Privacy Policy

Grey Swan Designs (Pty) Ltd · Last Updated: 9 October 2026

1. Who We Are and Scope of This Policy

Grey Swan Designs (Pty) Ltd (“Grey Swan Designs”, “we”, “us” or “our”) provides services that may include website design and development, hosting and maintenance, domain-related services, search engine optimisation (SEO), digital marketing, social media management, graphic design and related digital services.

This Policy applies to personal information processed in connection with greyswandesigns.co.za, our enquiries and communications, proposals and contracts, billing and administration, and our delivery of Services. It applies to individuals and, to the extent applicable under South African law, information relating to identifiable representatives of businesses and other organisations.

For the purposes of the Protection of Personal Information Act 4 of 2013 (“POPIA”), Grey Swan Designs may act as a “responsible party” when it determines why and how personal information is processed for its own business purposes. When we process personal information on a client’s documented instructions while providing hosting, website, marketing or related services, we may act as an “operator” or service provider for that client. The roles and obligations depend on the actual processing activity and applicable law.

2. The Information We May Collect

The information collected depends on how you interact with us and which Services you use. We aim to collect information that is reasonably necessary for the relevant purpose.

• Contact and identity information: name, business or trading name, job title, email address, telephone number, business address and contact details you choose to provide.
• Enquiry and communication information: the content of messages, enquiry forms, emails, WhatsApp communications, meeting notes, project instructions, feedback and support requests.
• Client and contract information: quotations, proposals, signed forms, service selections, approvals, project records, delivery history and related correspondence.
• Billing and transaction information: invoice details, billing address, payment status, transaction references and accounting records. Payment card or banking credentials should be supplied directly to the relevant payment provider or bank where applicable; we do not intend to collect passwords or full payment credentials through ordinary enquiry forms.
• Website and technical information: IP address, browser and device type, operating system, referring pages, pages viewed, approximate location derived from technical information, timestamps, diagnostic logs and security events, where made available by our website, hosting provider or analytics tools.
• Cookie and preference information: cookie identifiers, consent choices, settings, and analytics, performance or advertising information depending on the cookie categories you permit.
• Project materials and account access: website content, photographs, branding, social media assets, domain information, and access details needed to perform agreed work. We ask clients to use secure methods for sharing credentials and not to send passwords in plain text where avoidable.
• Public and third-party information: business information you make public, information provided by an authorised representative, and information from service providers or platforms where relevant to an agreed service or legitimate business purpose.

Please do not send us sensitive personal information, identity documents, health information, financial account credentials or information about children unless it is genuinely necessary, you are authorised to provide it, and a secure and appropriate method has been agreed.

3. How We Collect Information

We may collect information directly from you when you complete a form, request a quotation, contact us by email or WhatsApp, enter into an agreement, pay an invoice, provide project content, approve work or ask for support.

Some information is generated automatically when you visit the website, depending on your browser settings, server logs, cookie preferences and the technologies enabled on the site. We may also receive information from hosting companies, domain registrars, analytics providers, social platforms, advertising providers, payment or accounting services, and other suppliers involved in providing a requested service.

Where information comes from someone other than you, we will handle it in accordance with applicable law and take reasonable steps to ensure that the processing is lawful for the purpose concerned.

4. Why We Use Personal Information

Depending on the circumstances, we may process personal information for the following purposes:

• Responding to enquiries, preparing quotations and discussing potential projects.
• Providing, configuring, maintaining and supporting websites, hosting, domains, SEO, design, marketing and other contracted Services.
• Managing client relationships, project instructions, approvals, handovers and support requests.
• Issuing invoices, recording payments, managing accounts, recovering overdue amounts lawfully and maintaining financial records.
• Operating, securing, troubleshooting and improving our website, systems and Services.
• Understanding website usage and performance through analytics where permitted by your cookie choices and applicable law.
• Measuring advertising performance or delivering relevant advertising where the relevant technologies are enabled and you have provided any consent required by law.
• Sending service-related notices, important account information, contractual communications and responses to requests.
• Sending direct marketing where lawful, including where consent is required and has been obtained. You can object to or opt out of direct marketing as explained below.
• Complying with applicable laws, lawful requests, tax and accounting obligations, and protecting or exercising legal rights.
• Detecting fraud, preventing abuse, enforcing our terms and protecting our business, clients, website and systems.

5. Legal Grounds for Processing

POPIA requires personal information to be processed lawfully and for a specific, explicitly defined and lawful purpose. Depending on the circumstances, our justification may include your consent; the need to take steps at your request before entering into a contract or to perform a contract with you; compliance with a legal obligation; the protection of a legitimate interest of yours; or a legitimate interest of Grey Swan Designs or another party, where permitted by law and appropriately balanced against your rights.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not make processing that occurred lawfully before withdrawal unlawful, and we may still need to retain or process certain information where another lawful justification applies. Where we ask for information needed to provide a requested Service, not providing it may mean we cannot quote, contract, deliver or support that Service.

6. Cookies and Similar Technologies

We use cookies and similar technologies to help you navigate the website efficiently, enable core features, remember preferences, understand how the website is used and, where enabled, support advertising and campaign measurement. A cookie is a small data file stored by a website in your browser or device. Some cookies are set by us and others may be set by third-party services integrated into the website.

Our cookie notice groups cookies into the categories below. The exact cookies, providers, names, purposes and retention periods may change as website functionality and third-party services change. Please consult the cookie settings or cookie declaration displayed on the website for the current cookie-level details where available.

6.1 Necessary — Always Active

Necessary cookies support essential website functions, such as security, navigation, session management and storing your cookie-consent choices. These are described as always active because the website may not function properly without them. They should not be used for unrelated advertising purposes.

6.2 Functional

Functional cookies enable additional features, such as sharing content on social media, collecting feedback, remembering user choices or enabling other third-party features. If these functions are not essential, the related cookies should only be set where you have given the consent required by applicable law.

6.3 Analytics

Analytics cookies help us understand how visitors interact with the website. They may support statistics such as visitor numbers, page views, bounce rate, traffic sources and the pages or features people use. These insights help us evaluate website performance and identify improvements. Analytics cookies are only stored where you have provided the prior consent required by our cookie settings and applicable law.

6.4 Performance

Performance cookies and similar technologies help us measure and analyse key website performance indicators and understand whether the site is working effectively for visitors. Depending on the tool, this may overlap with analytics functionality. Non-essential performance cookies are only stored where the required consent has been obtained.

6.5 Advertisement

Advertising cookies may be used to make advertising more relevant, limit repeated advertisements, understand which pages or campaigns led to an interaction, and measure advertising effectiveness. They may be set by third-party advertising or social media providers and may allow those providers to recognise a browser across websites or services. These cookies are only stored where you have provided the prior consent required by the cookie settings and applicable law.

6.6 Others

“Others” covers cookies that are being reviewed or have not yet been classified. Their purpose may not be fully categorised until they have been assessed. We will take reasonable steps to identify and classify cookies and update the cookie declaration. Unclassified cookies should not be treated as exempt from consent requirements merely because they have not yet been categorised.

6.7 Managing Your Cookie Choices

You can choose to enable or disable non-essential cookie categories through the cookie consent controls presented on the website. You can also delete or block cookies using your browser settings, although blocking certain cookies may affect the website’s functionality or your browsing experience. If the website provides a cookie-settings link, you can use it to revisit your choices. Where required, we will seek consent before storing non-essential cookies and will respect withdrawal of that consent for future use.

Cookie controls do not necessarily remove information already collected by a third-party provider. You may need to use that provider’s own privacy or advertising controls for additional choices. More information about Google’s third-party cookies and data handling is available in the Google Privacy Policy and privacy information.

7. Analytics, Advertising and Embedded Third-Party Features

Depending on the features active on the website or in a client project, third-party services may include Google Analytics, Google Search Console, Google Tag Manager, Google reCAPTCHA, Google Business Profile, social media sharing or embedded content, advertising platforms, website plugins, hosting and security services. The tools actually used may vary over time and by project.

When enabled, these services may process technical identifiers, usage events, device or browser information, IP addresses or other information according to their own settings and privacy terms. We aim to configure optional tracking in line with the cookie choices and permissions required by applicable law. Third-party providers may process information in countries other than South Africa, subject to their systems and terms.

We do not control the independent privacy practices of third-party providers. Review their notices before interacting with embedded services or consenting to their optional cookies. For Google’s relevant privacy information, see Google Privacy.

8. Direct Marketing and Your Choices

We may contact you about an enquiry you submitted, a quotation you requested, an existing Service, a project, billing, security or other service-related matter. These operational communications are distinct from promotional marketing.

We may send promotional communications only where permitted by applicable law. Where prior consent is required, we will obtain it before sending such marketing. Where the law allows a limited exception for existing customers or similar circumstances, we will comply with the conditions and provide a clear, free and accessible way to opt out. You can ask us to stop direct marketing by emailing info@greyswandesigns.co.za with “Unsubscribe” or “Marketing Opt-Out” in the subject line, or by using an unsubscribe mechanism included in the communication.

We will not make continued service delivery conditional on consent to unrelated direct marketing where such consent is not necessary for the Service.

9. When We Share Personal Information

We do not sell personal information as a standalone commercial product. We may share or make information available where reasonably necessary for the purposes described in this Policy, including to:

• Service providers and operators: hosting companies, domain registrars, email providers, website and security tools, analytics services, cloud storage, technical support and other suppliers helping us operate our business or deliver a Service.
• Professional advisers: accountants, auditors, insurers, legal advisers and other professional advisers who need the information for legitimate professional purposes.
• Payment and financial providers: banks, payment processors and accounting systems to process or record transactions.
• Advertising, analytics and social platforms: where enabled, configured and lawfully permitted, including in accordance with your cookie choices.
• Clients and authorised representatives: information needed to deliver a project, communicate with an authorised contact or provide agreed reporting.
• Authorities and other parties: where required by law, a court order, lawful regulatory request, or where reasonably necessary to establish, exercise or defend legal rights or protect people and systems.
• Business transfers: a potential or actual purchaser, successor or restructuring party, subject to appropriate confidentiality and legal safeguards where applicable.

Where another party processes information on our behalf, we will take reasonable steps to use appropriate contractual and security measures. We seek to limit disclosures to information relevant to the stated purpose.

10. Client Websites and Information We Process for Clients

When Grey Swan Designs provides website hosting, maintenance, design, SEO or marketing services, client websites and systems may contain information submitted by that client’s customers, users, staff or other contacts. In such cases, the client may determine the purposes for which that information is collected, while Grey Swan Designs may process it only to provide the contracted service and in accordance with the client’s instructions and applicable law.

The client is generally responsible for ensuring that its own website has appropriate privacy notices, cookie controls, lawful collection practices and any required consents or permissions. Grey Swan Designs can assist with technical implementation where agreed, but a general privacy-policy template or cookie banner does not by itself guarantee legal compliance for a client’s particular business.

We may access client website information when necessary for support, troubleshooting, security, maintenance or other agreed work. We aim to restrict access to what is reasonably necessary and to use appropriate confidentiality and security measures.

11. International Transfers

Some suppliers and platforms may store or access information outside South Africa. Where personal information is transferred to another country, we will take reasonable steps to ensure that the transfer is permitted under POPIA, including where applicable by relying on an adequate level of protection, binding agreements, an applicable legal basis or another permitted condition under the Act.

Because third-party providers and their infrastructure may change, the country in which a particular item of information is processed may depend on the service used. You can contact us for further information about relevant providers where this can reasonably be identified.

12. Information Security

We take reasonable and appropriate technical and organisational measures intended to protect personal information against loss, damage, unauthorised destruction, unlawful access or unlawful processing. Depending on the service and information involved, safeguards may include access restrictions, account permissions, software updates, security monitoring, secure transfer methods and contractual confidentiality obligations.

No website, email system, internet transmission or storage environment can be guaranteed completely secure. You should use strong, unique passwords, protect account credentials and notify us promptly if you suspect that a Grey Swan Designs account or a service we manage has been compromised.

If a security compromise involving personal information occurs, we will assess and respond to it in accordance with applicable law, including any applicable notification obligations to the Information Regulator and affected data subjects. We will not imply that a breach has occurred unless we have a reasonable basis for that conclusion.

13. Retention and Deletion

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, for the duration of a relevant client relationship, to meet contractual or legal obligations, to resolve disputes, to maintain appropriate business records, or to establish, exercise or defend legal claims. The appropriate period depends on the type of information and the circumstances.

Accounting, tax, contractual and other records may need to be retained for periods prescribed by law. Technical logs, cookie identifiers, enquiry records and project files may have different retention periods based on operational needs, security, consent settings and applicable requirements.

When information is no longer required and there is no lawful reason to retain it, we will take reasonable steps to delete it, destroy it or de-identify it. Information may remain in routine backups for a limited period until those backups are overwritten or securely deleted, subject to reasonable safeguards.

14. Your Rights Under POPIA

Subject to applicable law, you may have the right to:

• Ask whether we hold personal information about you and request access to it through the applicable process.
• Request correction, deletion or destruction of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, unlawfully obtained or that we are no longer authorised to retain.
• Object to certain processing where the grounds and requirements in POPIA apply.
• Withdraw consent where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
• Object to processing for direct marketing in accordance with applicable law and request that direct marketing stop.
• Lodge a complaint with the Information Regulator of South Africa if you believe your personal information has been handled unlawfully.

These rights are subject to statutory conditions, exemptions and procedures. We may need to verify your identity and clarify the scope of a request before responding. Some information may need to be retained to comply with law, complete a transaction, protect legal rights or meet another lawful requirement. We will explain where a request cannot be fulfilled in full, to the extent required by law.

15. How to Make a Privacy Request or Complaint

To make a request about your personal information, withdraw consent, correct details or opt out of direct marketing, contact us using the details in section 20. Please describe your request clearly and include enough information for us to identify the relevant records. Do not email passwords or unnecessary sensitive documents. We may request reasonable proof of identity before disclosing or changing personal information.

You may also contact the Information Regulator of South Africa through its official website for guidance or to lodge a complaint: inforegulator.org.za. Please check the Regulator’s current contact details and prescribed forms before submitting a formal complaint.

16. Children’s Personal Information

Our Services are intended primarily for businesses and adults. We do not knowingly seek to collect children’s personal information through our general website enquiries. If a project requires processing children’s personal information, it must be discussed and appropriately authorised before processing begins, with any consent or authorisation required by POPIA and other applicable laws. If you believe a child has supplied personal information to us without appropriate authorisation, please contact us so that we can assess the matter.

17. Automated Processing and Profiling

We may use analytics or advertising tools that categorise website activity or use automated methods to measure performance. We do not intend to make decisions about you that produce legal consequences or similarly substantial effects solely through automated processing in the ordinary operation of this website. If a particular Service involves profiling or automated decision-making that is materially different, additional information should be provided where required by law.

18. Links to Other Websites

Our website or project work may contain links to third-party websites, social media platforms, plugins or embedded content. Those websites and services have their own privacy policies and practices. We are not responsible for the privacy, security or content of third-party services that we do not control. Review their terms before submitting information or interacting with their features.

19. Updates to This Policy

We may update this Policy to reflect changes in our business, website functionality, technologies, service providers or legal obligations. The revised version will be published on this page with an updated date. If a change materially affects an existing arrangement or requires additional notice or consent under applicable law, we will take the steps required in the circumstances.

20. Contact Details

For privacy questions, requests concerning personal information, or direct-marketing opt-outs, contact:

Grey Swan Designs (Pty) Ltd
Email: info@greyswandesigns.co.za
Phone: +27 78 125 5564
Location: Vredenburg, Western Cape, South Africa.