Privacy notice (POPIA)
How I handle your information.
Erzo is a small, founder-led studio. I collect as little as I can, I only use it to answer you and improve this site, and I never sell it or use it for advertising.
Who is responsible
This website is run by Erzo Web Development (Pty) Ltd (“Erzo”), founded in Johannesburg in 2010. Under the Protection of Personal Information Act (POPIA), Erzo is the “responsible party” for the information you share through this website.
The Information Officer is Henry Shepherdson. You can reach him at henry@erzo.co.za about anything on this page.
What the contact form collects
Only what you type into it:
- Your name (up to 100 characters), so I know who I’m talking to.
- Your email address, so I can reply. It is set as the reply-to address on the email the form sends me.
- What it’s about: one of “Ideas session”, “Fractional CTO” or “Something else”.
- Your message (up to 5,000 characters).
The form doesn’t ask for a phone number, company, address or anything else. Please don’t include sensitive details such as health or financial information in your message.
There is also a hidden field that people never see. It catches automated spam, and anything typed into it is thrown away.
Collected automatically
- Bot check (Cloudflare Turnstile). To stop spam, the contact page runs Cloudflare Turnstile. It looks at technical signals from your browser and device, such as your IP address and browser characteristics, to tell people from bots. Most visitors never see a puzzle. It isn’t used for advertising or to track you across sites. See Cloudflare’s Turnstile privacy addendum.
- Rate limiting. To stop the form being abused, the server counts submissions per IP address for 10 minutes. It stores a one-way hash of the IP address, never the address itself, and the count expires on its own.
- Hosting logs. Like any website, the servers that deliver these pages (Cloudflare) process your IP address and basic request information to deliver and secure the site.
- Google Analytics, only if you accept it. See below.
Analytics and cookies
I use Google Analytics 4 to understand which pages are useful and how people find the site, so I can improve it. It is off until you choose “Accept” on the analytics card at the bottom of the screen. If you decline, or don’t choose, Google Analytics isn’t loaded at all and sets no cookies.
If you accept, Google Analytics collects:
- the pages you view, how you got here (for example a search engine or a link), and when;
- interactions such as scrolling, clicks on links to other sites and file downloads;
- your device type, browser, operating system, screen size and language;
- your approximate location (country and city), worked out from your IP address. Google Analytics 4 doesn’t store IP addresses;
- a random identifier stored in cookies, so repeat visits can be counted.
It sets these first-party cookies on erzo.co.za:
| Cookie | Purpose | Expires |
|---|---|---|
_ga | Distinguishes visitors with a random ID | 2 years |
_ga_<ID> | Keeps track of the current visit (session) | 2 years |
Google signals and ad personalisation are switched off, and the analytics consent signals for advertising (Google Consent Mode) are always set to “denied”. This data isn’t used for advertising, and I don’t combine it with what you send through the contact form. Google keeps the analytics data for no longer than the retention period set for the site, which is 14 months at most.
Your choice is saved in your browser’s local storage (erzo-analytics-consent), so the banner doesn’t ask again. That entry stays on your device and isn’t sent to anyone.
Changing your mind: choose Cookie settings at the bottom of any page and select “Decline”. Analytics stops and the _ga cookies are deleted. You can also clear cookies in your browser, or use Google’s opt-out browser add-on.
Google Search Console gives me summary reports about how the site appears in Google Search (for example search terms, clicks and impressions). It adds no code or cookies to this site, and it doesn’t give me information about individual visitors.
Why, and on what basis
I use what you send through the form only to read and reply to your enquiry, and to keep a record of our conversation if we go on to work together. The lawful basis is your consent when you choose to send the message, and taking steps you’ve asked for before a possible contract (POPIA section 11). Analytics runs only with your consent, which you can withdraw at any time. I don’t use your information for marketing, and I don’t sell or share it, other than with the service providers below who help run the site.
Where it’s processed
| Who | What they do | Where |
|---|---|---|
| Cloudflare, Inc. | Hosts the website and runs the form’s server code (Cloudflare Pages), the Turnstile bot check and the rate limit. | Cloudflare’s global network, including outside South Africa. Cloudflare is based in the United States. |
| Resend (Plus Five Five, Inc.) | Delivers the form’s email to my inbox, sent from updates.erzo.co.za. It keeps sending logs for a limited time. | European Union (Ireland, eu-west-1). Resend is based in the United States. |
| Domains.co.za | Hosts the Erzo mailbox (assistant@erzo.co.za) where your message arrives and is answered. | South Africa (Johannesburg). Domains.co.za, a South African provider, hosts its servers in the Teraco data centre in Johannesburg. |
| Google LLC | Google Analytics (only if you accept) and Google Search Console. | Google’s data centres, including in the United States. |
Cross-border transfers. Cloudflare, Resend and Google process information outside South Africa. Under POPIA section 72, I only use providers that are bound by data-protection terms, laws or binding rules that give protection substantially similar to POPIA, or where you have consented to the transfer.
How long I keep it
- Your message and email address: in the Erzo mailbox for up to 24 months after our last contact, unless we start working together, when it becomes part of the client record.
- Resend’s sending logs: about 30 days.
- Rate-limit counters: 10 minutes.
- Google Analytics: up to 14 months; cookies expire after 2 years or when you withdraw consent.
- Turnstile and hosting logs: as set out in Cloudflare’s policies.
Your rights
You can ask me at any time:
- whether I hold information about you, and for a copy of it;
- to correct it, or to delete it;
- to stop using it, or object to how it’s used.
Email henry@erzo.co.za and I’ll respond within 30 days. I may ask you to confirm it’s you first, so I don’t give your information to someone else.
If you’re unhappy with how I’ve handled your information, you can complain to the Information Regulator: inforegulator.org.za, POPIAComplaints@inforegulator.org.za, 010 023 5200.
Security
The site is served only over HTTPS. Form submissions are checked on the server, the email-service key is stored as an encrypted Cloudflare secret (never in the website’s code), and access to the mailbox is limited to Erzo.
Changes
I’ll update this page if anything changes. Last updated: 3 October 2026.
See also the accessibility statement.