Privacy notice

1. Who we are

Cross Code ("we", "us") is the trading name of Joshua Oosthuizen, who runs it as a sole proprietorship. For POPIA, we are the responsible party for the personal information described in this notice.

Business name	Cross Code
Business structure	Sole proprietorship (not a registered company)
Owner	Joshua Oosthuizen
Information Officer	Joshua Oosthuizen
Physical address	44 Gordon Road, Henley on Klip, Gauteng, South Africa
Email	admin@crosscode.co.za
WhatsApp	+27 68 903 8075

2. What this notice covers

This notice covers personal information we receive when you:

• visit this website (crosscode.co.za);
• send us an enquiry with the contact form; or
• contact us by email or WhatsApp.

It doesn't cover the Cross Events sites that churches use. Each church is responsible for the personal information on its own Cross Events site, and its own privacy notice explains how it's used.

3. What we collect

When you send the contact form

• Your name and email address (required, so we can reply).
• Your phone or WhatsApp number and the name of your organisation, if you give them.
• The topic you choose and your message, including anything you choose to tell us in it.

Please don't include sensitive information (such as health or financial details) in your message. We don't need it to answer an enquiry.

When you email or WhatsApp us

Your email address or phone number, your name as it appears on that account, and whatever you send us.

When you visit the website

Like most websites, our web server automatically records each request in its access log: your IP address, the date and time, the page requested, the referring page and your browser's description of itself (user agent). The contact form also briefly keeps your IP address in memory to limit how many messages can be sent from one address (see section 7).

No cookies, analytics or tracking. This website sets no cookies and uses no analytics, advertising or tracking tools. Its fonts and images are served from our own server, so visiting it doesn't send your information to third parties. A WhatsApp button only contacts WhatsApp when you click it.

4. Why we use it

Purpose	Information	Lawful basis (POPIA section 11)
Replying to your enquiry and discussing what you need	Contact form, email and WhatsApp details and messages	Needed to take the steps you asked for before any agreement (s11(1)(b)), and our legitimate interest in answering enquiries (s11(1)(f))
Keeping the website secure and working, and preventing spam and abuse	Server access logs; IP address for the form's sending limit	Our legitimate interest in protecting the website and our inbox (s11(1)(f))
Meeting legal obligations	Any of the above, only where the law requires it	Compliance with an obligation imposed by law (s11(1)(c))

We use your information only for these purposes. We don't sell it, we don't use it for marketing without your consent, and we don't add you to a mailing list because you contacted us.

5. How it's stored and protected

• The website is served over an encrypted connection (HTTPS), so what you type into the contact form is encrypted on its way to our server.
• The website doesn't keep a copy of your enquiry: there's no database. The form passes your message straight to our email inbox (admin@crosscode.co.za) and keeps nothing else.
• Enquiries are kept in that mailbox, and WhatsApp messages in our WhatsApp account. Both are protected by passwords, and only the owner of the business can access them.
• Server access logs are kept on our own server, which only we can access.

We take appropriate, reasonable technical and organisational measures to protect your information, as POPIA requires (section 19). If we become aware of a security compromise affecting your personal information, we'll notify you and the Information Regulator as POPIA requires (section 22).

6. Who has access to it

Only the owner of Cross Code, Joshua Oosthuizen, has access to your enquiries and messages. We don't share them with anyone else, except:

• Service providers that carry the messages: the email service that delivers and stores our email, and WhatsApp (Meta) when you message us there. They handle the information to provide their service. WhatsApp is run from outside South Africa, so a WhatsApp conversation involves information crossing the border (POPIA section 72) under WhatsApp's own terms and privacy policy.
• When the law requires it: for example, a court order or a lawful request from an authority.

7. How long we keep it

Information	How long
Contact form enquiries, and emails and WhatsApp messages about an enquiry	12 months, then deleted, unless there's a legitimate reason or a legal requirement to keep them longer (for example, an unresolved matter)
Correspondence that leads to work together	Becomes part of the client's records, and is kept for as long as needed for the work and as the law requires (for example, tax records)
Web server access logs	About 14 days, then deleted automatically
IP addresses for the contact form's sending limit	In memory for up to an hour, never written to disk

8. Your rights

Under POPIA you have the right to:

• access: ask whether we hold personal information about you, and for a copy of it (section 23);
• correction: ask us to correct or update information that is inaccurate, out of date or incomplete (section 24);
• deletion: ask us to delete information we're no longer allowed to keep (section 24);
• objection: object to our use of your information based on our legitimate interests (section 11(3)); and
• complain to the Information Regulator (see section 10).

To use any of these rights, email admin@crosscode.co.za with "Privacy request" in the subject, and say what you'd like us to do. We may need to confirm your identity before acting on a request, so that we don't give your information to someone else. We'll reply as soon as reasonably possible, and aim to do so within 30 days. There's no charge to ask whether we hold information about you or to have it corrected or deleted.

9. Contacting our Information Officer

Our Information Officer is Joshua Oosthuizen. For any question or concern about your personal information or this notice:

• Email: admin@crosscode.co.za (subject: "Privacy request")
• WhatsApp: +27 68 903 8075
• Post or delivery: 44 Gordon Road, Henley on Klip, Gauteng, South Africa

10. Complaints to the Information Regulator

We'd like the chance to sort out any concern first, but you have the right to lodge a complaint with the Information Regulator (South Africa) at any time:

• Website: inforeg.org.za
• Complaints email: POPIAComplaints@inforeg.org.za

11. Children, links and changes

Children. This website is meant for organisations and businesses, not children. We don't knowingly collect information from children; if a child has sent us information, ask us to delete it.

Other websites. Links to other websites (such as WhatsApp or the Information Regulator) are governed by those websites' own privacy policies.

Changes. We may update this notice when our practices or the law change. The effective date at the top shows when it last changed.