Privacy Policy

Last updated: May 2026

1. Who I Am

I operate this site (leroy.africa) from South Africa. I am the responsible party for any personal information you submit through this site. I protect your privacy in line with South Africa's Protection of Personal Information Act (POPIA), the EU General Data Protection Regulation (GDPR), and the UK Data Protection Act 2018.

This policy explains what information I collect, how I use it, the legal basis for processing, how I protect it, and your rights under applicable law.

2. What I Collect

I collect the minimum amount of personal information necessary. I do not use analytics, tracking pixels, advertising cookies, or third-party data brokers.

2.1 Information You Give Me

When you submit the contact form, I collect:

  • First name and last name
  • Email address
  • Phone number (optional)
  • Your message
  • When you sent it

2.2 Technical Information (Not Stored)

The server may record standard access logs. I do not link these to your identity. Additionally:

  • A single functional cookie (lang) remembers your language preference. Not used for tracking.
  • An anonymised IP hash (SHA-256) is used for rate limiting and abuse prevention. The hash cannot be reversed.
  • No Google Analytics, Facebook Pixel, social trackers, fingerprinting, or advertising cookies.

3. Legal Basis

I process your information only on these grounds:

  • Consent: By submitting the contact form, you consent to me processing your information to respond to your enquiry.
  • Legitimate interest: I use anonymised IP hashes for rate limiting and spam prevention. This is a legitimate security interest that does not override your rights.

4. How I Use Your Information

I use contact form submissions only to:

  • Respond to your message
  • Prevent spam and abuse
  • Keep a record of our conversation

I do not use your information for marketing, profiling, or automated decision-making. I do not sell, rent, or share your personal information with anyone.

5. International Data Transfers

Your data is stored on servers in South Africa. If you are visiting from outside South Africa, your information may be transferred to and processed here, where data protection laws may differ from your country. I ensure that:

  • POPIA provides adequate protection for personal information
  • GDPR Standard Contractual Clauses apply where relevant for EU/EEA visitors
  • I implement appropriate technical and organisational measures to protect your data regardless of where it is processed

6. Data Retention

Contact form submissions are kept indefinitely unless you ask me to delete them. If you want your data removed, email me using the address below.

7. Security

I take the security of your personal information seriously:

  • The database sits outside the web root and cannot be accessed via the internet
  • All database writes use parameterised queries to prevent SQL injection
  • Forms are protected against CSRF, spam bots (honeypot + timing checks), and brute force (rate limiting)
  • Your IP address is stored only as an irreversible SHA-256 hash

8. Your Rights

Depending on where you live, you have the following rights:

8.1 Rights Summary

You have the right to:

  • Access: request a copy of the information I hold about you
  • Correction: ask me to fix inaccurate information
  • Deletion: ask me to delete your information
  • Objection: object to processing or withdraw consent at any time

9. Contact

If you have questions about this policy, want to exercise your rights, or want to file a complaint:

Email: [email protected]