Privacy Policy
How we collect, use, and protect your personal information under POPIA.
1. Who We Are
Digital Operations and Technology (Pty) Ltd, trading as Do.Qix ("Do.Qix," "we," "us," "our") is a workflow automation company based in Cape Town, South Africa. We design, build, and manage automations for businesses, and offer standalone software products via subscription.
- Website: digitaloperations.co.za/doqix
- Email: hello@digitaloperations.co.za
- Phone: +27 61 514 8375
- Information Officer: Stephan Marais
We are committed to protecting your personal information in accordance with the Protection of Personal Information Act, No. 4 of 2013 ("POPIA") and the eight conditions for lawful processing.
2. What Information We Collect
2.1 Information You Give Us
When you contact us through our website form, we collect:
| Information | Required | Purpose |
|---|---|---|
| Your name | Yes | To address you and identify your enquiry |
| Email address | Yes | To respond to your enquiry |
| Company name | No | To understand your business context |
| Company size | Yes | To recommend the right service tier |
| Your message | Yes | To understand what you need |
| How you heard about us | No | To measure which channels work |
2.2 Information We Collect Automatically
Our website is a static site hosted on GitHub Pages. We do not track your behaviour across other websites.
If you click "Allow All" on our cookie banner, we load Google Analytics 4 (GA4, measurement ID G-BC57HM6CTG) to understand how visitors use our website. GA4 collects:
- Pages you visit, time on site, and general navigation patterns
- Device type, browser, operating system, and screen resolution
- Approximate geographic location (city-level, derived from IP address)
- Interactions with our ROI calculator (slider values, recommended tier, whether you clicked the call-to-action)
GA4 data is processed by Google and subject to Google's Privacy Policy. We have IP anonymisation enabled. We do not enable Google Signals, advertising features, or data sharing with other Google products.
If you click "Decline" or "Only Essentials," GA4 is never loaded and no analytics data is collected.
Certain external services used by our website may also collect limited technical data:
- GitHub Pages (hosts our website): May log your IP address and browser type in standard server logs. GitHub's privacy practices are governed by their own privacy statement.
- Google Fonts (provides our typeface): Your browser connects to Google's servers to load fonts. This may expose your IP address to Google.
- Tailwind CDN (provides styling): Your browser connects to Tailwind's CDN servers. This may expose your IP address.
We do not have access to any data collected by these third-party services (other than GA4, which we access through the Google Analytics dashboard).
2.3 Cookies and Local Storage
Our website uses the following browser storage:
| Service | Type | Purpose | Category |
|---|---|---|---|
| Cookie consent | localStorage | Remembers your cookie choice so we do not ask again | Essential |
| Exit-intent popup | sessionStorage | Shows popup once per session; cleared when you close the tab | Essential |
| Google Analytics 4 | Cookies (_ga, _ga_*) | Distinguishes unique visitors and sessions for analytics | Analytics (consent required) |
GA4 cookies are only set if you click "Allow All" on our cookie banner. If you decline or choose essentials only, no analytics cookies are placed.
3. Why We Process Your Information
We process your personal information based on the following lawful grounds under POPIA:
| Purpose | Lawful Basis | POPIA Condition |
|---|---|---|
| Responding to your enquiry | Legitimate interest / pre-contractual steps | Processing limitation |
| Sending you a quote or plan | Pre-contractual steps | Purpose specification |
| Delivering contracted services | Contract performance | Purpose specification |
| Invoicing and payments | Legal obligation (tax records) | Processing limitation |
| Improving our services | Legitimate interest | Further processing limitation |
| Website analytics (GA4) | Consent (cookie banner) | Processing limitation |
We will never sell your personal information. We will never use your data for purposes unrelated to why you gave it to us.
4. How We Process and Store Your Data
4.1 Contact Form Submissions
When you submit our contact form:
- Your data is sent directly from your browser to our self-hosted n8n automation platform via an encrypted HTTPS connection.
- n8n generates a notification email to our team.
- Your submission is stored on our self-hosted infrastructure.
4.2 Infrastructure
- All form data and client data is processed and stored on self-hosted infrastructure based in South Africa.
- We use n8n, an open-source automation platform, which we manage and host ourselves.
- We do not use third-party cloud CRM or marketing platforms to store your enquiry data.
5. Who We Share Your Information With
We do not sell, rent, or trade your personal information.
We may share your information only in these circumstances:
- Service delivery: If you become a client, we connect your chosen business applications (e.g., Xero, Google Workspace, Slack) as part of delivering your automation workflows. Data shared with these applications is governed by their respective privacy policies and your existing agreements with them.
- Legal obligation: If required by South African law, a court order, or the Information Regulator.
- Professional advisers: Our accountants or legal advisers, bound by professional confidentiality.
6. International Data Transfers
Your personal information (form submissions, client data) is stored and processed on South African infrastructure. We do not transfer your personal data to servers outside South Africa.
However, our website is hosted on GitHub Pages, which serves static files from servers that may be located outside South Africa (including the United States). No personal data is stored on GitHub Pages. Your form submissions go directly from your browser to our South African servers, not through GitHub.
When your browser loads our website, it also connects to:
- Google Analytics 4 (United States) for website analytics (only with your consent)
- Google Fonts (United States) to load typefaces
- Tailwind CDN (United States) to load stylesheets
These connections may expose your IP address to US-based servers. We do not control how these providers handle that information.
If any cross-border transfer of personal data becomes necessary in future, we will ensure appropriate safeguards are in place in accordance with POPIA Section 72, and will update this policy accordingly.
7. Data Retention
| Data Type | Retention Period | Reason |
|---|---|---|
| Contact form enquiries | 12 months from submission | To follow up and track service interest |
| Client project data | Duration of contract + 30 days | To deliver services; 30-day export window after cancellation |
| Invoicing and financial records | 5 years from transaction | Tax and legal compliance (Income Tax Act) |
| Google Analytics data | 14 months (GA4 default) | To understand website usage trends; managed by Google |
| Website server logs (GitHub) | Managed by GitHub | Not under our control |
After the retention period, personal information is permanently deleted from our systems. You may request earlier deletion at any time (see Section 8).
8. Your Rights Under POPIA
As a data subject, you have the right to:
- Access your personal information we hold.
- Correct any inaccurate or incomplete information.
- Delete your personal information (subject to legal retention requirements).
- Object to the processing of your information on reasonable grounds.
- Withdraw consent where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
- Request data portability in a reasonable, machine-readable format.
- Not be subject to automated decision-making that produces legal effects. We do not use automated decision-making for any purpose that affects your rights.
How to Exercise Your Rights
Contact us at:
- Email: hello@digitaloperations.co.za
- Subject line: "POPIA Data Request"
We will verify your identity and respond within 30 days. If we need more time, we will let you know and explain why.
There is no fee for exercising your rights, unless a request is manifestly unfounded or excessive.
9. Security
We take the security of your personal information seriously. Our measures include:
- Encryption in transit: All data submitted through our website is transmitted via HTTPS (TLS encryption).
- Self-hosted infrastructure: Your data is stored on servers we manage, not on shared third-party cloud platforms.
- Access control: Only authorised team members can access client data.
- Regular updates: We keep our software and systems up to date with security patches.
No system is completely secure. If you become aware of any security concerns, please contact us immediately at hello@digitaloperations.co.za.
10. Data Breaches
In the event of a data breach that compromises your personal information, we will:
- Notify the Information Regulator as soon as reasonably possible, as required by POPIA Section 22.
- Notify you as soon as reasonably possible, providing details of what happened, what information was affected, and what steps we are taking.
- Take immediate steps to contain the breach and prevent further compromise.
11. Direct Marketing
Do.Qix will only send marketing communications with your prior consent. Submitting our contact form does not constitute consent to receive marketing emails.
If we send marketing communications in future, every message will include an unsubscribe option. You may opt out of marketing at any time by emailing the Information Officer.
12. Children's Information
Our website and services are not directed at children under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child, we will delete it promptly.
13. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be:
- Published on our website
- Communicated to active clients via email at least 14 days before taking effect
The "Last Updated" date at the top of this policy will always reflect the most recent version.
14. Complaints
If you believe we have not handled your personal information properly, you have the right to lodge a complaint with the Information Regulator (South Africa):
- Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
- Email: enquiries@inforegulator.org.za
- Phone: +27 10 023 5207
We encourage you to contact us first so we can try to resolve your concern directly.
15. Contact Us
For questions about this Privacy Policy or how we handle your personal information:
Digital Operations and Technology (Pty) Ltd, trading as Do.Qix
Information Officer: Stephan Marais
Email: hello@digitaloperations.co.za
Phone: +27 61 514 8375
Location: Cape Town, South Africa