that project, and on handover the client receives the credentials, documentation, and data, and can take all of it elsewhere.

Enquiries that do not become work are deleted within 24 months. If you send us a quote-form submission or an enquiry and we never end up working together, we delete it — from the inbox and from anywhere else it was filed — no later than 24 months after your last contact with us. This is reviewed on a set date each quarter rather than left to memory.

If you become a client, project correspondence is kept for the life of the project and then for as long as South African tax and company law requires supporting records to be kept, which is at least five years.

When Resend cannot be reached, a submission is written to our host’s server log so that the enquiry is not silently lost. Those logs are Vercel’s, are purged automatically on their retention schedule, and are not copied anywhere by us. Sentry’s error reports are deleted on its own retention schedule and contain no personal information by design.

You can ask us to delete your enquiry sooner than any of this, and we will, unless a law obliges us to keep it.

Because this site stores no visitor data, there is no site database to breach. The information you send us lives in access-protected business accounts and devices, reachable by the small number of people named on the About page — there is no wider staff with access. If we ever suffer a breach that affects your information, we will notify you and the Information Regulator as POPIA requires.

Under POPIA you can, at any time and free of charge:

• ask what information we hold about you, and receive a copy;
• ask us to correct it;
• ask us to delete it, which we will do unless a law requires otherwise;
• object to processing, including withdrawing any consent; and
• complain to the Information Regulator (South Africa) if you believe we have handled your information unlawfully: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 · enquiries@inforegulator.org.za · inforegulator.org.za (opens in a new tab).

To exercise any of these, email ethan.olivier@webon.africa. Formal access requests can also be made under the Promotion of Access to Information Act — the procedure is in our PAIA manual.

This site is aimed at business owners and is not directed at children. We do not knowingly process children’s personal information.

If the way this site or this business handles personal information changes, this notice will be updated before the change takes effect, and the date at the top will move. We will not quietly weaken a promise made here.