1. Who we are
TRUTERAX (legal name TRUTERA X (PTY) LTD, CIPC registration 2026/379872/07, effective 18 May 2026) is a Cape Town web studio that designs, builds and maintains websites, web applications and SaaS products, based at SPACES, 50 Long Street, Cape Town, 8001, South Africa. References to "we", "us", and "our" in this policy mean TRUTERAX.
We act as the Responsible Party (POPIA) / Data Controller (GDPR) for personal information we collect through our website and during the provision of our services.
2. Information Officer
As required by POPIA Section 55, TRUTERAX has designated an Information Officer responsible for ensuring compliance with this Act:
- Name: The sole director of TRUTERA X (PTY) LTD serves as Information Officer ex officio until otherwise appointed
- Email: privacy@truterax.com
- Postal address: SPACES, 50 Long Street, Cape Town, 8001
The Information Officer is registered with the Information Regulator of South Africa.
3. What personal information we collect
We collect personal information directly from you and through automated means when you use our website or engage us for services:
3.1 Information you give us
- Contact information: name, email, company name, phone number
- Project information: project descriptions, current website URL if you give one, and the brief you send
- Communications: emails, meeting notes, support requests
3.2 Information collected automatically
- Technical data: IP address (used transiently for rate-limiting the contact form and, if accounts are enabled, sign-up/login), browser type as sent by your client
- Usage data: we do not run analytics or usage-tracking cookies on this website
- Cookies & similar: see our Cookie Policy
3.3 Account sign-up & authentication
If you create an account on this website, we process the following on the lawful basis of your explicit consent (POPIA s11(1)(a) / GDPR Art. 6(1)(a)), which you give by ticking the consent box at sign-up. We record the time of consent and the policy version for accountability (POPIA s23):
- Email address: to create your account, send a verification link, and let you sign in.
- Password: never stored in plain text. We store only a salted PBKDF2-HMAC-SHA256 hash; we cannot recover or read your password.
- IP address: processed transiently for security and abuse-prevention (rate-limiting sign-up and login attempts).
Account data is stored in a Cloudflare D1 database; see §6 (operators) and §8 (where it is processed). You may withdraw consent at any time by deleting your account; email privacy@truterax.com (see §9).
Launch & product announcements (optional): at sign-up you may tick a separate, optional, never pre-checked box to receive emails about new TRUTERAX apps and products. This is direct marketing by electronic means under POPIA section 69, processed only on your opt-in consent; we record the date and time of that consent. You can withdraw at any time; every such email contains an unsubscribe option, or email privacy@truterax.com. Leaving the box unticked has no effect on your account.
4. Our lawful basis for processing
| Purpose | POPIA Justification | GDPR Lawful Basis |
|---|---|---|
| Responding to enquiries | Necessary for contract / legitimate interest | Art. 6(1)(b) / 6(1)(f) |
| Delivering our services | Performance of contract | Art. 6(1)(b) |
| Compliance / accounting | Legal obligation | Art. 6(1)(c) |
| Marketing communications | Consent (only if you opt in) | Art. 6(1)(a) |
| Account sign-up & authentication | Consent (POPIA s11(1)(a)) - accounts are currently parked and not offered on the public site | Art. 6(1)(a) |
5. How we use your information
We use personal information to: respond to enquiries and quote requests; deliver, support, and improve our services; manage our contracts and invoicing; comply with our legal obligations; and (where you consent) send you marketing communications.
We will not sell your personal information or use it for purposes incompatible with those listed above.
6. Who we share your information with
We share personal information only with carefully selected operators (POPIA) / processors (GDPR) under written contracts that protect your rights. Categories include:
- Cloudflare, Inc.: website hosting and our D1 database (quote/enquiry records; account records only if you create an account); Cloudflare Turnstile on the contact form (bot check).
- Resend: sends transactional email (quote requests to our inbox, and account verification if accounts are enabled).
- Analytics: none at present. We do not use Plausible, GA4, or similar.
- Payment processors: none on this website. Invoices are issued off-site (EFT / USD invoice).
- Professional advisers: accountants, legal counsel under confidentiality
7. How long we keep your information
We keep personal information only for as long as necessary for the purposes set out above, or as required by law (e.g., SARS retains tax records for 5 years). Typical retention periods:
- Quote/enquiry records: 24 months from last contact
- Active client records: duration of engagement + 5 years
- Marketing list: until you unsubscribe (we do not currently run a marketing list from this site)
- Account records (email, password hash, consent record): kept until you delete your account or ask us to; unverified accounts may be removed sooner.
- Security / rate-limit logs (IP addresses of sign-up & login attempts): retained only for abuse-prevention and purged on a rolling basis, typically within 24 hours.
8. International transfers
Because we use international cloud and SaaS providers, your information may be transferred to, and processed in, countries outside South Africa. In particular (POPIA Section 72): your account data is stored in a Cloudflare D1 database hosted in Western Europe, and the verification email is sent via Resend (processed outside South Africa). Where personal information is transferred cross-border we rely on safeguards permitted under POPIA Section 72 / GDPR Chapter V: recipients bound by laws or agreements providing adequate protection, Standard Contractual Clauses, adequacy decisions, or your consent.
9. Your rights
Under POPIA and GDPR, you have the right to:
- Access the personal information we hold about you
- Request correction or deletion of inaccurate information
- Object to processing or withdraw consent
- Request restriction of processing
- Data portability (GDPR only)
- Lodge a complaint with the Information Regulator (SA) or your local supervisory authority
To exercise any of these rights, email privacy@truterax.com. We will respond within 30 days.
10. How we protect your information
We follow security practices aligned with ISO/IEC 27001 principles:
- Encryption in transit (TLS 1.2+) and at rest where applicable
- Role-based access controls and the principle of least privilege
- Regular vulnerability scanning and dependency monitoring
- Multi-factor authentication on administrative accounts
- Incident response procedures, including breach notification within 72 hours where legally required
11. Cookies
Our use of cookies and similar storage is described in our Cookie Policy. The banner on first visit is a notice (OK), not a choice between analytics and essential cookies, because we do not set analytics or marketing cookies.
12. Children
Our services are not directed at children under 18 years of age, and we do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us so we can delete it.
13. Governing law & jurisdiction
This Privacy Policy, and any matter relating to it, is governed by the laws of the Republic of South Africa, and the processing described here is undertaken in accordance with POPIA (and, where applicable, the GDPR). Any dispute arising from this policy is subject to the exclusive jurisdiction of the Western Cape Division of the High Court (Cape Town), without prejudice to your right to lodge a complaint with the Information Regulator (South Africa) (see Contact, below).
14. Changes to this policy
We may update this policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Material changes will be communicated via email or a prominent notice on our site.
15. Contact us
If you have any questions about this Privacy Policy, please contact us:
- Email: privacy@truterax.com
- General: hello@truterax.com
- Post: TRUTERAX (TRUTERA X), SPACES, 50 Long Street, Cape Town, 8001, South Africa
You may also contact the Information Regulator (South Africa): inforegulator.org.za