Privacy

This notice explains how forge collects, uses, shares and protects personal information, and what you can do about it. It is written to meet the Protection of Personal Information Act 4 of 2013 (POPIA) and its Regulations. We have kept it in plain English; where a word has a legal meaning, it carries the meaning POPIA gives it.

Effective date: TO BE SUPPLIED — date published

Who is responsible for your information

forge is the responsible party for the personal information described here — the party that decides why and how it is processed. Our legal name, registration details and addresses are set out once, on the terms of use. Our Information Officer is named in our PAIA manual. To reach us, use the channels on the contact page.

What this notice covers

• People who visit weforge.africa.
• People who contact us — by email, by WhatsApp, or in person.
• Clients, prospective clients and the people who work for them, where we deal with them in our own right.
• Suppliers, partners and people who approach us about working with us.

What it does not cover

• Information we process for a client. When a client gives us personal information to work on — data in a reporting system, a model or a solution we build — we act as the client's operator under sections 20 and 21 of POPIA. The client is the responsible party, and the engagement contract governs that processing. If your information reaches us that way, the client is the right first point of contact.
• Other websites. Links on this site — including the photography and type credits in the footer — lead to sites run by others, under their own privacy terms. We do not control them and are not responsible for how they handle your information.
• What your browser stores. That is set out on the cookies page.

Changes to this notice

We will update this notice when what we do changes, or when the law does. The version on this page, with its effective date, is the one that applies. If a change materially affects information we already hold about you, and we have a way to reach you, we will tell you directly.

Nothing here takes away your statutory rights

This notice describes what we do; it does not ask you to give anything up. Nothing in it limits a right you have under POPIA, or any other law, that cannot lawfully be limited.

We collect only what we need for a stated purpose, and we do not use it for a purpose that is incompatible with the one it was collected for.

When you visit this website

What the site stores in your browser, and what it loads, is set out on the cookies page.

Like every website, the server that delivers it receives some technical information with each request: your IP address, your browser and device type (the user agent), the page requested, the date and time, and the page that referred you, if any. These are recorded in the hosting provider's server logs.

• Why: to deliver the site, keep it secure and working, and investigate misuse or faults.
• Lawful basis: our legitimate interest in running a secure website (section 11(1)(f)).
• Voluntary? Your browser sends this automatically; the site cannot be delivered without it.

We do not use this information to identify you, and we do not combine it with anything else we hold, unless we need to investigate a security incident or the law requires it.

When you contact us

Whatever you choose to send us: usually your name, email address or phone number, the organisation you work for and your role, and what your message says. If you contact us on WhatsApp, we also receive your WhatsApp number and profile name.

• Why: to reply, to understand what you need, to prepare a proposal if you ask for one, and to keep a record of what was agreed.
• Lawful basis: taking steps you have asked for before a contract (section 11(1)(b)), and our legitimate interest in answering the people who approach us (section 11(1)(f)).
• Voluntary? Yes. Without a way to reach you, we cannot reply; without enough detail, we may not be able to help.

When we work together

For clients, prospective clients, suppliers and partners: the names, job titles and business contact details of the people we deal with, correspondence and meeting notes, proposals, contracts, invoices, payment and banking details, and — where the law requires it — tax and identity information.

• Why: to deliver and manage the work, to invoice and pay, to keep proper business records, and to meet our legal and tax obligations.
• Lawful basis: performing a contract (section 11(1)(b)), complying with the law (section 11(1)(c)), and our legitimate interest in running the business (section 11(1)(f)).
• Voluntary? Supplying it is voluntary, but where it is needed for a contract or required by law — for example, the details a tax invoice must carry — we cannot enter into or perform the contract without it.
• Laws that require it: the Tax Administration Act 28 of 2011 (section 29); the Value-Added Tax Act 89 of 1991 (section 55), if forge becomes a VAT vendor; and the Companies Act 71 of 2008 (section 24).

When you ask about working with us

If you approach us about a role or about joining the partner collective, we keep what you send — typically a CV, a portfolio, contact details and correspondence — to consider it. We do not seek references or background checks without telling you first.

• Lawful basis: taking steps you have asked for (section 11(1)(b)) and our legitimate interest in finding the right people (section 11(1)(f)).
• Voluntary? Yes. Without it, we cannot consider you.

Where the information comes from

Almost always, from you. Occasionally from someone else: a colleague who introduces you, your employer when it engages us, or information you have made public in a professional capacity, such as a company website or a professional profile. When we collect from another source, we do so only where POPIA allows it (section 12).

What we do not collect

• Special personal information — such as health, religious or philosophical beliefs, race or ethnic origin, political persuasion, sex life, biometric information, trade union membership or criminal behaviour. We do not ask for it. Please do not send it to us unless we have specifically agreed that it is needed; if it arrives unasked, we will delete it unless we are required to keep it.
• Children's information. This site and our services are meant for adults acting in a business or professional capacity. We do not knowingly collect personal information from anyone under 18. If you believe a child has sent us their information, let us know and we will delete it.

No automated decisions

We do not make decisions about you based solely on automated processing — including profiling — that have legal consequences for you or affect you to a substantial degree (section 71).

Direct marketing

We do not send marketing to people who have not asked for it. If we ever send news or offers electronically, we will do so only with your consent, or — if you are an existing client — where all of the following hold (section 69(3) of POPIA):

• we obtained your contact details in the context of selling you a product or service;
• the message markets only forge's own similar products or services; and
• you were given a reasonable opportunity to object, free of charge, when your details were collected, and are given one again in each message.

Every such message will identify us and give you a simple way to stop receiving them, and we will honour that request. We may keep your contact details on a suppression list for the sole purpose of making sure we do not contact you again.

We do not sell personal information, and we do not share it for anyone else's marketing. We share it only as set out here.

Partner companies in the collective

forge works with a collective of partner companies. To answer an enquiry properly, or to deliver work, we may share the relevant part of it — usually your name, organisation, contact details and what you need — with a partner whose expertise it calls for. A partner receives only what it needs for that purpose. We share an enquiry with a partner only where that partner is bound to forge by a written confidentiality agreement and, where it processes the information on forge's behalf, by an operator agreement as section 21 of POPIA requires. Where a partner then deals with you directly, it may become a responsible party in its own right, and its own privacy notice applies to what it does.

Where we can, we will tell you which partner is involved. If you would rather we did not share your enquiry at all, say so when you contact us and we will respect it — though it may limit how fully we can help.

Service providers who process information for us

We use service providers — operators, in POPIA's terms — to run the business. Each processes personal information only on our instructions, under a duty of confidentiality and with security measures in place, as sections 20 and 21 of POPIA require.

We may also share information with professional advisers — such as accountants, auditors and lawyers — who are bound by professional confidentiality, and with our insurers where it is needed for cover or a claim.

WhatsApp

If you choose to contact us on WhatsApp, your messages pass through a service run by WhatsApp LLC, part of Meta, which processes them outside South Africa under its own terms and privacy policy, as the provider of a service you and we both chose to use. Our own backups of WhatsApp chats may be stored with a cloud provider outside South Africa — TO BE SUPPLIED — backup provider, if any — under the transfer rules below. If you would rather your message did not pass through it, use email instead — the options are on the contact page.

When the law requires it

We will disclose personal information where the law requires us to — to a regulator, a court, the South African Revenue Service or law enforcement — or where it is needed to establish, exercise or defend a legal claim, or to protect someone's life or safety.

If the business changes hands

If forge is incorporated, restructured, merged or sold, the personal information we hold may pass to the entity that carries on the business, which will be bound by this notice or one that protects you at least as well.

Transfers outside South Africa

Some of our providers may store or process information outside South Africa — WhatsApp does, as may the provider of our WhatsApp chat backups named above, and the location of our hosting and email servers is TO BE SUPPLIED — server locations. Under section 72 of POPIA, we transfer personal information across the border only where:

• the recipient is subject to a law, binding corporate rules or a binding agreement that gives it substantially similar protection to POPIA; or
• the transfer is needed to perform a contract with you, or to take steps you have asked for; or
• you have consented to it.

Choosing to contact us through a service that operates outside South Africa, such as WhatsApp, means your message will be processed there.

How long we keep it

We keep personal information only for as long as we need it for the purpose it was collected for, or for as long as the law requires or allows (section 14 of POPIA). After that, our policy is to delete or destroy it, or de-identify it so that it can no longer be linked to you. The periods below are what we aim for, unless we need to keep the information longer for a reason section 14 of POPIA permits.

We may keep information longer where it is needed to establish, exercise or defend a legal claim, or where the law requires it. Information that has been de-identified may be kept for record or statistical purposes.

How we protect it

We take reasonable technical and organisational measures to protect personal information against loss, damage, and unauthorised access or destruction, as section 19 of POPIA requires. In practice, that means:

• collecting as little as we can — the website itself gathers nothing beyond what any web server must;
• limiting access to the people who need it for their work;
• choosing providers that protect information in transit and at rest, and binding them by contract;
• using strong authentication on the accounts that hold personal information; and
• reviewing these measures as risks and our business change.

No method of storage or transmission is completely secure, and email and messaging services pass through systems outside our control. We cannot guarantee absolute security, and we do not claim to. Please do not send us anything sensitive over an ordinary channel; if you need to share something sensitive, contact us first and we will agree a safer way.

If something goes wrong

If we have reasonable grounds to believe that someone without authority has accessed or acquired your personal information, we will notify the Information Regulator and you as soon as reasonably possible, as section 22 of POPIA requires. We will tell you what happened, what it may mean for you, what we are doing about it, and what you can do to protect yourself — unless a public body responsible for investigating crime tells us that notifying you would impede its investigation.

POPIA gives you rights over your personal information. You can use them at any time.

What you can ask for

• Access — to know whether we hold personal information about you, free of charge, and to request a copy of it (sections 23 and 25). Access requests follow the procedure in our PAIA manual, which also sets out any prescribed fee.
• Correction and deletion — to have us correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, or to destroy or delete information we are no longer authorised to keep (section 24). We will do so, or give you credible evidence of why the information is correct, and tell you what we have done.
• Objection — to object, on reasonable grounds relating to your particular situation, to our processing your information on the basis of legitimate interest (section 11(3)(a)). We will then stop, unless the law allows us to continue.
• Stop direct marketing — to object at any time to receiving direct marketing, and to have us stop (section 11(3)(b)). You never need to give a reason.
• Withdraw consent — where we rely on your consent, to withdraw it at any time. This does not affect processing that happened before you withdrew it, or processing we are entitled to carry out on another basis.

How to make a request

A request for access to your personal information is made under the procedure in our PAIA manual. Every other request under POPIA should be directed to our Information Officer, whose particulars are set out in the PAIA manual. POPIA's Regulations prescribe forms for objections (Form 1) and for correction or deletion (Form 2); using them helps, but we will not refuse a clear request because it was not made on a form.

We will need to confirm who you are before we act, so that we do not give your information to someone else. We will respond within a reasonable time and, where a law sets a time limit, within it. If we cannot do what you ask — because a law requires us to keep the information, for example, or because doing so would reveal someone else's information — we will tell you why.

Complaining to the Information Regulator

If you believe we have handled your personal information unlawfully, you may complain to the Information Regulator (section 74). We would appreciate the chance to put it right first, so please tell us — but you do not have to.

The Regulator's details change from time to time; its contact page has the current ones.