Privacy Policy

1. Who We Are

TOUCHDOMAIN (Pty) Ltd, trading as Touch Domain ("we," "us," or "our"), is a South African digital studio providing branding, web design, digital content, app development, website hosting, business email and domain registration services.

This policy explains how we collect, process, store, and protect your personal information through touchdomain.co.za and our client portal in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA).

2. Personal Information We Collect

We collect personal information that you voluntarily provide to us when completing forms on our website:

• Contact Form: Name, email address, message subject, and enquiry details.
• Consultation Booking: Name, email address, phone number, and preferred date/time.
• Order Requests: Name, email address, phone number, and selected packages or features.
• Custom Quote Builder: Name, email address, phone number, and service requirements.
• Reviews & Testimonials: Name, email address, business name, project type, rating, and feedback.

Client Portal

If you become a client, we create a portal account for you and collect further information to deliver your project:

• Account Details: Name, email address, phone number, company name, and your login (your password is stored only in encrypted, hashed form).
• Onboarding Answers: Business details and address, goals, audience, brand preferences, and links you choose to share. Do not send passwords in onboarding answers; the portal rejects them.
• Billing Records: Invoices, payment schedules, and the proof-of-payment documents you upload, which may show your name and bank details.
• Electronic Signatures: When you sign an agreement in the portal, we record your name, signature image, the date and time, your IP address, and a fingerprint of the signed document, as evidence of the agreement under the Electronic Communications and Transactions Act.
• Files: Logos, images, and documents you or we upload for your project.

Domains & Hosting

To register a domain for you, we send your name, company, email address, phone number, and address to our registrar (HOSTAFRICA) and the domain registry, as registration rules require. Websites and mailboxes we host for you are stored on our hosting partner's servers in South Africa.

Cookies & Automated Technical Data

We do not use tracking cookies, analytics scripts, or third-party advertising pixels on this site. However, our web hosting infrastructure automatically collects standard, anonymized server access logs (such as IP addresses, browser types, and timestamp data) solely to maintain platform security, prevent abuse, and ensure site stability.

3. Purpose of Collection & Legal Basis

We process your personal information strictly for legitimate business operational purposes, including:

• Responding to your enquiries and project requests.
• Preparing custom estimates, scope confirmations, and billing accounts.
• Scheduling consultation calls and managing project timelines.
• Delivering, hosting, and supporting your website, email, and domains, and keeping your project records.
• Billing, confirming payments, and keeping the financial records the law requires.
• Recording electronic signatures as evidence of our agreements.
• Publishing client reviews and case studies (only with your explicit, separate consent collected on our review form).

We do not sell, rent, trade, or share your personal information with third parties for marketing purposes.

4. Data Storage, Access & Retention

Storage & Access

• Website Forms: Contact, quote, and review submissions are sent by email to our business mailbox (Google Workspace) and are not stored in a database. Orders and consultation bookings are emailed and also stored in our portal database (Supabase) so we can process them. Bookings are deleted 12 months after the call; orders that don't become a client account are deleted 12 months after they were placed.
• Client Portal: Your account and project records are stored in our portal database (Supabase), where security rules let you see only your own records.
• Documents: Invoices, agreements, and files are stored in our company Google Drive.
• Hosted Websites & Email: Stored on our hosting partner's servers (HOSTAFRICA) in South Africa, with automatic backups kept for up to 30 days.

Access is strictly limited to Touch Domain staff directly involved in responding to your request or delivering your project.

Retention Period

We retain personal information for 12 months from your last interaction with us, after which it is securely deleted or anonymized, unless you request earlier deletion.

Financial records are the exception: South African tax law requires us to keep invoices, proof of payment, and signed agreements for 5 years. If you ask us to delete your account, these documents are moved to a separate restricted archive, kept for 5 years, and then destroyed. Everything else is deleted; deleted files are permanently removed from our storage within 30 days.

5. Cross-Border Data Transfers

We use the following service providers (operators) to run our services. Some of them store or process data outside the Republic of South Africa:

• Vercel Inc.: hosts our website and client portal (servers outside South Africa).
• Supabase Inc.: stores client portal accounts and records (servers outside South Africa).
• Google LLC (Google Workspace): business email and document storage (servers outside South Africa).
• HOSTAFRICA: website and email hosting, DNS, and domain registration (South Africa).
• Domain registries: hold registration details for each domain (.za domains in South Africa; .com and other extensions abroad).

Where personal information is processed cross-border, we ensure compliance with Section 72 of POPIA by utilizing reputable cloud service providers that implement industry-standard encryption, organizational security measures, and data protection practices consistent with POPIA.

6. Your Data Protection Rights Under POPIA

As a data subject under South African law, you have the right to:

• Access Your Data: Confirm whether we hold personal information about you and request a copy of those records.
• Correction or Deletion: Request that inaccurate, irrelevant, or obsolete personal information be corrected or destroyed.
• Withdraw Consent: Withdraw your consent at any time regarding the public display of your testimonial, review, or case study.
• Object to Processing: Object to the processing of your personal information on reasonable grounds.
• Lodge a Complaint: Contact the Information Regulator of South Africa if you believe your personal data rights have been violated.

7. How to Exercise Your Rights & Contact Us

To exercise any of your rights or request further clarity on how your personal data is handled, please contact our Information Officer directly:

Information Regulator Contact Details

If you are unsatisfied with our response, you have the right to lodge a complaint with the South African Information Regulator:

Related: Terms & Conditions · PAIA Manual · ECTA Disclosure