Privacy notice

1. Who is responsible for your information

WebIQ is a security testing and web development business operated by Anthonie du Toit, providing penetration testing, red team engagements and vulnerability research alongside website design, development and search engine optimisation. For the purposes of POPIA, WebIQ is the responsible party for the personal information described in this notice.

• Responsible party: WebIQ
• Information officer: Anthonie du Toit
• Email: anthonie@webiq.co.za
• Telephone: 082 046 5051
• Address: 13 Muratie Street, Glen Erasmia Boulevard, Kempton Park, Gauteng, 1619, South Africa

2. What information is collected

Information you give WebIQ directly

When you complete the enquiry form on this website, or contact WebIQ by email or telephone, the following may be collected:

• Your name
• Your email address
• Your telephone number, if you choose to provide it
• The service you are enquiring about
• The content of your message, including any business details you choose to share

Information collected automatically

Like almost every website, this site is served by a web host that keeps standard server logs. These logs may include your IP address, the date and time of your request, the pages requested, your browser type and the referring page. They are used for security, diagnostics and to understand which pages are useful.

Cookies

This website does not set advertising or tracking cookies, and it does not use behavioural profiling. If analytics or other measurement tools are added in future, this notice will be updated before they go live and, where the law requires it, your consent will be requested first.

3. Why the information is used

Personal information is processed for these purposes only:

• To answer your enquiry and have a conversation about the work you need
• To prepare a quote or proposal, and to carry out work you appoint WebIQ to do
• To keep the records a business is required to keep, including tax and accounting records
• To keep this website secure and working properly

Your information is not sold, rented or traded. You will not be added to a marketing list from an enquiry alone.

4. The lawful basis for processing

WebIQ relies on the following justifications under section 11 of POPIA:

• Your consent, which you give when you tick the consent box and submit the enquiry form
• Performance of a contract, where you appoint WebIQ to carry out work
• Legal obligation, for records that legislation requires a business to retain
• Legitimate interests, for the security and correct operation of this website

5. Who else may process your information

A small number of service providers act as operators on behalf of WebIQ. They may only process your information for the purpose they were engaged for, and they are not permitted to use it for their own purposes.

• Form delivery. The enquiry form on this website is submitted through Web3Forms, which passes the contents of your message to the WebIQ email address. Web3Forms processes the submission outside South Africa.
• Email. Correspondence is held in the WebIQ email account with its email provider.
• Web hosting. The host that serves this website processes the server log information described above.
• Web fonts. Typefaces on this site are delivered by Google Fonts, which means your browser makes a request to Google servers and Google receives the IP address making that request.

Information may also be shared where WebIQ is legally obliged to do so, for example in response to a lawful request from a regulator, a court or the South African Revenue Service.

6. Transfers outside South Africa

Some of the providers above store or process information on servers outside South Africa. Where that happens, WebIQ relies on section 72 of POPIA and uses providers who are subject to laws or binding agreements that give personal information a level of protection substantially similar to POPIA. If you would prefer not to have your enquiry pass through the website form, you are welcome to email or phone WebIQ directly instead.

7. How long information is kept

• Enquiries that do not lead to work: kept for up to 24 months so the conversation can be picked up again if you return, then deleted.
• Client project records: kept for the duration of the working relationship and then for as long as tax, accounting and other legislation requires.
• Server logs: kept for the retention period set by the web host, typically a matter of weeks.

You may ask for your information to be deleted sooner, and WebIQ will do so unless a law requires that a record be retained.

8. How information is protected

Reasonable technical and organisational measures are in place, including encrypted connections to this website (HTTPS), form submissions transmitted over encrypted channels, access to accounts restricted with strong authentication, and a practice of collecting only the information actually needed. No system can be guaranteed to be perfectly secure, but if a security compromise affects your personal information, WebIQ will notify you and the Information Regulator as required by section 22 of POPIA.

9. Your rights

Under POPIA you are entitled to:

• Ask whether WebIQ holds personal information about you, and request a copy of it
• Ask for information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained to be corrected or deleted
• Withdraw your consent at any time, which will not affect processing that took place before the withdrawal
• Object to processing on reasonable grounds
• Ask not to receive direct marketing, at any time and at no cost
• Complain to the Information Regulator

10. Complaints to the Information Regulator

If you believe your personal information has been handled unlawfully, you may lodge a complaint with the Information Regulator of South Africa. Raising it with WebIQ first is usually the fastest way to resolve a problem, but you are not obliged to do so.

• Website: inforegulator.org.za
• POPIA complaints: POPIAComplaints@inforegulator.org.za
• Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

The Regulator requires complaints to be submitted in writing in the prescribed manner, through its eServices portal.

11. Children

This website and the services described on it are intended for businesses and for adults. WebIQ does not knowingly collect personal information about children under 18. If you believe a child has submitted information through this site, please email WebIQ and it will be deleted.

12. Information handled during a security engagement

This notice covers the WebIQ website. Security testing engagements are governed separately, by the engagement agreement and rules of engagement signed before any testing starts. In outline, and as a matter of standing practice:

• Testing is only ever carried out against systems for which WebIQ holds written authorisation from someone entitled to give it.
• Personal information encountered during a test is not collected beyond what is strictly needed to prove a finding, and is redacted in the report wherever the finding can still be understood without it.
• Evidence, notes and reports are stored encrypted, with access limited to the tester working on the engagement.
• Working data is destroyed once the retest window closes, unless you ask in writing for it to be retained for longer.
• Findings are never disclosed to a third party without your written instruction, other than where the law requires it.

Where a test touches personal information belonging to your customers or staff, you remain the responsible party for that information under POPIA, and WebIQ acts as an operator in terms of sections 20 and 21. The engagement agreement records this in full.

13. Links to other websites

This site links to a small number of external websites, such as the map link for the WebIQ address and the Information Regulator's website. Once you follow a link, this notice no longer applies, and the privacy practices of that website apply instead.

14. Changes to this notice

This notice may be updated when services, providers or legal requirements change. The date at the top of the page always reflects the current version. Material changes affecting how your information is used will be brought to your attention where WebIQ has a way to contact you.