Privacy Notice

This Privacy Notice explains how 3cits (Pty) Ltd collects, uses, shares and protects personal information when you visit www.3cits.co.za, contact us, or work with us. It is written to meet the requirements of the Protection of Personal Information Act 4 of 2013 (POPIA).

1. Who we are

3cits is the responsible party for the personal information described in this notice.

When we deliver a project for a client and handle personal information that belongs to that client (for example, the client's own customer records), we act as the client's operator. In that case the client's privacy notice applies, we process the information only on the client's instructions, and we pass any request we receive about that information to the client.

2. What we collect

When you visit this website

• This website has no forms, no user accounts, no analytics and no advertising. We do not set cookies. See our Cookie Notice.
• The website is hosted on GitHub Pages. GitHub records technical information such as your IP address when you request a page, and uses it to keep its service secure. We do not receive these logs.
• The website loads fonts from Google Fonts. To deliver the fonts, Google's servers receive your IP address and basic browser information.

When you email or phone us

• Your name, email address, telephone number, job title and organisation.
• The content of your message, any attachments, and anything else you choose to tell us.

When we work with you

• Contact details of the people we deal with at clients, prospective clients, suppliers and partners.
• Engagement records: proposals, contracts, meeting notes, project correspondence and invoices.
• For contractors and job applicants: the information needed to assess, contract and pay you, such as a CV, qualifications, references, and the identity, tax and payment details that the law or the contract requires.

We do not intentionally collect special personal information (such as health, religious or biometric information) or information about children. If we ever need special personal information for a specific purpose, we will only process it where POPIA allows.

3. Why we use it

We use personal information to:

• respond to your enquiry and arrange meetings and discovery calls;
• prepare proposals and quotations;
• deliver the services you engage us for and manage our relationship with you;
• invoice, keep accounting records and meet our tax and company law obligations;
• engage and manage suppliers and contractors;
• assess job and contract applicants;
• keep our website, accounts and systems secure;
• establish, exercise or defend legal rights; and
• send you relevant information about our services where the law allows it (see section 9).

We will not use your personal information for a purpose that is incompatible with the reason we collected it.

4. Our lawful basis

We process personal information only where section 11 of POPIA allows it:

5. Who we share it with

We share personal information only where necessary, and we do not sell it.

• Operators (service providers) who process information for us under written terms that require confidentiality and security safeguards (POPIA sections 20 and 21):
  • Google Workspace: business email, calendar and documents, including email sent to info@3cits.co.za.
  • Zoho Books: accounting, quotations and invoicing.
  • ClickUp: project and task management.
  • GitHub: hosting of this website and our source code.
• Professional advisers such as our accountants, auditors and attorneys, who are bound by professional or contractual confidentiality.
• Specialist contractors who work with us on your engagement, under written agreements that include confidentiality and POPIA obligations.
• Authorities and courts where the law requires us to, for example the South African Revenue Service or the Information Regulator.

6. Cross-border transfers

Our operators store and process information on servers that may be outside South Africa, including in the United States and the European Union. We transfer personal information outside South Africa only where section 72 of POPIA allows it, for example where:

• the recipient is subject to a law, binding corporate rules or a binding agreement that gives an adequate level of protection, substantially similar to POPIA;
• the transfer is necessary to perform a contract with you, or a contract concluded in your interest; or
• you have consented to the transfer.

7. How long we keep it

We keep personal information only as long as we need it for the purpose we collected it for, or as long as the law requires (POPIA section 14). As a guide:

We may keep information longer where a dispute, audit or legal request is pending. When we no longer need information, we delete or destroy it, or de-identify it so that it can no longer identify you.

8. How we protect it

We take appropriate, reasonable technical and organisational measures to prevent loss of, damage to, or unauthorised access to personal information (POPIA section 19). These include:

• multi-factor authentication on our business accounts and access limited to people who need it;
• encryption in transit (HTTPS and TLS) and encryption at rest provided by our cloud service providers;
• device security such as screen locks, disk encryption and up-to-date software;
• written confidentiality and security terms with our operators and contractors; and
• an incident response procedure.

If we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible, as required by section 22 of POPIA.

9. Direct marketing

We do not send unsolicited electronic marketing (email, SMS or instant messages) to people who are not our clients unless they have given us prior consent, as required by section 69 of POPIA. We may send existing clients information about similar services we offer. Every marketing message tells you how to opt out, and you can opt out at any time by replying to the message or emailing info@3cits.co.za.

10. Your rights

Under POPIA you have the right to:

• Access (section 23): ask us to confirm, free of charge, whether we hold personal information about you, and ask for a copy or description of it and of the third parties who have had access to it.
• Correction and deletion (section 24): ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, or to destroy or delete a record we are no longer authorised to keep.
• Objection (section 11(3)): object, on reasonable grounds, to processing based on legitimate interests (section 11(1)(d) to (f)), and object at any time to processing for direct marketing.
• Withdraw consent (section 11(2)(b)) where we rely on your consent. This does not affect processing that took place before you withdrew it.
• Not to be subject to a decision based solely on automated processing that has legal or similarly significant effects (section 71). We do not make such decisions.
• Complain to the Information Regulator, and institute civil proceedings (section 99).

How to make a request: email info@3cits.co.za with the subject "POPIA request". You may use the forms prescribed under the POPIA Regulations, 2018 (Form 1 for an objection and Form 2 for a request for correction or deletion), but this is not required. We will need to verify your identity before acting on a request, and we aim to respond within 30 days. Section 25 of POPIA provides that requests for access to records are handled under the Promotion of Access to Information Act 2 of 2000; our PAIA Manual explains how, and which fees may apply to copies.

11. Complaints

Please contact us first so that we can try to resolve your concern. You also have the right to lodge a complaint with the Information Regulator (South Africa):

• Website: inforegulator.org.za
• POPIA complaints: POPIAComplaints@inforegulator.org.za
• General enquiries: enquiries@inforegulator.org.za

12. Children

Our website and services are intended for businesses and adults. We do not knowingly collect personal information about children (persons under 18). If you believe we have done so, please contact us and we will delete it.

13. Other websites

This website may link to websites run by others. We are not responsible for their content or privacy practices, so please read their privacy notices.

14. Changes to this notice

We may update this notice from time to time. The date at the top of the page shows when it last changed. If a change materially affects how we use your personal information, we will tell you where we have your contact details.