How I handle your information.

Trueline is the trading name of Jarrod Hinde, trading as a sole proprietor. There is no separate legal entity, so I am personally the responsible party.

Address: Phase 3, Serengeti Golf and Wildlife Estate, Kempton Park, Gauteng, South Africa.
Email: jarrod@trueline.systems
Telephone: 082 329 7662

Jarrod Hinde is the Information Officer, reachable at jarrod@trueline.systems.

This is not a title I gave myself. Under POPIA the Information Officer of a private body is its head by operation of law, so for a one-person studio it is me whether I appoint myself or not. The role carries personal accountability for what follows.

• ·Your name.
• ·Your company.
• ·Your email address.
• ·What you are running the process on today, chosen from a list.
• ·Roughly what you have set aside, chosen from a list, which is optional.
• ·A free-text description of the problem.

Whatever you type into that last box is up to you. Please do not put anything in it that you would not want stored, and in particular do not send me anyone else's personal information, medical details, or identity or account numbers. If you do, I will delete it and tell you I have.

• ·A one-way hash of your IP address. Not the address itself. It is combined with a secret value and hashed, so it cannot be turned back into your address. Its only job is to stop one person submitting the form a thousand times.
• ·Ordinary server logs kept by the hosting provider, which include IP addresses and are retained on their schedule rather than mine.
• ·Your light or dark theme choice, stored in your own browser. It never reaches me. There are no analytics, no advertising trackers and no third-party cookies on this site, which is why you have not been asked to dismiss a cookie banner.

To read your enquiry, answer it, and have the conversation that follows. If we end up working together, to run that engagement. That is the whole list.

I do not use it for anything else. I do not build a marketing list from it, I do not profile you, and there is no automated decision-making of any kind.

Supplying it is entirely voluntary. Nothing in law requires you to give me any of it.

The consequence of not supplying it is narrow and obvious: I cannot reply to an enquiry I cannot read or an address I do not have. If you would rather not use the form, email me directly and share only what you want to.

Processing is necessary to take steps at your request before entering into a contract, and for my legitimate interest in responding to people who ask me to. Both are recognised grounds under section 11 of POPIA. I am not relying on consent, which means you do not have to give any, and withdrawing it is not the mechanism you need. The objection right below is.

I do not sell your information, share it for marketing, or pass it to anyone for their own purposes. Nobody sees an enquiry but me.

Three suppliers process it on my instructions, under contract, and may not use it for anything of their own:

• ·Supabase, which hosts the database the enquiry is stored in
• ·Lovable and its hosting provider, which serve the website itself
• ·Lovable Emails and its delivery provider, which deliver the notification telling me an enquiry arrived, and handle it in transit only

The database sits in Northern Virginia, in the United States, on Amazon Web Services in the us-east-1 region, and the website is served from a global edge network. So your information is processed outside South Africa. POPIA allows this where the recipient is bound by an agreement that gives effect to principles substantially similar to POPIA, which is the basis I rely on under section 72.

I am telling you this plainly because most South African privacy notices of this length quietly do not.

• ·An enquiry that goes nowhere: deleted 12 months after you sent it.
• ·An enquiry that becomes work: kept for the engagement, then for five years from the end of the tax year in which it ended, because tax and company law require me to keep records of what I was paid for.
• ·The hashed IP: deleted after 24 hours. It has no purpose beyond that.

Ask me to delete something sooner and, unless a law requires me to keep it, I will, and I will confirm when it is done.

Section 19 requires reasonable technical and organisational measures. Here is what that means concretely, rather than a sentence saying I take your privacy seriously:

• ·The database rejects reads, updates and deletes from the public internet. Those permissions are enforced in the database itself, not hidden in the interface, and row level security is forced so the rule binds even the table owner.
• ·Only the server can write an enquiry. The browser holds no credential capable of it.
• ·Field limits and content rules are constraints on the table, so a malformed or oversized submission is rejected by the database rather than by a script someone can skip.
• ·Submissions are rate limited, using the hashed address described earlier.
• ·Everything travels over TLS. The site sets a content security policy, denies framing, and sends the usual hardening headers.
• ·Access to the database is limited to me.

If your information is accessed or acquired by someone unauthorised, section 22 requires me to notify the Information Regulator and you, as soon as reasonably possible after establishing what happened. I will tell you what was taken, what I think the consequences are, and what I have done about it. I would rather tell you early and be wrong about the scale than tell you late.

• ·Ask what I hold about you, and get a copy. Section 23. Free of charge to confirm whether I hold anything; a prescribed fee may apply to the copy itself.
• ·Have it corrected or deleted if it is wrong, misleading, outdated, incomplete, excessive, or obtained unlawfully. Section 24.
• ·Object to the processing on reasonable grounds. Section 11(3). If you object I stop, unless a law says otherwise.
• ·Complain to the Information Regulator, at any time, without going through me first.

Email jarrod@trueline.systems for any of these. I will answer within 30 days, and usually the same week. There is a prescribed form for access and objection requests, but I am not going to insist on it. Ask me in a sentence.

JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
PO Box 31533, Braamfontein, Johannesburg, 2017
General enquiries: enquiries@inforegulator.org.za
Complaints: POPIAComplaints@inforegulator.org.za
inforegulator.org.za

My PAIA manual, prepared under section 51 of the Promotion of Access to Information Act, is available on request by email. Ask and I will send it the same day.

The version date is at the top. If I change anything that affects what I do with information I already hold, I will say so here and date it, rather than editing quietly.