Privacy Policy

Last updated: 23 October 2026

1. About this policy

This policy explains how Francois Badenhorst t/a COIS Web Development (“COIS”, “we”, “us”) collects, uses, shares and protects personal information, in line with the Protection of Personal Information Act, 2013 (POPIA). It applies to visitors to cois.co.za, people who contact us, and our clients. Read it together with our Terms and Conditions and our Cookie Policy.

2. Who is responsible for your information

Francois Badenhorst t/a COIS Web Development is the responsible party for the personal information we collect for our own purposes.

Information Officer: Francois Badenhorst (owner)
Email: info@cois.co.za
Phone: 082 465 0734
Address for legal notices: 24 Wyllie Street, Boat Lake Village, Benoni, 1501, South Africa

3. What personal information we collect

3.1 Information you give us

Contact forms: your name, email address, phone number, business name and the details of your enquiry.
WhatsApp: your name, phone number and the messages and files you send us.
Email and phone: your contact details and what you tell us.
Free website check requests: your website address and email address, which we use to run the passive check you asked for and send you the report.
Clients: contact, billing and business details, quotes, invoices and payment records, and the login details and information you share with us so we can provide our services.

3.2 Information collected automatically

When you visit our website, we and our providers may collect technical information such as your IP address, browser and device type, and the pages you visit. Our website security software uses this to protect the site. With your consent, we use Google Analytics to understand how the site is used. Analytics cookies are only set if you accept them, and WhatsApp may set cookies only when you click the chat button. See our Cookie Policy for details.

3.3 Information on our clients’ websites and systems

When we build, host, maintain or support a client’s website, email or IT systems, we may have access to personal information belonging to that client’s customers, staff or website visitors. For that information, the client is the responsible party and we act as an operator on the client’s behalf. We process it only to provide the agreed services, on the client’s instructions, and we keep it confidential and secure. Clients are responsible for their own privacy notices and for meeting POPIA on their own websites.

4. Why we use your information and our lawful basis

Under section 11 of POPIA, we only process personal information where we have a lawful reason. We use it:

to answer your enquiries and prepare quotes, because you asked us to or to take steps towards a contract with you;
to provide, bill for and support our services, because it is needed to perform our contract with you;
to keep financial and tax records and meet other legal duties, because the law requires it;
to protect our website, systems and clients against spam, fraud and attacks, and to improve our services, because we have a legitimate interest in doing so;
to run website analytics and send marketing, where you have given consent.

Where we rely on your consent, you may withdraw it at any time. This does not affect processing that took place before you withdrew it.

5. Direct marketing

We only send marketing messages by email, SMS or WhatsApp if you have agreed to receive them, or if you are an existing client and the message is about services similar to those you already use from us. Every marketing message will tell you how to opt out. You can also opt out at any time by emailing info@cois.co.za, and we will stop.

6. Who we share your information with

We do not sell your personal information. We share it only where needed, with:

our hosting provider, xneelo, which hosts our website and client websites;
email service providers that carry and store our email;
banks and payment processors that handle EFT and debit order payments;
professional advisers, such as accountants and attorneys, where needed;
authorities, regulators or courts, where the law requires it.

We expect providers who process personal information for us to keep it confidential and secure, and to use it only for the services they provide to us. Payment is by EFT or debit order, and we do not store card details.

7. Sending information outside South Africa

xneelo hosts our website and client websites in South Africa. Some providers, such as Google Analytics, WhatsApp and some email services, may process information on servers outside South Africa. Under section 72 of POPIA, we only allow this where the recipient is subject to laws, binding rules or an agreement that give a level of protection substantially similar to POPIA, or where another ground in section 72 applies, such as your consent or the need to perform a contract with you.

8. How long we keep information

We keep personal information only for as long as we need it for the purpose we collected it for, or for as long as the law requires. For example, financial and tax records are kept for the periods required by tax and company law. When we no longer need information, we delete or destroy it, or anonymise it so that it no longer identifies you. Information we process for clients as an operator is kept for as long as the client’s service needs it, or as the client instructs.

9. How we protect information

We take reasonable technical and organisational steps to protect personal information against loss, damage, and unauthorised access or use. These include access controls, secure connections, website security software, regular updates and backups. Login details clients share with us are stored in an encrypted password manager or secure storage, are used only for the agreed work, and should be changed by the client when the work ends. No system is completely secure, so we cannot guarantee the security of information sent to or stored by us.

10. Security breaches

If we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible, as required by section 22 of POPIA, in writing, with enough information for you to take steps to protect yourself, unless the law or a law enforcement agency says we must delay. Where we act as an operator for a client, we will tell the client straight away so that it can meet its own obligations.

11. Your rights

Under POPIA, you have the right to:

ask whether we hold personal information about you, and ask for a copy of it;
ask us to correct information that is wrong, incomplete or out of date;
ask us to delete information we no longer have a lawful reason to keep;
object to processing based on our legitimate interests, and to direct marketing at any time;
withdraw your consent where we rely on it; and
complain to the Information Regulator.

To make a request, email info@cois.co.za. We may need to confirm your identity first. We will respond within a reasonable time, and may refuse a request where the law allows it, in which case we will tell you why. If your request concerns information on a client’s website, we will refer you to that client, as the responsible party, or help the client respond.

12. Complaints to the Information Regulator

If you are unhappy with how we have handled your personal information, please contact us first so we can try to resolve it. You may also lodge a complaint with the Information Regulator (South Africa):

Website: inforegulator.org.za
POPIA complaints: POPIAComplaints@inforegulator.org.za
General enquiries: enquiries@inforegulator.org.za

13. Children

Our website and services are not aimed at people under 18, and we do not knowingly collect personal information from children. If you believe a child has given us personal information, please contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated.