1. Who we are and how to reach us

VDM Digital (Pty) Ltd (registration number 2026/179981/07) is the responsible party under the Protection of Personal Information Act 4 of 2013 ("POPIA"), and the controller under the EU and UK General Data Protection Regulation ("GDPR"), for the personal information described in this policy.

  • Address: 13 Jigger Avenue, Somerset West, Western Cape, 7130, South Africa
  • Information Officer: Erik van der Merwe, erik@vdmdigital.io
  • Deputy Information Officer: Nico van der Merwe
  • General privacy contact: erik@vdmdigital.io
  • Telephone: Our telephone number is published in the current version of this document on our website, and is available on request by email.

This policy covers vdmdigital.io and the services we provide from it, including the client and staff area behind the sign-in door. Where we build or run a system for a client, that client is usually the responsible party for the data in it and we act as their operator (POPIA) or processor (GDPR). See clause 9.

2. The short version

  • We collect very little, and we do not sell any of it.
  • Our contact form emails your message straight to our vdmdigital.io mailbox, files it in our own client-management system so we can follow it up, and sends you a short confirmation. It passes through our own web server on the way, which keeps it only until it is delivered and filed.
  • Our website brief saves your answers, and any logo or photos you add, in our own client-management system as you go, so we can scope, price and build your site. Clause 3.1 explains.
  • Our website analytics are first-party and cookie-free. No Google Analytics, no advertising pixels, no third-party tracking script of any kind.
  • If you reach us through one of our own Google ads and then send us an enquiry, our server tells Google that the ad click led to an enquiry. Google gets its own code for that click and the time, never anything you typed. Clause 3.1 explains.
  • Our web server logs each request it answers, with the last part of your IP address removed, and deletes those logs after about 15 days. Clause 3.5 explains the one place your full address can appear.
  • Card details never reach us. Our payment processor handles them.
  • You can ask us what we hold, ask us to fix it, and ask us to delete it.

3. What we collect, why, and on what legal basis

3.1 When you contact us

Our contact form collects your name, email address, contact number, company name, budget range and your message. When you press send, our own web server (the one that hosts this site) passes them to Google Workspace, which delivers them to our vdmdigital.io mailbox with your email address as the one we reply to. In the same step it sends a short confirmation to the email address you gave, so you know the message arrived; the confirmation repeats nothing you wrote except your first name. If Google cannot take a message at that moment, the server holds it, tries again every minute, and deletes it as soon as it is delivered (no confirmation is sent in that case). The server also files your enquiry, with the details you entered, in our own client-management system (VDM OS, whose database is hosted by Supabase), so that we can keep track of it and follow it up; if that system cannot take it at that moment, the server holds it and tries again every minute, and deletes its own copy as soon as it is filed. Beyond that the server keeps no copy. Once delivered, your message sits in our mailbox like any other email. To stop the form being used to flood that mailbox, the server counts recent messages from your network address in memory for about ten minutes. To stop it being used to send confirmations to someone else's inbox, it sends at most one a day to any address, and for that it holds a scrambled, one-way fingerprint of the address in memory for a day, never the address itself.

  • Purpose: to confirm we received your message, to answer you and to quote for the work.
  • Legal basis: POPIA section 11(1)(b), steps at your request before entering a contract. GDPR Article 6(1)(b), same.
  • Retention: for the life of the enquiry and, if it becomes an engagement, for the retention period in clause 7.

If you fill in our website brief. Our page for new websites starts with your name, email address, business name and, if you choose, a contact number, and files them as an enquiry exactly as the contact form does, with an ad click code if you arrived from one of our ads. It then asks what you are looking for and, depending on the answer, about your business and the site you want (what the business does, who its customers are and where it works; your current website and what is wrong with it; your logo, colours, photos and how the site should sound; its pages and the words on them; what else you would like it to do; your domain and email) or about the problem you want solved (what goes wrong, the whole story in your words, roughly what it costs you in time, the tools you use and how many people deal with it), and then your timing, who decides and your budget. Each screen is saved to our client-management system (VDM OS, hosted by Supabase) when you move on, so a brief you do not finish is not lost, and we email the two of us about a brief that stops part way. A copy of your answers is also kept in your own browser so you can carry on later on the same device (clause 3.4). A logo or photos you add are uploaded to a private storage area in the same system that only we can open, through links that expire. At the end, if your site fits our starter build, you are shown its price and can pay a deposit (clause 3.3), and we then raise your invoice and email you a confirmation. If it needs a call, you can book one: we keep the time you chose, whether you want a phone or video call and the number to call, and email you and us a calendar invitation. The confirmations we send you repeat nothing you wrote except your first name.

  • Purpose: to scope and price your site, to build it if you go ahead, and to arrange the call.
  • Legal basis: POPIA section 11(1)(b), steps at your request before entering a contract, and performing it once you have. GDPR Article 6(1)(b), same.
  • Retention: as an enquiry (clause 7) and, if it becomes an engagement, for the retention period in clause 7. The files you added are kept with your brief and deleted with it: our server checks every hour and removes any file whose brief no longer exists. A file you removed from the brief, or one it no longer uses, is deleted once the brief is finished (or 14 days after you started it), and never sooner than a day after you added it.

If you arrived from one of our Google ads. When you click one of our ads on Google, Google adds a code to the link that identifies that click (gclid, or gbraid or wbraid on some Apple devices). Your browser keeps the code for the rest of the visit (clause 3.4) and, if you send us an enquiry, sends it with your message. We store it with your enquiry in our client-management system, together with the time the enquiry arrived. About six hours later our server tells Google Ads that the click led to an enquiry, through Google's Data Manager API, sending only that code, the time and a random reference for the enquiry: never your name, email address, contact number, company, budget or message. Google uses it to count the enquiry against our ad and to learn which searches bring us enquiries. Nothing is sent if your browser sends a Do Not Track or Global Privacy Control signal (your browser then never keeps the code), if the form's spam check was tripped, or if we mark the enquiry as spam before it goes.

  • Purpose: knowing which of our ads bring enquiries, and letting Google's bidding favour the searches that do.
  • Legal basis: POPIA section 11(1)(f), our legitimate interest in knowing whether our advertising works, balanced against sending Google only a code it created itself, about a click on its own service, and nothing that names you. GDPR Article 6(1)(f).
  • Retention: we keep the code with your enquiry for as long as the enquiry (clause 7), and deleting the enquiry deletes it. What Google keeps is governed by Google's own terms and privacy policy.

3.2 When you become a client

To run an engagement and to invoice you, we hold: contact names, email addresses, telephone numbers, billing entity, company registration and VAT number where applicable, billing address, invoice and payment records, project correspondence, and any credentials you give us for systems we manage.

  • Purpose: performing the contract, invoicing, support, and record keeping.
  • Legal basis: POPIA sections 11(1)(a), (b) and (c); GDPR Article 6(1)(b) and (c).
  • Retention: clause 7.

3.3 When you pay us

Payments are processed by our payment processors. We never see, receive or store your full card number, CVV or PIN. Those are entered on the processor's own hosted, PCI-DSS-compliant page.

What we do receive and keep is: the amount, the currency, the date, whether it succeeded or failed, the reference, a transaction ID, the payment method type, and the last four digits and card brand where the processor supplies them.

  • Purpose: taking payment, reconciling accounts, refunds and chargebacks, fraud prevention, and the tax records we are legally obliged to keep.
  • Legal basis: POPIA sections 11(1)(b) and (c); GDPR Article 6(1)(b), (c) and (f).
  • Retention: financial records are kept for five years as required by the Companies Act 71 of 2008 and the Tax Administration Act 28 of 2011. We cannot delete them on request before then.

3.4 When you visit the site

Our analytics are our own, run on our own infrastructure. For each page view we record: the path you visited, the referring site (external referrers only; internal navigation is not recorded), a short browser and OS label such as "Chrome / Windows", a device class (one of mobile, tablet or desktop, not your screen size), any campaign tags in the link you arrived on (the utm_ parameters in the address, if a link carried them), whether your anonymous ID already existed (so we can count returning visits), how long the server took to answer, a random anonymous ID stored in your browser, a random session ID, and the timestamp.

When you leave a page, we record one more event for it: roughly how long the page was on screen, how far down it you scrolled (as a percentage), and how long the page took to load in your browser. Nothing in that event identifies you either.

If you start our website brief, your browser keeps a copy of it in localStorage (the brief's reference, a random key that lets your browser open it again, and your answers so far), so a reload or a trip to the payment page does not lose it. It is sent only to our own server, it is ignored after 14 days, and "Start again" removes it.

If you arrived from one of our Google ads, your browser also keeps Google's code for that click in sessionStorage for the visit, so that it can go with an enquiry if you send one (clause 3.1). It is not added to the analytics events above, it is sent nowhere unless you send an enquiry, and it is not kept at all if your browser sends a Do Not Track or Global Privacy Control signal.

We do not record your IP address in that table, we do not fingerprint your device, and we use no cookies for analytics. We deliberately do not record your screen size, pixel density, time zone or language: each is harmless on its own, and together they are the beginning of a fingerprint. Our web server's own logs are separate from these analytics and are covered in clause 3.5.

We do not collect analytics at all if:

  • Your browser sends Do Not Track or a Global Privacy Control signal;
  • You look like a bot or an automated browser; or
  • You are signed in to our admin area (staff activity is deliberately excluded).

Demo sites. When we build a business a concept of a new website and email them the link, that demo site carries the same analytics, filed under the demo's own address, so we can see whether it was opened after we sent it. It records exactly the fields above and nothing more, and the demo says on the page that it counts visits without cookies. Visits from before our email went out are ours, and are not counted as the business's.

  • Purpose: understanding which pages are useful, so we can improve the site; on a demo site, knowing whether the business looked at what we built them.
  • Legal basis: POPIA section 11(1)(f), our legitimate interest in running and improving our own website, balanced against a design that collects no identifiers we could tie back to you. GDPR Article 6(1)(f).
  • Retention: clause 7.

The identifiers live in your browser's localStorage and sessionStorage, not in cookies. See our Cookie and Local Storage Policy for the full list and how to clear them.

3.5 What our web server records

Separately from those analytics, the web server that hosts this site writes a line to its access log for every request your browser makes to it, whether for a page, an image or a file. Each line holds your IP address with the last part removed (the last of its four numbers for an IPv4 address, or everything after the first three of its eight groups for an IPv6 address), the date and time, the address requested (including anything after a ? in it, such as campaign tags or a Google ad's click code), whether the request succeeded, the size of the response, the referring address your browser sends (normally the page that linked to it or loaded it), and your browser's user-agent string, in which it names itself, its version and your operating system.

If something goes wrong while the server handles a request, for example an upload that is too large or a secure connection that fails, it also writes a line to its error log. That log's format is fixed by the server software and cannot be changed, so a line about your request holds your full IP address, with the request and what went wrong. Only requests that go wrong are written there.

Two kinds of request are never written to the access log: the contact form sending your message, and the logo that some of our emails load when you open them.

  • Purpose: keeping the site secure and working: spotting and blocking abuse, investigating attacks, and finding faults.
  • Legal basis: POPIA section 11(1)(f), our legitimate interest in securing and running our own server, balanced by shortening your IP address and deleting the logs quickly. GDPR Article 6(1)(f).
  • Retention: about 15 days. The server starts new logs every day and deletes each one 14 days after it closes.

3.6 When you record a video testimonial

If a client sends you a private testimonial link, that page collects: your video recording, your name, your business name, your role, optionally your email address, an optional 1-to-5 star rating, and your explicit consent.

  • Consent is required and enforced in the database: a submission without it is rejected outright.
  • The video lands in a private store first. Nothing is published until a VDM Digital administrator reviews and approves it.
  • Only on approval is the video copied to a public location and shown on our site.
  • Your email address is never published and is deliberately excluded from the public feed.
  • Legal basis: consent. POPIA section 11(1)(a), GDPR Article 6(1)(a).
  • Withdrawing consent: email erik@vdmdigital.io and we will unpublish and delete the recording. Withdrawal does not affect the lawfulness of what we did before you withdrew.

3.7 When you sign in

For anyone with an account in our client and staff area we hold an email address, a name, a role, which client company the account belongs to, a hashed password, session tokens and sign-in timestamps. Passwords are hashed by our authentication provider and are not visible to us.

A client portal account is created only for an address we have invited (usually because your company became our client and your details are on our records), and only once the person using it has proved they control that address with a one-time code we email to it. The code is made by our authentication provider and sent from our own server through Google Workspace; the server sends it straight away and keeps no copy. "Forgot your password?" works the same way.

  • Legal basis: performance of the contract and our legitimate interest in securing the system.

3.8 When you use the client portal

In the client portal you can report problems, ask for new features, message us about a project, and see your project's milestones and the documents we share with you. For that we hold what you send us there: the reports and requests and their replies, any screenshots or files you attach, the page address you give us, and a short line about your browser (its user-agent string, the size of the window and its language), which the form shows you before you send it. We also hold your email preferences.

We email you about your account: an invitation when your access is set up, and, unless you turn them off in the portal's settings, a note when a project milestone is completed, when we reply to you, and when something you reported is fixed or needs your answer. An estimate waiting for your approval is always emailed. Each of these emails waits in a queue in our database until our server sends it through Google Workspace; the record of it (your address and what the email said) is deleted 30 days after it is sent, or after 3 days if it could not be sent.

If you reply to one of those emails, our server adds your reply to the same conversation in the portal, where you and we can both see it. A reply from an address that is not on your company's account is not shown to you; it is held for our staff to check. Files attached to an emailed reply are not kept; you are asked to add them in the portal instead.

  • Purpose: supporting and maintaining the work we do for your company, and keeping you informed about it.
  • Legal basis: POPIA section 11(1)(b), performing the contract with your company; section 11(1)(f), our legitimate interest in supporting it well. GDPR Article 6(1)(b) and (f).
  • Retention: as client records (clause 7). Queued emails as described above.

3.9 What we do not collect

We do not knowingly collect special personal information under POPIA section 26 (race, health, religion, biometrics, political or trade union affiliation, criminal behaviour) or GDPR Article 9 special categories, and we do not ask for it. We do not collect information from children under 18 knowingly. If you believe a child has given us personal information, tell us and we will delete it.

4. Who we share it with

We do not sell, rent or trade personal information. We share it only with:

4.1 Operators and sub-processors

  • Supabase: database, authentication and file storage for our application data. Processes website enquiries, website briefs and the files added to them, booked calls, client records, invoices, client portal accounts, tickets and the files attached to them, the portal's email queue, testimonial submissions and analytics events.
  • Hetzner Online GmbH: the server that hosts vdmdigital.io, located in Helsinki, Finland. It holds the web server logs described in clause 3.5, it passes contact-form messages to our mailbox and files them in our client-management system, holding each one only until it is delivered and filed, it files each screen of the website brief, starts its payments with our payment processor and books its calls, keeping nothing of them itself, and it sends the client portal's emails and one-time codes and receives replies to them (clauses 3.7 and 3.8).
  • Google (Google Workspace): our business email on the vdmdigital.io domain, including the mailbox the contact form delivers to, the confirmation it sends you, and the client portal's emails.
  • Paystack: our South African payment processor for card and instant-EFT payments in ZAR. See their privacy policy.
  • Stripe: pre-authorised for future international card payments. This is not live yet. Until we say otherwise on this page, every payment to us is processed in ZAR by Paystack or made by EFT. See their privacy policy.
  • First National Bank: our bank, for EFT payments and reconciliation.
  • Wise: used for some international receipts.

Each is bound by a written agreement, or by its own published terms, to process personal information only on our instructions and to secure it, as POPIA sections 20 and 21 and GDPR Article 28 require. This list is kept current; ask us for the version in force on a given date.

4.2 Other recipients

  • Google (Google Ads): when an enquiry came from one of our Google ads, Google's code for that click, the time of the enquiry and a random reference for it (clause 3.1). Google receives these as the advertising platform we buy ads from, under its own terms and privacy policy.
  • Professional advisers: our accountant, auditor or attorney, under a duty of confidentiality.
  • Authorities: where we are legally compelled, and only to the extent compelled.
  • A buyer: if the business is sold or merged, subject to this policy continuing to apply.

5. Sending information outside South Africa

Our server is in Finland, several of our processors are outside South Africa, and so is Google, which receives the ad click codes described in clause 3.1. That makes these cross-border transfers under POPIA section 72.

We rely on:

  • Section 72(1)(a): the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection. Finland and the EU are covered by the GDPR, which is at least as protective as POPIA; our processor agreements carry the equivalent obligations.
  • Section 72(1)(b): where you have consented to the transfer.
  • Section 72(1)(c): where the transfer is necessary to perform a contract with you.

For personal information covered by the GDPR that we move out of the EEA or the UK, we rely on Standard Contractual Clauses or an adequacy decision, whichever applies to that processor.

6. How we protect it

  • Everything is served over TLS. HTTP Strict Transport Security is enforced.
  • A strict Content Security Policy blocks any script we did not ship, which is why there is no third-party tracker on this site and cannot casually become one.
  • Database access is controlled by row-level security: an account with no explicitly granted role gets nothing, and creating an account grants no access by itself.
  • Testimonial video uploads land in a private store, are rate limited, and are constrained to a fixed path so an anonymous caller cannot write arbitrary files.
  • Accounts are created by us, not self-registered, and an account grants nothing until we give it a role. A client portal account is made only for an address we invited, only after the person proves they control it, and it can see only its own company's work.
  • Files attached to tickets and documents shared in the portal are kept in private storage and opened only through short-lived links.
  • Access is limited to the people who need it, and staff activity is excluded from analytics rather than merged into it.

No system is perfectly secure and we do not claim ours is.

7. How long we keep it

  • Enquiries that do not become work: up to 24 months, then deleted, with any Google ad click code stored with them.
  • Client records and correspondence: for the engagement, plus 5 years after it ends.
  • Financial records (invoices, payments, refunds): 5 years, as the Companies Act and the Tax Administration Act require. This period overrides a deletion request.
  • Website analytics events: up to 24 months.
  • Web server logs: about 15 days (clause 3.5).
  • Testimonial recordings: until you withdraw consent, or until the client relationship ends and we no longer need them.
  • Account records: for the life of the account, plus 12 months.
  • Client portal tickets, messages and attachments: as client records, above.
  • The portal's queued emails: 30 days after sending, or 3 days if they could not be sent (clause 3.8).

After the applicable period we delete or de-identify the information.

8. Your rights

Under POPIA (sections 5, 23, 24 and 25) and, where it applies to you, the GDPR, you may:

  • Ask what we hold about you, and get a copy.
  • Correct or complete anything inaccurate, irrelevant, excessive, misleading or out of date.
  • Ask us to delete or destroy information we no longer have a lawful reason to keep.
  • Object to processing based on legitimate interest, on grounds relating to your particular situation.
  • Withdraw consent at any time where consent is the basis, for example a testimonial.
  • Object to direct marketing at any time, and we must stop.
  • Ask for portability and, where the GDPR applies, receive the data in a structured, commonly used, machine-readable format.
  • Not be subject to a decision based solely on automated processing that significantly affects you. We do not make such decisions.

How to exercise them: email erik@vdmdigital.io. Access and correction requests under POPIA are made on the prescribed forms described in our PAIA Manual, which also sets out the fees and the timelines. We respond within 30 days, and will tell you if we need longer and why.

We do not charge for exercising these rights, except for the copying fees prescribed under PAIA for a formal access request.

9. When we are the operator, not the responsible party

When we build, host or manage a system for a client, the personal information in that system belongs to the client's relationship with their own users. In that case:

  • The client is the responsible party or controller. They decide why and how it is processed.
  • We are the operator or processor. We act on their documented instructions, keep it confidential, secure it, and tell them without delay if we become aware of a compromise, as POPIA section 21 requires.
  • If you are a user of a client's system and want to exercise a right, ask that client. If you contact us instead, we will pass your request on and tell you we have.

10. If something goes wrong

If personal information under our control is accessed or acquired by an unauthorised person, we will notify the Information Regulator (South Africa) and every affected person as soon as reasonably possible after discovering it, as POPIA section 22 requires. Where the GDPR applies we will notify the relevant supervisory authority within 72 hours. The notification will say what happened, what the likely consequences are, and what you can do about it.

11. Complaints

Tell us first, at erik@vdmdigital.io. We would rather fix it than have you escalate.

If you are not satisfied, you may complain to the Information Regulator (South Africa):

If the GDPR applies to you, you may also complain to the supervisory authority in your country of residence, work or the place of the alleged infringement.

12. Links to other sites

Our site links to third-party sites, including our clients and our processors. We are not responsible for their privacy practices. Read their policies.

13. Changes

We may update this policy. The current version, its publication date and its version number are shown on this page, and every previous published version is retained and available on request. Material changes will be brought to your attention by email or a notice on the site.

14. Contact

VDM Digital (Pty) Ltd (Reg. No. 2026/179981/07)

13 Jigger Avenue, Somerset West, Western Cape, 7130, South Africa

Information Officer: Erik van der Merwe, erik@vdmdigital.io

Telephone: Our telephone number is published in the current version of this document on our website, and is available on request by email.

Last updated: 24 October 2026.