Privacy Policy

Responsible entities

Octothorp ITWS is used by Octothorp ZA in South Africa and Octothorp LLC in the United States. Depending on the interaction and contracting entity, one or both entities may be responsible for personal information processed through this website and client engagements. Privacy enquiries for either entity may be sent to privacy@octothorp.co.za.

Information we collect

• Contact details such as name, email address, telephone number and organisation.
• Enquiry, project, support and correspondence information supplied by a prospective or current client.
• Quotation, invoice, payment-reference and transaction-status information.
• Technical information such as browser, device, approximate location, website usage, security logs and diagnostic data.
• Information reasonably required to deliver a contracted service, administer an account or comply with law.

How we use information

• Respond to enquiries and prepare quotations.
• Conclude and perform contracts and deliver support.
• Issue invoices, reconcile payments and administer refunds or disputes.
• Operate, secure, diagnose and improve the website and services.
• Maintain accounting, tax and company records and comply with lawful requests.
• Protect the rights, systems and property of Octothorp, its clients and users.

Lawful processing

Depending on the circumstances, information is processed with consent, to take requested steps before a contract, to perform a contract, to comply with a legal obligation, or to pursue legitimate operational and security interests in a manner that does not unjustifiably prejudice the data subject.

Service providers and disclosures

Octothorp uses service providers only where reasonably necessary and requires appropriate handling of information. Current website and payment operations may involve Paystack for payment processing, Brevo for contact-form email delivery, and Vercel for hosting, infrastructure, analytics and performance monitoring.

Information may also be disclosed to professional advisers, authorities or other parties where required by law, necessary to establish or defend legal rights, or authorised by the data subject. Octothorp does not sell personal information.

Payments

Where a client pays through Paystack, Paystack processes the payment information under its own privacy and security terms. Octothorp receives transaction and reconciliation information but does not intend to receive or store full card details through this website.

Analytics and website technology

The website uses Vercel Analytics and Speed Insights to understand aggregate usage and diagnose performance. Browser or device information may also be processed for security and service delivery. Available controls depend on the technology and browser used.

International processing

Octothorp operates through entities in South Africa and the United States, and some infrastructure or service providers may process information in other countries. Information is transferred across borders only where reasonably necessary for the interaction or service. Octothorp will take reasonable steps to ensure that cross-border processing has an appropriate legal basis and safeguards consistent with applicable data-protection requirements.

Retention

• Unsuccessful enquiries and expired, unaccepted quotations are ordinarily retained for up to 24 months after the last relevant interaction.
• Accepted quotations, contracts, invoices, payment and accounting records may be retained for up to 7 years or longer where law, an audit or a dispute requires it.
• Project correspondence and acceptance records are retained for as long as reasonably necessary to perform and evidence the agreement.
• Temporary credentials are removed or returned as soon as reasonably practicable after their purpose ends.
• Routine technical backups are ordinarily overwritten within 30 to 90 days unless a service agreement or legal requirement requires longer retention.

Security

Octothorp uses reasonable technical and organisational safeguards appropriate to the information and risk. No internet transmission or storage method is completely secure, and suspected compromises will be handled according to applicable notification requirements.

Your rights

Subject to applicable law, a data subject may ask whether Octothorp holds their personal information and may request access, correction, deletion, restriction or an explanation of processing. Requests should be sent to privacy@octothorp.co.za. Octothorp may require reasonable proof of identity before acting on a request.

Policy changes

This policy may be updated as Octothorp's services, providers or legal obligations change. Material updates will be identified by a revised effective date and, where appropriate, additional notice.