Privacy
Policy

01Introduction

RootGrowth Digital (“RGD”, “we”, “us”) respects your privacy and is committed to protecting your personal information in line with the Protection of Personal Information Act 4 of 2013 (POPIA) and, where it applies, the EU General Data Protection Regulation (GDPR).

This policy explains what we collect when you use rootgrowthdigital.com, contact us, or become a client; why we collect it; who we share it with; and the rights you have. The responsible party is RootGrowth Digital (Pty) Ltd, registration number 2026/606963/07, of 13 Wack Wack Close, Cape Town, Western Cape, 7140, South Africa. Our Information Officer is name, reachable at hello@rootgrowthdigital.com.

02What we collect

Information you give us

• Quote and contact forms: your name, business name, industry, phone/WhatsApp number, email address and anything you tell us about your project.
• WhatsApp, email and calls: the content of our conversations and any files you send.
• As a client: billing details, invoices, and the logins and content you provide so we can build and maintain your website.

Information collected automatically

• Usage data: pages viewed, time on page, referring site, approximate location (city level), device and browser type, via analytics tools described below.
• Technical data: IP address, cookie identifiers and server logs used for security and to keep the site running.

We do not knowingly collect information from anyone under 18, and our services are aimed at businesses.

03Why we use it

We use personal information to:

• Respond to enquiries and prepare quotes;
• Deliver, host, maintain and support the services you have engaged us for;
• Invoice and collect payment, and keep the financial records the law requires;
• Improve our website and understand which services people are interested in;
• Send occasional service updates or marketing about RGD — only where you have agreed, and you can opt out at any time;
• Protect our systems, prevent fraud and comply with legal obligations.

Under POPIA our lawful bases are: performing a contract with you, your consent (which you may withdraw), our legitimate interests in running and promoting our business, and compliance with law.

04Cookies and analytics

Our website uses a small number of cookies and similar technologies:

• Essential cookies that make the site work (for example remembering that you closed a notice).
• Analytics — e.g. Google Analytics 4 / Vercel Analytics — which give us anonymised statistics about how visitors use the site.
• Advertising pixels — e.g. Meta Pixel, Google Ads tag — only where we run campaigns, to measure their effectiveness.

You can block or delete cookies in your browser settings; the site will still work but some features may be limited. Where the law requires it, we ask for consent before setting non-essential cookies.

05Who we share it with

We never sell personal information. We share it only with:

• Service providers who process data on our behalf under contract — hosting and infrastructure (e.g. Vercel, Cloudflare), email, analytics, invoicing and payment platforms, and WhatsApp Business (Meta).
• Subcontractors such as copywriters or developers we bring onto a project, bound by confidentiality.
• Professional advisers (accountants, lawyers) where necessary.
• Authorities where required by law, a court order or to protect our legal rights.

Some providers store data outside South Africa. Where that happens we make sure the recipient is bound by appropriate safeguards, as POPIA section 72 requires.

06Client website data

When we build or host a website for you, the data collected by your website — your customers’ enquiries, bookings or orders — belongs to you. You are the responsible party for that data and we act as your operator, processing it only on your instructions and keeping it secure. You are responsible for publishing a privacy policy on your own site; we can help you draft one.

07Security

We protect personal information with technical and organisational measures appropriate to the risk, including SSL/TLS encryption in transit, access controls and two-factor authentication on our accounts, encrypted backups, and least-privilege access for anyone working on a project. No system is completely secure; if we become aware of a breach affecting your personal information we will notify you and the Information Regulator as POPIA requires.

08How long we keep it

• Enquiries that do not become projects: up to 12 months, then deleted.
• Client records, contracts and correspondence: for the life of the relationship and 5 years afterwards, in line with tax and record-keeping law.
• Website backups: for the retention period of your care plan, typically 30 days rolling.
• Analytics data: as set in the analytics tool, normally 14–26 months in aggregated form.

09Your rights

Under POPIA (and GDPR where applicable) you have the right to:

• Ask what personal information we hold about you and receive a copy;
• Ask us to correct or delete it;
• Object to processing, including for direct marketing;
• Withdraw consent where consent is the basis for processing;
• Lodge a complaint with the Information Regulator of South Africa (inforegulator.org.za).

To exercise any of these, email hello@rootgrowthdigital.com. We will respond within 30 days and may ask you to verify your identity first.

10Links to other sites

Our website links to client websites, social media and third-party tools. Their privacy practices are their own; please read their policies. We are not responsible for the content or privacy practices of sites we do not operate.

11Changes to this policy

We may update this policy as our services or the law change. The date at the top shows the current version. Material changes will be flagged on our website, and where required we will ask for your consent again.