Privacy Policy

Sweet Phoenix Creations PTY Ltd ("we," "us," or "our") is committed to protecting your privacy in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) of South Africa, the General Data Protection Regulation (GDPR) where applicable, and all other relevant data protection legislation. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website sweetphoenix.co.za and any of our sub-domain services.

1. Information We Collect

1.1 Personal Information You Provide: We may collect personal information that you voluntarily provide to us when you:

• Fill out our contact form (name, email address, phone number, message)
• Request a quote or project consultation
• Subscribe to our email communications or newsletter
• Contact us via email, phone, or WhatsApp

1.2 Automatically Collected Information: When you visit our website, we automatically collect certain information about your device and usage, including your IP address, browser type, operating system, referring URLs, pages viewed, and time spent on pages. This data is collected through cookies and similar tracking technologies (see Section 5).

2. How We Use Your Information

We process your personal information for the following lawful purposes under POPIA:

• Consent (Section 11(1)(a)): To respond to your inquiries, provide requested services, and send project updates
• Legitimate Interest (Section 11(1)(f)): To improve our website functionality, user experience, and service offerings
• Legal Obligation (Section 11(1)(c)): To comply with applicable laws, regulations, and legal processes
• Contractual Necessity (Section 11(1)(b)): To perform and manage project contracts and deliverables

3. Information Sharing and Third Parties

We do not sell, trade, or rent your personal information to third parties. We may share information with the following categories of trusted service providers who are contractually bound to protect your data:

• Hosting Providers: Vercel Inc. and Netlify Inc. (website hosting and deployment)
• Analytics: Google Analytics 4 (anonymized website traffic analysis)
• Advertising: Google AdSense (contextual advertising)
• Communication: WhatsApp Business API (customer communication where you initiate contact)
• Database: Supabase (encrypted application data storage for our SaaS products)

4. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. Contact form submissions are retained for a maximum of 24 months. Anonymized analytics data may be retained indefinitely for trend analysis. You may request deletion of your data at any time (see Section 7).

5. Cookies and Tracking Technologies

Our website uses the following cookies and tracking technologies:

• Google Analytics (gtag.js): We use Google Analytics 4 to collect anonymized data about website traffic and user behavior. Google Analytics uses cookies to distinguish unique users and sessions. Data is processed by Google LLC in the United States under their privacy policy.
• Google AdSense: We display advertisements served by Google AdSense. AdSense uses cookies to serve ads based on your prior visits to our website and other websites. You may opt out of personalized advertising by visiting Google Ads Settings.
• Essential Cookies: Necessary for basic website functionality (session management, security).

You can control cookie preferences through your browser settings. Disabling cookies may affect certain website features.

6. Children's Privacy

This website does not knowingly collect personal information from children under the age of 18. Our child-facing product, Kryzzo, is designed with a privacy-first architecture that processes all child data locally on the parent's device and does not transmit identifiable child data to our servers. Parents or guardians who believe their child has provided personal information to us should contact us immediately at info@sweetphoenix.co.za.

7. Your Rights Under POPIA

As a data subject under POPIA, you have the right to:

• Request confirmation of whether we hold your personal information
• Request access to your personal information
• Request correction or deletion of inaccurate or outdated information
• Object to the processing of your personal information
• Lodge a complaint with the Information Regulator of South Africa
• Withdraw consent for processing at any time (where consent was the legal basis)

8. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include SSL/TLS encryption for all data in transit, Row Level Security (RLS) on our database systems, and regular security audits. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. Cross-Border Data Transfers

Some of our third-party service providers (Google, Vercel, Supabase) process data in the United States and other countries. In such cases, we ensure that adequate safeguards are in place in accordance with Section 72 of POPIA, including binding contractual agreements that provide equivalent levels of data protection.

10. Changes to This Policy

We reserve the right to update this Privacy Policy at any time. Changes will be posted on this page with an updated "Last Updated" date. We encourage you to review this policy periodically. Continued use of our website after any modifications constitutes your acceptance of the revised policy.

11. Information Officer and Contact

To exercise any of your rights or if you have questions about this Privacy Policy, please contact our designated Information Officer:

You may also contact the Information Regulator of South Africa at inforegulator.org.za if you believe your personal information has been processed in violation of POPIA.