Privacy Policy

1. Introduction

Let’s Crea8 (“we”, “us”, or “our”) is a web design, graphic design, digital marketing, and e-commerce integration service provider based in South Africa. We respect your privacy and are committed to protecting your personal information in accordance with the Protection of Personal Information Act, 4 of 2013 (POPIA), and where applicable, international data protection laws such as the EU/UK General Data Protection Regulation (GDPR / UK GDPR).

This Privacy Notice applies to all data subjects whose personal information we process. A “data subject” includes, but is not limited to:

• Clients and prospective clients
• Suppliers and vendors
• Service providers and contractors (including occasional subcontractors)
• Job applicants
• Any other individuals whose personal information we process in the course of our business operations

(This notice does not apply to our own employees/staff, who receive a separate internal staff privacy policy.)

This Privacy Notice explains how we collect, use, store, share, and protect personal information when you interact with our website (crea8.co.za), contact us via forms, email, WhatsApp, phone, submit a job application, supply goods/services to us, or otherwise engage with our business.

By providing your personal information to us (whether via the website or any other channel), you acknowledge that you have read and understood this Notice.

2. International Clients and Data Protection Laws

We provide services to clients in South Africa and internationally, including the United Kingdom and the United States. While this Privacy Notice is primarily drafted to meet POPIA requirements, we aim to apply equivalent protections consistent with GDPR principles when processing personal data of individuals in the EU or UK.

If you are located in a jurisdiction with specific data protection rights, please contact us so we can assist you appropriately.

3. Who We Are (Responsible Party)

Business Name: Giovanni Liebenberg t/a Let’s Crea8
Physical Address: 16 Park Street, Perlamoenbaai, Gansbaai, 7220, Western Cape, South Africa
Information Officer: Giovanni Liebenberg (Founder & Owner)
Information Regulator Registration Ref: 202606014489
Email: gio@crea8.co.za
Phone: +27 83 300 0158

You can contact our Information Officer with any questions or requests regarding your personal information.

4. Personal Information We Collect

We collect the following categories of personal information / personal data:

• Contact details: Name, email address, phone number, and physical/postal address.
• Business details: Company name and VAT registration number.
• Billing-related information: Details required to issue and send invoices and statements.
• Technical / usage information: We may indirectly collect anonymous technical data (such as IP address, browser type, or device information) via Google Search Console. We do not actively collect this for identification purposes.
• Cookies and tracking data: Managed through CookieYes on our WordPress website.
• Content review details (Project Pulse): For client contacts and contractors who review or edit content, we hold your name, email address, a personal secure link, and a record of what you edited, approved or asked to change, with the date and time.
• Device details (Project Pulse): For contractors who sign in to Project Pulse and choose to receive notifications, we hold a device name and browser details.

We do not collect special personal information (such as health, religious, biometric, or race data) or information about children under 18. Our services are aimed at business owners, executives, and general managers.

Our website and services are directed exclusively at adults aged 18 and over, specifically business owners, executives, and general managers. We do not knowingly collect, process, or store personal information from children under the age of 18. If you are under 18, please do not submit any personal information through our website or contact forms.

If we become aware that we have inadvertently collected personal information from a child under 18 without appropriate parental or guardian consent, we will delete that information as soon as reasonably practicable. If you believe we may have collected information from or about a minor, please contact us immediately at gio@crea8.co.za.

In accordance with Section 34 of the Protection of Personal Information Act 4 of 2013 (POPIA), we do not process personal information of children and have not sought authorisation from the Information Regulator to do so, as our services are not directed at or intended for use by minors.

For suppliers, contractors and job applicants we typically collect only basic contact and business details necessary for the relevant relationship (e.g. invoicing, project coordination or recruitment).

5. Lawful Bases for Processing

We only process your personal information on valid lawful bases, including:

• Consent – Where you have given clear consent for a specific purpose.
• Contract – To perform our services or take steps at your request before entering into a contract.
• Legal obligation – Where we are required by law to process your data.
• Legitimate interests – For our business purposes (e.g. website maintenance, responding to enquiries, improving our services), provided your rights do not override our interests.

6. How We Collect Your Information

We collect your personal information through:

• Website contact / enquiry forms
• Email, WhatsApp, and phone correspondence
• Google Search Console (anonymous technical data only)
• Cookies (via CookieYes)

7. Purpose of Processing

We process your personal information only for the following specific purposes:

• To communicate with you about the web design, graphic design, digital marketing, or e-commerce services in which you have expressed interest.
• To provide our contracted services and manage client projects.
• To issue invoices, process billing, and maintain financial records.
• To respond to enquiries and provide customer support.
• For legitimate business purposes such as website maintenance and record-keeping.

8. Voluntary or Mandatory Provision

Providing certain personal information (such as name, email, phone, and business details) is mandatory if you wish to receive a quote, engage our services, or receive billing documents. Without this information we may be unable to provide or invoice for our services.

Other information is voluntary. You may choose not to provide optional details, but this may limit our ability to assist you fully.

9. Sharing Your Personal Information

We only share your personal information with third parties when strictly necessary and on a “need-to-know” basis. This includes service providers we use for day-to-day operations, including cloud storage and email (Google Workspace, Google Drive, iCloud, Microsoft OneDrive), invoicing and billing (Zoho Invoice), website security and backup tools (Wordfence, WPvivid), communication platforms (WhatsApp), website search performance (Google Search Console), cookie consent management (CookieYes), Cloudflare (Pages, Workers, KV data storage and R2 file storage), which powers Project Pulse, our own site-monitoring and maintenance dashboard, and Anthropic (Claude), an AI service we use to help draft website content, marketing copy, and client reports from information already held in Pulse. Each provider has their own privacy policy and data protection commitments. We only share information with these providers to the extent necessary for our legitimate business operations.

For clients whose websites we actively maintain, Project Pulse may access technical site data (software versions, backup status, security scan summaries, uptime/downtime status from Pulse’s own monitoring, SSL certificate status, hosting storage usage, broken internal link reports, and search performance data such as clicks, impressions, and search queries for your pages) and, where instructed, perform maintenance actions such as running software updates or backups on your behalf. Search performance data reaches Pulse through our own read-only Google service account, which you separately grant access to in your Google Search Console settings by adding it as a restricted user (Settings > Users and permissions). Pulse never requests or stores your Google password.

Where we use Project Pulse to generate draft blog content, social media posts, or monthly performance reports on your behalf, this drafting is performed with the assistance of Anthropic’s Claude AI, using only the business information, search performance data, and website content already described in this policy. All AI-drafted content is reviewed by our team before anything is published or sent to you for approval.

Project Pulse also runs a monthly privacy compliance check on the public pages of client websites, such as their privacy and cookie policies. Anthropic’s Claude is used to suggest wording changes, which our team reviews. These suggestions are not legal advice, nothing on a website is changed automatically, and the answers our team types in are kept so that the same question is not asked again.

We may engage independent contractors and subcontractors, for example for content writing, social media management, graphic design or website development and maintenance. They work under written agreements that include confidentiality and data protection obligations in line with POPIA (and GDPR principles where applicable). Contractors do not communicate with our clients directly. They access client information primarily through Project Pulse, our own monitoring and content platform, where each person signs in individually and sees only what their role requires. This may include business profile information and draft content, or technical site information for developers. Their actions in Project Pulse are logged, and their access ends when their engagement ends. Client contacts who review content do so through a personal secure link rather than a sign in.

10. Cross-Border Transfers

Some of our service providers (e.g. Google Workspace, iCloud, Microsoft OneDrive, Zoho, Cloudflare, and Anthropic) may store or process data outside South Africa, including in countries such as the United States.

Where personal information is transferred internationally, we take reasonable steps to ensure appropriate safeguards are in place, such as:

• Secure, encrypted connections.
• Service provider agreements that include appropriate safeguards (including Standard Contractual Clauses or equivalent mechanisms where required for GDPR compliance).
• Reliance on your consent or the necessity of the transfer to perform our contract with you.

11. Cookies and Tracking Technologies

We use cookies and similar technologies on our website, managed through CookieYes. A cookie consent banner is displayed to allow you to manage your preferences.

Essential cookies are necessary for the website to function. We do not currently use non-essential cookies. You can manage your preferences at any time through the banner or your browser settings.

Project Pulse and its review pages store display preferences in your browser. These are strictly necessary and are not used to track you.

For full details of the cookies we use, including names, providers, purposes, and expiry durations, please see our Cookie Policy.

12. Storage and Security

We store your personal information using secure tools including Mac software (Mail, Contacts), Google Workspace, Zoho Invoice, and WhatsApp (with disappearing messages set to 90 days where applicable).

We take reasonable technical and organisational measures to protect your information, including:

• Avast Premium Security on our devices.
• Apple Passwords for secure credential management.
• Regular deletion of sensitive data (such as passwords) where possible.
• Access controls and secure communication channels.

Project Pulse data is held with Cloudflare and protected by individual sign in for our team, personal secure links for client reviewers, role based access and an activity log. Nightly backups are kept for 30 days.

While we strive to protect your information, no system is completely secure. We will notify you and the relevant supervisory authority of any security compromises as required by law.

13. Retention of Personal Information

We retain your personal information only as long as necessary for the purposes described above or as required by law. Our standard retention periods are: client project files — 5 years from project completion; billing and invoice records — 7 years (SARS legal requirement); enquiry and prospect data — 2 years from last contact; job applications — 6 months unless a position is offered. You may request permanent deletion of your information at any time, subject to legal obligations such as billing records which we are required by law to retain.

Project Pulse: generated content, review records and uploaded images are removed 90 days after the end of the content month. Content that is approved but not yet scheduled or published is kept until it is. Items that are deleted are held for 30 days and then removed permanently. Records of who approved what are kept for 12 months and then removed or anonymised. Review links expire after 30 days of non use.

14. Your Rights

You have the following rights regarding your personal information:

• Right of access — request access to the personal information we hold about you.
• Right to correction or deletion — request correction or deletion of inaccurate, irrelevant, or excessive information. Once your request has been actioned, we will notify you of the correction, deletion or destruction carried out.
• Right to object — object to the processing of your personal information at any time, including for direct marketing purposes.
• Right to withdraw consent — withdraw consent at any time where processing is based on consent.
• Right to data portability — request your data in a structured, commonly used format.

Where your name appears in a Project Pulse review record, we can anonymise it on request and keep the date and time of the record.

How to submit a request: you may submit any of the above requests free of charge through any of the following channels:

• Email: gio@crea8.co.za (preferred channel for record-keeping purposes)
• WhatsApp: +27 83 300 0158 (please follow up any WhatsApp request with an email confirmation to ensure it is properly recorded and actioned)
• Post: 16 Park Street, Perlamoenbaai, Gansbaai, 7220, Western Cape, South Africa

We will respond to all requests within 30 days of receipt. For complex or voluminous requests, we may extend our response time by a further 30 days (60 days total) and will notify you of the extension and the reason for it within the initial 30-day period. You may also submit a request using our dedicated Personal Data page.

15. PAIA Manual

You may access our PAIA Manual here: PAIA Manual – Let’s Crea8

16. Complaints

If you are unhappy with how we have handled your personal information, please first contact our Information Officer. You also have the right to lodge a complaint with the Information Regulator (South Africa) or the relevant supervisory authority in your jurisdiction.

Information Regulator (SA): Complaints about personal information can be sent to the Information Regulator of South Africa at inforegulator.org.za (complaints: POPIAComplaints@inforegulator.org.za, general enquiries: enquiries@inforegulator.org.za, telephone 010 023 5200).

17. Updates to This Policy

We may update this Privacy Policy from time to time. The latest version will always be available on our website with the updated “Last Updated” date. We encourage you to review it periodically. In accordance with the POPIA Amendment Regulations 2025, we are committed to continuously reviewing and improving our data protection compliance framework to reflect ongoing operational and legal developments.

18. Contact Us

For any questions about this Privacy Policy or our data practices, please contact:

Giovanni Liebenberg
Email: gio@crea8.co.za
Phone: +27 83 300 0158