1. Who is responsible for your information
Neighbourdo is responsible for personal information it processes for its own business purposes. References to “we”, “us” and “our” mean Neighbourdo. For privacy questions, requests or complaints, contact our Information Officer at [email protected].
We aim to process personal information in line with the Protection of Personal Information Act 4 of 2013 (POPIA), where applicable, and other privacy laws that apply to the specific work or relationship.
2. Information we collect
Depending on how you interact with us, this can include:
- identity and contact details, such as your name, work email address, phone number, role and organisation;
- project, product and commercial information you choose to share in an enquiry, proposal, briefing session or support request;
- communications, meeting notes and records needed to respond to you or deliver agreed work;
- technical information generated when you use this website, such as device, browser, IP address, pages requested, time zone and diagnostic data; and
- payment, billing or supplier-contact information where it is needed to administer a commercial relationship.
Please do not send passwords, access tokens, payment-card data, special personal information or production credentials by ordinary email unless we have agreed a secure transfer method.
3. Why we use it and our lawful basis
We use personal information only for legitimate, defined purposes, including to:
- respond to enquiries and assess whether we can help;
- prepare proposals, statements of work, estimates, invoices and project records;
- perform, support and improve services that you or your organisation have asked us to provide;
- protect our website, systems, clients, people and intellectual property from misuse, fraud and security threats;
- meet legal, accounting, tax, record-keeping and dispute-resolution duties; and
- send relevant business communications where permitted by law, with a clear opt-out where required.
Our grounds may include your consent, taking steps at your request before a contract, performing a contract, complying with a legal obligation, or our legitimate interests in running a secure, accountable professional-services business. We do not sell personal information.
4. Sensitive information and credentials
We do not ask for special personal information, production credentials or payment-card information unless it is genuinely necessary for agreed work and an appropriate secure method has been identified. If information relating to health, biometric data, children or criminal history is needed for a client product, the client and Neighbourdo will agree the applicable roles, controls, access boundaries and instructions before that processing begins.
Access credentials are treated as confidential operational information. We use named, least-privilege access where practical, keep access only for the necessary period and ask for access to be changed or removed when the agreed work ends.
5. Business communications
We may send a reply to an enquiry, a project update, an invoice, a security notice or another communication needed for an existing relationship. We may also send relevant business information where permitted by law. You can opt out of non-essential marketing communications at any time by using the unsubscribe option provided or by contacting us. An opt-out does not prevent service, billing, security or legal notices that are needed for an active relationship.
6. Client systems and service delivery
When we build, host, maintain, assess or support a client product, we may process personal information on that client’s documented instructions. In that situation, the client normally remains responsible for the information in its product and Neighbourdo acts as an operator or service provider. The applicable proposal, data-processing terms and security scope govern that work and take priority over this general policy.
We do not use client production data to train public models or develop unrelated products unless the client has expressly agreed in writing.
7. Sharing and international transfers
We share information only where necessary, including with professional advisers, payment and accounting providers, hosting and cloud providers, communications tools, security providers, subcontractors approved for the work, and authorities where the law requires it. Each recipient must be appropriate for the purpose and subject to suitable confidentiality, security or contractual safeguards.
Some providers may process information outside South Africa. Where that happens, we use an appropriate transfer mechanism and seek a level of protection that is materially consistent with applicable privacy requirements.
8. Cookies, analytics and similar technology
The website may use essential technical storage to operate safely and remember basic preferences. If we introduce non-essential analytics, advertising, session replay or similar technology, we will update this policy and provide the notices or choices required by applicable law before using it.
9. Retention and security
We keep information only for as long as reasonably necessary for the purpose it was collected, to meet legal or contractual requirements, or to establish, exercise or defend legal claims. We use proportionate administrative, technical and organisational safeguards, including access controls, least-privilege practices and secure development methods where appropriate. No system can guarantee absolute security.
In practical terms, enquiry records are retained for as long as the discussion remains relevant, client delivery records follow the agreed project and legal-retention needs, and accounting records are kept for the period required by applicable law. We securely delete, anonymise or restrict information when it is no longer required.
10. Security incidents
If we identify a suspected compromise involving personal information for which we are responsible, we investigate, contain and document it using proportionate incident procedures. Where notification is required, we will notify the relevant client, authority or affected person in the manner and timeframe required by applicable law.
11. Your rights and complaints
Subject to applicable law, you may ask to access, correct, delete or object to certain processing of your personal information, withdraw consent where consent is the basis, and ask about automated decisions. We may need to verify your identity and may keep limited information where the law permits or requires it.
Contact us first at [email protected]. You may also lodge a complaint with the South African Information Regulator if you are dissatisfied with our response.
12. Changes to this policy
We may update this policy when our services, technology or legal obligations change. The current version and its “Last updated” date will appear on this page. Material changes will receive an appropriate additional notice where required.