Privacy Policy.

1. Who I am

This site is operated by Kent Weyers, trading as Zivaro, a one-person digital studio based in Cape Town, South Africa. For the purposes of the Protection of Personal Information Act, 2013 (POPIA), I am the responsible party for any personal information collected through this site.

You can reach me at hello [at] zivaro [dot] co [dot] za for any privacy-related questions, requests, or complaints. I act as my own Information Officer until the business grows enough to need a dedicated one.

2. What I collect, and when

I keep collection minimal. Specifically:

• When you submit the contact form: your name, email address, optionally your company name, optionally your phone number, your selection of services, budget range, timeline, and the message you typed. Plus a timestamp, the page you submitted from, and the IP address the submission came from (recorded so I can tell a real enquiry from a bot flood).
• When you sign up for a downloadable pack: your email address, your explicit tick confirming you want it, the page you signed up from, and any campaign tags in the link you arrived through. You then have to click a confirmation link in your own inbox before anything is sent, so an address cannot be signed up by somebody else.
• When you email me directly: whatever you choose to include in that email.
• Server logs: the web server that hosts this site keeps standard access logs (IP address, browser, page requested, response code) for a maximum of 30 days, used only for security and diagnostics.
• Anonymous analytics (Plausible), always on: aggregate, cookieless usage data such as pages visited, traffic source, device category, screen size, and approximate country derived from IP. No cookies are set, no cross-site identifiers are used, and IP addresses are never stored: they are only used momentarily to derive a country and are discarded.
• Google Analytics 4, only if you accept it: if, and only if, you choose "Accept" on the cookie notice, Google Analytics is loaded and sets two first-party cookies to measure how visitors move through the site. If you decline, or simply ignore the notice, it is never loaded and those cookies are never set. See section 9.

I do not collect any other personal information through this site. I do not use advertising cookies, retargeting pixels, or session replay tools.

3. Why I collect it (lawful basis)

I process the personal information described above on two POPIA-recognised lawful bases:

• Consent: when you fill in the contact form and submit it, you are consenting to me using the information you provide to reply to you and discuss potentially working together.
• Legitimate interest: for server logs and basic diagnostics, the legitimate interest of running a functioning, secure website.

I do not use your personal information for marketing without separate consent. I do not sell or rent your information to anyone. Ever.

4. Where the data goes

When you submit the contact form, the data flow is:

1. Your browser sends the form data over HTTPS to an endpoint on this site itself (/api/contact), which runs on Cloudflare's network. It does not travel to another company's domain first.
2. That endpoint checks the submission is genuine, then hands it to Resend, my email provider, which delivers it to my inbox and sends you an acknowledgement.
3. Resend also stores your name and email address as a contact record, flagged as not subscribed. Sending me an enquiry is not consent to marketing, so you are never added to a mailing list from it.
4. No copy is kept by the endpoint itself. Cloudflare keeps short-lived request logs and Resend keeps a delivery log, both covered in section 5.

The downloadable packs are separate. That sign-up still runs through an automation workflow on n8n, which sends the confirmation email, records your confirmation, and sends the pack. The contact form no longer touches n8n at all.

The processors involved (subprocessors, in POPIA terminology) are:

• Cloudflare: serves this website and runs the contact form endpoint. Processing happens at the edge location nearest you, which for most South African visitors is inside South Africa.
• Resend: sends and delivers the contact emails, and stores the contact record described above. Resend is a United States company and processes this data there.
• n8n: workflow orchestration for the downloadable pack sign-up only. Data is processed in the region I have configured (currently the European Union or South Africa, depending on hosting).
• My email provider: for receiving and storing the message once it arrives.
• Plausible (self-hosted): for aggregate, cookieless usage analytics. This runs on my own infrastructure, so the data is not shared with any third-party analytics provider.
• Google (Google Analytics 4): only for visitors who accept analytics cookies. Google acts as a processor for this data and may process it outside South Africa, including in the United States. Nothing is sent to Google unless you accept.

All subprocessors are bound by their own privacy policies and applicable data protection laws.

5. How long I keep it

• Contact form submissions and email correspondence: retained for as long as our conversation is active. If we do not end up working together, I delete the thread within 12 months of the last contact, unless you ask me to delete it sooner.
• Active client records: retained for the duration of our engagement plus 5 years afterwards (to meet SARS, contractual, and dispute-resolution requirements).
• Server and edge request logs: 30 days maximum.
• Resend delivery logs: kept by Resend under its own retention policy, and used only to confirm whether a message was delivered.
• Resend contact records: deleted on request, and otherwise on the same schedule as the correspondence they relate to.
• n8n workflow logs (pack sign-ups only): 30 days maximum.

6. Transborder transfers

Some of the processors listed above sit outside South Africa, so your personal information may be transferred across borders under POPIA section 72.

• Resend processes contact form submissions in the United States. This applies to every submission, not only to visitors who accept cookies.
• Cloudflare serves the site from the edge location nearest you, and its own logging and support systems may process data outside South Africa.
• My n8n instance and email provider are hosted in the European Union or South Africa, depending on the service.
• Google Analytics, and only if you accept it, may process data in the United States. See section 9.

These destinations are subject to data protection laws or contractual safeguards comparable to POPIA (typically the EU's GDPR or equivalent). By submitting personal information through this site, you consent to this transborder transfer. If you would rather your details did not leave South Africa, email me directly instead of using the form.

7. Your rights under POPIA

You have the right, at any time, to:

• Access the personal information I hold about you.
• Correct any inaccurate or outdated information.
• Delete your personal information (where I am not required by law to retain it).
• Object to my processing of your information.
• Withdraw consent at any time, where consent was the lawful basis.
• Lodge a complaint with the Information Regulator if you believe I have mishandled your information.

To exercise any of these rights, email me. I will respond within 30 days, usually faster.

The Information Regulator's contact details:

• JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
• POPIAComplaints@inforegulator.org.za
• inforegulator.org.za

8. Security

The site is served over HTTPS only, with security headers configured (HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Content-Security-Policy). Almost every page is static HTML; the only code that runs on a server is the contact form endpoint. That endpoint accepts submissions from this site only, rate-limits by IP so a flood cannot bury real enquiries, and keeps its email credentials server side where a visitor never sees them. I follow standard practices to protect any personal information I receive, including encrypted storage and least-privilege access.

That said, no system is perfectly secure. If I become aware of a breach affecting your personal information, I will notify you and the Information Regulator as required by POPIA section 22.

9. Cookies, consent, and tracking

Two analytics tools run on this site, and they are treated differently because they behave differently.

Plausible: always on, no cookies

Plausible Analytics is a privacy-first, cookieless analytics tool, self-hosted on my own infrastructure. It runs for every visitor, and needs no consent because it collects nothing personal:

• No cookies. Plausible sets no cookies and writes nothing to your device's storage.
• No cross-site or persistent identifiers. You are not tracked across sites or across visits, and no profile is built about you.
• No personal information. Only aggregate metrics are recorded: page views, referral source, device category, screen size, and approximate country. Your IP address is never stored: it is used momentarily to derive a country, then discarded.
• Self-hosted. The analytics data stays on my own infrastructure and is not shared with any third-party analytics provider.

Google Analytics: only if you accept

Google Analytics 4 gives me more detail about how people move through the site. It does use cookies, so it is off by default and is only ever loaded if you actively choose "Accept" on the cookie notice:

• Nothing loads before you accept. If you decline, or ignore the notice entirely, the Google script is never downloaded and no Google cookie is ever created. Declining is not a "cookie to remember you declined": your choice is stored in your browser's local storage, not in a cookie.
• Two cookies, if you accept. _ga and _ga_5NQKBP22R3. They hold a randomly generated identifier used to recognise a returning browser and to group page views into a session. Google's current default retention for these cookies is two years.
• What it measures. Pages viewed, how you arrived, roughly where in the world you are, device and browser, and how long you stay. I do not use Google Analytics for advertising, remarketing, or Google Signals, and I do not link it to any advertising account.
• Where it goes. Google processes this data as my processor, and may do so outside South Africa, including in the United States. This is a cross-border transfer under POPIA section 72, which is one of the reasons it is opt-in rather than automatic.

Changing your mind

Your choice is not final. You can switch it at any time here:

Whatever you choose, you can also:

• Use a browser with built-in tracking protection (Firefox with strict mode, Brave, Safari with cross-site tracking prevention).
• Block the scripts served from test-apps-plausible.renrgg.easypanel.host and www.googletagmanager.com using uBlock Origin, Privacy Badger, or your browser's content blocking.
• Install Google's own opt-out browser add-on.

There are no advertising cookies, no Meta pixel, no LinkedIn Insight Tag, and no session-replay or retargeting tools on this site. If that ever changes in a way that involves cookies or personal information, this policy will be updated and, where the law requires it, consent will be asked for first.

10. Children

This site and the services Zivaro provides are aimed at business customers. I do not knowingly collect personal information from anyone under 18. If you believe a child has submitted information through this site, please email me and I will delete it.

11. Changes to this policy

I will update this policy when the site, processors, or data practices change. The "last updated" date at the top reflects the most recent revision. Material changes will be flagged on the site for at least 30 days.

12. Questions

If anything on this page is unclear, or you want to know more about how Zivaro handles your information, email me at hello [at] zivaro [dot] co [dot] za . I am happy to talk you through any part of it in plain language.