Privacy notice — the client-site template, and Leachie's own position

Canonical source: biz/legal/privacy-popia.md — edit the markdown, re-run npm run sync in workspace-site, rebuild, redeploy. The A4 PDF is the client's copy and has the internal notes stripped.

INTERNAL, strip before rendering ------------------------------------------
     Plain-language draft by Claude, 2026-08-10. Not attorney-reviewed. See
     LEGAL-PLAN.md §1 for the POPIA reasoning and what is verified.

     TWO DOCUMENTS IN ONE FILE, because they must stay consistent:
       Part A = the notice that goes ON a client's site (swap the bracketed bits).
       Part B = Leachie's own notice for leachie.com, which has a checkout and so
                actually does process personal information.

     Part A is written for the sites as they are TODAY: no forms, no analytics, no
     cookies, enquiries by WhatsApp/mailto straight to the practitioner. Every one
     of those sentences becomes a lie the moment someone adds a contact form that
     emails a copy anywhere. If a site gains a form, an analytics script or a
     booking tool, THIS NOTICE MUST CHANGE FIRST.

     Cloudflare Web Analytics is the standing analytics pick (cookieless, no
     personal information) — Part A has a paragraph for it, commented out. Turn it
     on when analytics goes on, not before.

     For an e-commerce client (Aerias: card payments, customer accounts, addresses)
     Part A is NOT sufficient. That needs its own notice and a professional read.

Part A — for a client's site

Privacy

[PRACTICE NAME] respects your privacy. This page explains, plainly, what happens to your information when you visit this website.

This website does not collect anything about you

There are no contact forms on this site, no newsletter sign-up, and no accounts to create. The site does not track your browsing, does not build a profile of you, and does not use cookies for advertising. Nobody is paying to watch what you do here.

When you get in touch

The buttons on this site open your own WhatsApp or your own email program, addressed to [PRACTITIONER NAME]. Your message goes directly to her — it does not pass through this website, and no copy is kept here.

From that point your message is an ordinary private message between you and her, held in her own WhatsApp and email account, and covered by the confidentiality that applies to her professional practice.

Who looks after this website

This website is built and maintained by Leachie (Daniel Slater, Cape Town), on [PRACTICE NAME]'s instructions. Leachie can change the words and pictures on the site and can see standard technical information that any website host sees — such as the fact that a page was requested, and roughly where in the world from. Leachie has no access to your messages, your appointments or your records, because the site never holds them.

Your rights

You are entitled to ask what personal information is held about you, to have it corrected, and to ask for it to be deleted. Because this site holds nothing, such a request would be about [PRACTITIONER NAME]'s own records rather than the website: contact her at [PRACTITIONER EMAIL].

If you are not satisfied with how a request is handled, you may complain to the Information Regulator of South Africa.

IF AND ONLY IF analytics is switched on, add:
### Visitor numbers
We count visits so we know which pages are useful, using a service that does not use cookies and
does not collect anything that identifies you personally. We can see that a page was visited; we
cannot see who visited it.

Last updated [DATE].

Part B — for leachie.com

Privacy

Leachie is a one-person web-development business: Daniel Slater, trading as Leachie, Cape Town, South Africa. Contact danslater@leachie.com for anything on this page. Daniel Slater is the Information Officer.

What is collected, and why

If you enquire about work, whatever you send — your name, your email address or phone number, and what you tell us about your project. It is used to reply to you and to do the work if you become a client. Nothing else.

If you become a client, the details needed to invoice you and to run your site: your name, your business's name, your contact details, and the record of what was paid.

If you pay online, the payment is handled by Paystack, a South African payment provider. Your card details go to them and never to us — we see only that a payment succeeded, and for how much.

When you visit the site, standard technical records kept by the hosting provider (Cloudflare), such as the request itself and an approximate region. These are not used to identify you.

What is never done with it

Your information is not sold, rented or shared for anyone else's marketing. There is no mailing list you are added to without asking. Nothing you send in an enquiry is used as an example of our work — that only happens with a client's explicit permission, in writing, and only for what they have agreed to.

Who else sees it

Only the services needed to run the business, and only the part each one needs: Cloudflare (hosting), Resend (sending email), Supabase (the content-editing accounts on client sites), Paystack (payments), and Google (the email account itself). Each holds your information under its own terms, and we choose providers on the basis that they do.

How long it is kept

Enquiries that do not become work are kept for about a year and then deleted. Client and financial records are kept for as long as the law requires records to be kept, and no longer than necessary after that.

Keeping it safe, and telling you if something goes wrong

Access is limited to Daniel Slater, systems are kept up to date, and nothing sensitive is stored where it does not need to be. If information is ever exposed by a security failure, the people affected and the Information Regulator will be told as soon as reasonably possible, along with what happened and what to do about it.

Your rights

You may ask what is held about you, have it corrected, have it deleted, object to its use, and withdraw consent. Email danslater@leachie.com and it will be dealt with without charge. If you are unhappy with the outcome, you may complain to the Information Regulator of South Africa.

Last updated [DATE].

Part C — internal: Leachie as an operator

This part never goes on a website. It is the plain-language version of what
     the service agreement's POPIA clause has to commit to. 

When Leachie hosts or maintains a site for a client, the client decides what happens to any personal information on it and Leachie acts on the client's instructions. That makes the client the responsible party and Leachie the operator.

Note where the legal duty actually sits: POPIA s21(1) obliges the client to have a written contract with us covering the s19 security measures — not the other way round. s20, which is our own duty as operator, has no writing requirement at all. So an operator agreement is something we provide so the client can comply, which is both accurate and a better thing to say than "the law makes me do this". In scope: the Supabase-backed editor sites and the Paystack site. A genuinely static site whose only contact route is a mailto: or WhatsApp link involves no processing by us at all — the message goes browser-to-inbox.

Leachie undertakes to:

1. Process only on the client's instruction — not to use anything on their site or in their database for any purpose of its own, including marketing or training.
2. Keep it secure, with access limited to Daniel Slater and to the service providers named above, each for the part it needs.
3. Tell the client immediately if there is reason to believe information has been accessed or acquired by an unauthorised person (POPIA s21(2)) — with enough detail for the client to meet their own notification duty. They must then tell the Regulator and the affected people "as soon as reasonably possible" (s22), and they cannot do that if we have not told them. There is no 72-hour rule in POPIA — that is GDPR. Do not put one in writing anywhere.
4. Not send it out of the country beyond the named providers without telling the client. POPIA s72 restricts cross-border transfer, and Cloudflare and Supabase are both offshore, so the transfer is recorded here and in the client's own privacy notice deliberately.
5. Hand it back or delete it when the engagement ends, at the client's choice.
6. Keep it confidential, indefinitely, including after the engagement ends.

Design rule that makes most of this easy: client enquiries go straight to the client and never through Leachie's systems. A form that emails a copy anywhere else converts a clean operator position into a real one — for a healthcare practitioner's site, that decision is not a convenience choice, it is the whole risk position.