Website Privacy Policy

Scope of This Policy

This policy explains how Damascus27 (Pty) Ltd ("we", "us", "our") processes personal information of visitors to the Damascus²⁷ marketing website at damascus27.co.za (the "Website") and of prospective clients who contact us through it.

We are the responsible party under the South African Protection of Personal Information Act 4 of 2013 (POPIA) and, where it applies to you, the controller under the EU General Data Protection Regulation (EU) 2016/679 and the UK GDPR (together, the "GDPR"). In this policy, "personal information" includes "personal data" as defined in the GDPR.

Information We Collect

Contact and Demo Requests

When you submit our contact form, we collect:

• Required: company name, surname and email address
• Optional: first name, designation, secondary email address, phone number, company website and a description of your enquiry
• A record of your consent to the processing described in this policy

Request and Security Data

• IP address and request details: when you submit the form, your IP address and basic request information are processed to apply rate limiting and prevent abuse.
• Bot protection data: the form uses a bot-protection service, which may process limited technical information such as browser and device characteristics and interaction signals to verify that the submission comes from a person.
• Standard server logs: like most websites, our hosting infrastructure may record technical request information (such as IP address, browser type and pages requested) for security and operational purposes.

We do not use analytics, advertising or tracking technologies on this website, and we do not carry out profiling or automated decision-making that produces legal or similarly significant effects for you.

How We Use Your Information

• To respond to your enquiry and arrange product demonstrations
• To prepare information or quotations you request
• To manage our relationship with you as a prospective client, including reasonable follow-up on your enquiry
• To protect the Website and our enquiry process from spam, bots and abuse
• To comply with legal obligations

We do not sell your personal information.

Direct Marketing

In line with section 69 of POPIA and applicable electronic marketing laws, we will only send you electronic direct marketing if you have given your consent, or if you are an existing customer and the marketing relates to similar products or services. Replying to your enquiry is not direct marketing. Every marketing message will include a way to opt out. You have an absolute right to object to direct marketing at any time (including under Article 21(2) of the GDPR) by emailing office@damascus27.co.za.

Lawful Grounds for Processing

• Consent (POPIA s11(1)(a); GDPR Art. 6(1)(a)): enquiry details are processed on the basis of the consent you give on the contact form. You may withdraw consent at any time, which does not affect processing already carried out.
• Steps towards a contract (POPIA s11(1)(b); GDPR Art. 6(1)(b)): where you request a demonstration or quotation, processing is necessary to take steps at your request before entering into a contract.
• Legitimate interests (POPIA s11(1)(f); GDPR Art. 6(1)(f)): security processing such as rate limiting and bot verification is carried out in our legitimate interest in protecting the Website and our systems. We have balanced this interest against your rights and limit the data used to what is necessary.
• Legal obligation (POPIA s11(1)(c); GDPR Art. 6(1)(c)): where we must retain or disclose information to comply with the law.

Providing the required form fields is necessary for us to respond to your enquiry. If you do not provide them, we will not be able to reply.

Who We Share Information With

We share personal information only with the following categories of service providers, who act as operators (POPIA) or processors (GDPR) on our behalf under written terms requiring them to keep it secure and confidential and to use it only on our instructions:

• Customer relationship management (CRM) provider: stores and manages the enquiry details you submit.
• Bot-protection and security provider: verifies that contact form submissions come from a person.
• Website hosting and infrastructure providers: deliver the Website and process technical request data.

You may ask us for the identity of the specific recipients of your personal information using the contact details below. We may also disclose information where required by law or to protect our legal rights.

International Transfers

Our service providers may process personal information outside South Africa and, for visitors in the EU/EEA or UK, outside those regions. Where this happens, we rely on the grounds permitted by section 72 of POPIA and Chapter V of the GDPR, such as adequacy decisions, standard contractual clauses or other binding commitments that provide an adequate level of protection, or your consent where appropriate. You may contact us for more information about these safeguards.

Retention

• Enquiry records in our CRM: retained for up to 24 months from our last contact with you, unless you request earlier deletion or you become a client, in which case your information is handled under the client agreement.
• Security and request data: retained only for as long as needed for security and abuse prevention.

Security

We take reasonable technical and organisational measures to protect personal information submitted through the Website against loss, misuse and unauthorised access, including encrypted transmission, input validation, rate limiting and bot protection. No method of transmission over the internet is completely secure. If a security compromise affects your personal information, we will notify the Information Regulator and you as required by section 22 of POPIA and, where the GDPR applies, the competent supervisory authority and affected individuals as required by Articles 33 and 34 of the GDPR.

Your Rights

Subject to POPIA and, where applicable, the GDPR, you have the right to:

• Ask whether we hold personal information about you and request access to it
• Request correction of inaccurate or incomplete information
• Request deletion of your personal information
• Request that we restrict processing in certain circumstances
• Receive information you provided in a structured, commonly used format and have it transferred to another party (data portability)
• Object to processing based on legitimate interests, and object at any time to direct marketing
• Withdraw your consent at any time

To exercise these rights, contact our Information Officer using the details below. We will respond within the period required by applicable law (under the GDPR, generally one month) and may need to verify your identity before acting on a request.

Complaints

We would appreciate the chance to address your concern first, but you may lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za or, if you are in the EU/EEA or UK, with the data protection supervisory authority in the country where you live or work or where the alleged infringement took place.

Cookies and Browser Storage

The Website stores only your consent preference in your browser, and our bot-protection service may use strictly necessary storage on the contact form. For details, see our Cookie Policy.

Changes to This Policy

We may update this policy from time to time. Changes take effect when published on this page, and the "Last updated" date above will be revised.

Information Officer and Contact