Privacy Policy

Last updated: 09 Feburary 2026

1. Introduction

Darkblue Web & IT Solutions (“we,” “us,” or “our”) is committed to protecting your personal information in accordance with the Protection of Personal Information Act (POPIA), No. 4 of 2013.

This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use our services or interact with our website.

Our Information Officer:

2. Definitions

  1. “Seller” refers to DARKBLUE WEB & IT SOLUTIONS.
  2. “Data Subject” refers to the individual or entity to whom the personal information relates.
  3. “POPIA” refers to the Protection of Personal Information Act (No. 4 of 2013).
  4. “Personal Information” means information relating to an identifiable, living, natural person, and where applicable, an identifiable, existing juristic person.
  5. “Processing” means any operation or activity concerning personal information, including collection, storage, use, sharing, or deletion.
  6. “SARS” refers to the South African Revenue Service.
  7. “Operator” refers to a person or entity who processes personal information on our behalf (e.g., xneelo, cloud.co.za, couriers, payment gateways).
  8. “MSP Services” refers to our Managed Service Provider offerings, including invoicing systems, password management, and identity provider services.

3. Information We Collect

We collect personal information that is necessary to fulfill our contract with you, provide services, and meet legal obligations. This includes:

3.1 Information You Provide Directly

  • Identification Data: Full names, company/business registration numbers, and identity numbers (where required for legal compliance).
  • Contact Data: Email addresses, phone numbers, physical addresses, and delivery addresses.
  • Financial Data: Payment information, banking details for refunds, tax/VAT numbers (for SARS-compliant invoicing).
  • Account Data: Usernames, passwords (encrypted), and security credentials for MSP Services.
  • Service-Specific Data:
    • Invoice and financial records (Invoice Ninja)
    • Encrypted passwords and credentials (Passbolt/Bitwarden)
    • User authentication data (Authentik)
    • Domain registration details (WHOIS information)

3.2 Information Collected Automatically

  • Technical Data: IP addresses, browser type and version, device information, operating system.
  • Usage Data: Website interaction data, pages visited, time spent on pages, referral sources.
  • Cookies and Tracking Technologies: See our separate Cookie Policy for full details.

3.3 Information from Third Parties

  • Payment confirmation data from payment gateways
  • Delivery confirmation from courier services
  • Domain registration verification from registrars

4. Lawful Basis for Processing

We process your personal information on the following lawful bases as required by POPIA:

  1. Consent: You have given explicit consent for processing your personal information for specific purposes (e.g., marketing communications, cookie consent via CookieYes).
  2. Contractual Necessity: Processing is necessary to fulfill our contract with you (e.g., processing orders, providing hosting services, delivering MSP services).
  3. Legal Obligation: Processing is required to comply with South African law (e.g., SARS tax requirements, Companies Act record-keeping, consumer protection laws).
  4. Legitimate Interests: Processing is necessary for our legitimate business interests (e.g., fraud prevention, service improvement, technical support) provided your rights are not overridden.

We obtain your consent through the following mechanisms:

  • Website: Cookie consent is obtained through CookieYes banner on your first visit.
  • Account Creation: Consent is obtained during registration for MSP Services or hosting accounts.
  • Order Process: By completing a purchase, you consent to necessary data processing for order fulfillment.
  • Marketing: Explicit opt-in checkboxes for marketing communications (never pre-checked).
  • Service Agreements: Acceptance of Terms & Conditions constitutes consent for contractual processing.

You have the right to withdraw consent at any time by contacting aidan@darkblue.co.za.

6. Purpose of Processing

Personal information is processed only for the following specific purposes:

6.1 Service Delivery

  • Processing sales and orders for hardware and goods
  • Delivering physical products
  • Managing web hosting, domain registrations, and email services (via xneelo)
  • Providing MSP Services (Invoice Ninja, Passbolt/Bitwarden, Authentik) via cloud.co.za infrastructure
  • Account management and user authentication

6.2 Customer Support

  • Providing technical support and troubleshooting
  • Processing warranty claims and returns
  • Handling service-related inquiries
  • Resolving complaints

6.3 Legal & Regulatory Compliance

  • Meeting tax and accounting requirements (SARS)
  • Complying with Companies Act record-keeping obligations
  • Responding to lawful requests from authorities
  • Complying with Consumer Protection Act requirements

6.4 Communication

  • Sending essential service notifications (e.g., order confirmations, shipping updates)
  • Sending renewal reminders for domains and hosting services
  • Responding to your inquiries
  • Sending marketing communications (only with your consent)

6.5 Business Operations

  • Fraud prevention and security monitoring
  • Website analytics and performance improvement
  • Payment processing and financial reconciliation
  • Maintaining backup and disaster recovery systems

7. Sharing of Personal Information

We do not sell, rent, or trade your personal information to third parties. We only share data with trusted Operators and service providers as necessary to deliver our services:

7.1 Service Providers (Operators)

  • xneelo: Web hosting, domain registration, and email services infrastructure provider
  • cloud.co.za: Cloud infrastructure provider for MSP Services
  • Payment Gateways: Secure third-party payment processors (e.g., PayFast, Peach Payments, Paystack)
  • Courier Services: Delivery and logistics partners (e.g., The Courier Guy, Aramex, Pargo)

7.2 Professional Advisors

  • Legal advisors, accountants, and auditors (under confidentiality obligations)
  • Law enforcement, regulatory bodies, or courts where required by law or court order
  • SARS for tax compliance purposes

7.4 Business Transfers

  • In the event of a merger, acquisition, or sale of business assets, your information may be transferred to the new owner (you will be notified)

All Operators are contractually obligated to protect your personal information and process it only for specified purposes.

8. Cross-Border Data Transfers

8.1 Data Location

  • Primary Storage: Your data is primarily stored on servers located in South Africa through xneelo and cloud.co.za.
  • Backup Systems: Backups may be stored on servers within South Africa or in jurisdictions with adequate data protection laws.

8.2 International Transfers

Some service providers may process data outside South Africa. Where this occurs:

  • We ensure the recipient country has adequate data protection laws, or
  • We implement appropriate safeguards (such as standard contractual clauses), and
  • We obtain your consent where required by POPIA

If you require specific information about where your data is processed, please contact aidan@darkblue.co.za.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, loss, destruction, or alteration:

9.1 Technical Measures

  • Encryption: SSL/TLS encryption for data transmission
  • Password Security: Encrypted password storage; end-to-end encryption for password management services
  • Firewall Protection: Network security measures implemented by hosting providers
  • Access Controls: Role-based access restrictions to personal data
  • Regular Updates: Security patches and software updates

9.2 Organizational Measures

  • Staff Training: Employees are trained on data protection and confidentiality
  • Access Limitation: Personal data is accessible only to authorized personnel who need it for their duties
  • Confidentiality Agreements: All staff and contractors sign confidentiality agreements
  • Third-Party Audits: Regular security assessments of infrastructure providers

9.3 Infrastructure Provider Security

9.4 Your Responsibilities

  • Keep your login credentials confidential
  • Use strong, unique passwords
  • Enable two-factor authentication where available
  • Notify us immediately of any suspected unauthorized access

Note: While we implement robust security measures, no system is 100% secure. We cannot guarantee absolute security of data transmitted over the internet.

10. Data Breach Notification

In accordance with POPIA Section 22, we have implemented procedures to detect, respond to, and notify you of data breaches:

10.1 Our Obligations

If we become aware of a security compromise that results in unauthorized access to your personal information, we will:

  1. Investigate: Immediately investigate the nature and extent of the breach
  2. Contain: Take steps to contain and remedy the breach
  3. Notify the Information Regulator: Report the breach to the Information Regulator as soon as reasonably possible
  4. Notify You: Inform affected Data Subjects as soon as reasonably possible if the breach poses a risk of harm

10.2 What We Will Tell You

Breach notifications will include:

  • A description of the potential consequences of the security compromise
  • A description of measures to be taken to address the compromise
  • A recommendation with regard to measures to be taken by you to mitigate the potential adverse effects

10.3 How We Will Notify You

  • Email to your registered email address
  • Notice on our website (for widespread breaches)
  • Direct phone call (for high-risk breaches)

11. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this policy and to meet legal requirements:

11.1 Retention Periods

Data TypeRetention PeriodLegal Basis
Transaction records, invoices, receipts7 years from date of transactionCompanies Act (7 years), SARS/Tax Administration Act (5 years)
Annual financial statements15 years from end of financial yearCompanies Act
Accounting and financial records (general)7 years from end of financial yearCompanies Act, Income Tax Act
Tax returns and supporting documents5 years from date of submissionTax Administration Act
Active hosting/service accountsDuration of service + 12 monthsContractual necessity
Cancelled service accounts90 days after cancellation (for data export)Contractual necessity
Marketing consent recordsUntil consent is withdrawn + 12 monthsPOPIA compliance
MSP Service dataDuration of service + 30 daysContractual necessity
Support tickets and correspondence2 years from resolutionBusiness operations
Website analytics (anonymized)26 monthsLegitimate interest
CCTV footage (if applicable)30 daysSecurity purposes

11.2 Deletion and De-identification

After the retention period expires:

  • Personal data is securely deleted or permanently anonymized
  • You may request earlier deletion subject to legal retention requirements
  • Backups are cycled and overwritten according to our backup retention schedule (typically 30-90 days)

11.3 Active Service Accounts

Data associated with active services (hosting, domains, MSP services) is retained for the duration of the service relationship and may be retained for up to 12 months after service termination for:

  • Resolving disputes
  • Facilitating service reactivation
  • Meeting regulatory requirements

12. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your website experience, analyze usage, and deliver relevant content.

Full details are available in our separate Cookie Policy.

We use CookieYes to manage cookie consent. When you first visit our website, you will be presented with a cookie consent banner allowing you to:

  • Accept all cookies
  • Reject non-essential cookies
  • Customize your cookie preferences

12.2 Managing Cookies

You can change your cookie preferences at any time by:

  • Clicking the “Consent Preferences” button on our website
  • Adjusting your browser settings to block cookies
  • Clearing existing cookies from your device

Please refer to our Cookie Policy for comprehensive information about the types of cookies we use and how to manage them.

13. Your Rights as a Data Subject

Under POPIA, you have the following rights regarding your personal information:

13.1 Right to Access (Section 23)

You have the right to:

  • Request confirmation of whether we hold personal information about you
  • Request a copy of your personal information
  • Request information about how your data is processed

How to exercise: Email aidan@darkblue.co.za with “Data Access Request” in the subject line.

Response time: We will respond within 30 days (may be extended by 30 days if the request is complex).

Fee: We may charge a reasonable fee to cover administrative costs.

13.2 Right to Correction (Section 24)

You have the right to:

  • Request correction of inaccurate or outdated information
  • Request completion of incomplete information

How to exercise: Email aidan@darkblue.co.za with the specific corrections needed.

13.3 Right to Deletion (Section 22)

You have the right to request deletion of your personal information where:

  • It is no longer necessary for the purpose it was collected
  • You withdraw consent (and we have no other lawful basis)
  • You object to processing and we have no overriding legitimate grounds
  • The data was unlawfully processed
  • Legal obligation requires deletion

Limitations: We may refuse deletion where retention is required by law (e.g., SARS 5-year requirement) or for legal claims.

13.4 Right to Object (Section 11(3))

You have the right to object to processing of your personal information:

  • For direct marketing purposes (we will stop immediately)
  • Based on legitimate interests (we will stop unless we have compelling legitimate grounds)

13.5 Right to Restrict Processing

You may request restriction of processing while we:

  • Verify the accuracy of disputed data
  • Determine whether our legitimate interests override your objection

13.6 Right to Data Portability

You have the right to:

  • Receive your personal information in a structured, commonly used format
  • Request transfer of your data to another service provider (where technically feasible)

Applies to: Data processed based on consent or contract and processed by automated means.

13.7 Right to Lodge a Complaint

If you believe your privacy rights have been violated, you have the right to lodge a complaint with:

Information Regulator of South Africa

Where processing is based on consent, you have the right to withdraw consent at any time. This will not affect the lawfulness of processing before withdrawal.

14. Exercising Your Rights

To exercise any of your rights:

  1. Contact our Information Officer:
    • Email: aidan@darkblue.co.za
    • Subject Line: Clearly state the right you wish to exercise (e.g., “Data Access Request,” “Right to Deletion”)
  2. Provide Verification:
    • We may request proof of identity to prevent unauthorized disclosure
    • Acceptable ID: Copy of ID document, passport, or company registration
  3. Response Timeline:
    • We will acknowledge your request within 7 days
    • We will respond substantively within 30 days
    • Complex requests may require an additional 30 days (we will notify you)
  4. Fees:
    • Most requests are processed free of charge
    • We may charge a reasonable fee for repetitive or excessive requests
    • You will be notified of any fees before processing

15. Children’s Privacy

Our services are not directed at children under the age of 18. We do not knowingly collect personal information from children without parental consent.

If you are under 18:

  • You must obtain parental/guardian consent before using our services
  • A parent/guardian must create accounts and provide personal information on your behalf

If we become aware that we have collected personal information from a child without proper consent, we will take steps to delete that information.

Parents/guardians have the right to:

  • Review personal information collected from their child
  • Request deletion of their child’s information
  • Refuse further collection or use of their child’s information

16. Marketing Communications

We may send you marketing communications about our products, services, and special offers only if:

  • You have given explicit consent (opted in), or
  • You are an existing customer and the marketing relates to similar products/services

16.1 Opt-Out Rights

You can opt out of marketing communications at any time by:

  • Clicking the “unsubscribe” link in any marketing email
  • Emailing aidan@darkblue.co.za with “Unsubscribe” in the subject
  • Updating your communication preferences in your account settings

Important: Opting out of marketing will not stop essential service communications (order confirmations, renewal reminders, security alerts).

Our website may contain links to third-party websites, services, or applications that are not operated by us.

We are not responsible for:

  • Privacy practices of third-party websites
  • Content on third-party websites
  • Security of data you provide to third parties

We recommend:

  • Reading the privacy policies of any third-party sites you visit
  • Being cautious about providing personal information to third parties

18. Automated Decision-Making

We do not currently use automated decision-making or profiling that produces legal effects or significantly affects you.

If we introduce such processing in the future:

  • We will update this Privacy Policy
  • We will inform you of the logic involved
  • You will have the right to request human intervention

19. Information Officer Registration

Our Information Officer is registered with the Information Regulator of South Africa as required by POPIA.

Information Officer Details:

  • Name: Aidan
  • Email: aidan@darkblue.co.za
  • Responsibilities: Ensuring POPIA compliance, handling data subject requests, coordinating with the Information Regulator

20. Updates to This Privacy Policy

We reserve the right to update this Privacy Policy at any time to reflect:

  • Changes in our business practices
  • Changes in legal or regulatory requirements
  • Introduction of new services or features
  • Feedback from the Information Regulator or data subjects

20.1 How We Notify You of Changes

  • Material Changes: We will notify you via email and/or prominent notice on our website at least 30 days before changes take effect
  • Minor Changes: We will update the “Last Updated” date at the top of this policy

20.2 Your Options After Changes

  • If you disagree with changes, you may discontinue using our services
  • Continued use of services after changes take effect constitutes acceptance of the updated policy
  • You may contact us with questions or concerns about policy changes

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

21. Contact Information

For any questions, concerns, or requests regarding this Privacy Policy or our data protection practices:

Information Officer:

Alternative Contact Methods:

  • Via our website contact form: [insert website contact page URL]
  • In writing: [insert physical business address if available]

Response Time: We aim to respond to all privacy-related inquiries within 7 business days.

22. Governing Law

This Privacy Policy is governed by the laws of the Republic of South Africa, including but not limited to:

  • Protection of Personal Information Act (POPIA), No. 4 of 2013
  • Electronic Communications and Transactions Act, No. 25 of 2002
  • Consumer Protection Act, No. 68 of 2008
  • Companies Act, No. 71 of 2008

Any disputes arising from this Privacy Policy will be subject to the exclusive jurisdiction of South African courts.

Acknowledgment: By using our services, you acknowledge that you have read, understood, and agree to the collection, use, and disclosure of your personal information as described in this Privacy Policy.

This Privacy Policy was last updated on 09 February 2026 and is effective immediately.

  1. Definitions
    1. “Seller” refers to DARKBLUE WEB & IT SOLUTIONS.
    2. “Data Subject” refers to the individual or entity to whom the personal information relates.
    3. “POPIA” refers to the Protection of Personal Information Act (No. 4 of 2013).
    4. “SARS” refers to the South African Revenue Service.
    5. “Operator” refers to a person or entity who processes personal information for a responsible party in terms of a contract (e.g., xneelo, couriers).
  2. Information We Collect
    We collect personal information that is necessary to fulfill our contract with you and to meet legal obligations. This includes:
    1. Identification Data: Names, company registration numbers, and identity numbers (where required).
    2. Contact Data: Email addresses, phone numbers, and physical/delivery addresses.
    3. Financial Data: Payment information and tax/VAT numbers (for SARS-compliant invoicing).
    4. Technical Data: IP addresses and website usage data collected during your interaction with our digital services.
  3. Purpose of Processing
    Personal information is processed only for the following reasons:
    1. Contract Fulfillment: Processing sales, delivering hardware, and managing web hosting/domain subscriptions.
    2. Support: Providing after-sales service and technical hardware support.
    3. Legal Compliance: Meeting tax requirements (SARS) and other regulatory obligations.
    4. Communication: Sending essential service-related notifications and renewal reminders.
  4. Sharing of Information
    We do not sell or trade your personal information. We only share data with trusted Operators to facilitate our services:
    1. Infrastructure Providers: xneelo, who hosts our servers and your digital data.
    2. Logistics Partners: Couriers and shipping companies for hardware delivery.
    3. Payment Gateways: Secure third-party providers for processing electronic payments.
    4. Legal Authorities: Where required to do so by law or a court order.
  5. Data Security
    We take all reasonable technical and organisational measures to safeguard your personal data against loss, damage, or unauthorized access.
    1. All server-side data is managed by xneelo. Their security protocols (including physical security and firewalls) can be reviewed at xneelo Security & Reliability.
    2. We use encrypted channels for the transmission of sensitive payment information.
  6. Data Retention
    • In accordance with the Companies Act and SARS requirements, we retain your personal data (specifically transaction records and invoices) for a period of 5 years. After this period, data is de-identified or securely destroyed unless further retention is required for the provision of ongoing services (like active hosting accounts).
  7. Your Rights as a Data Subject
    Under POPIA, you have the right to:
    1. Access: Request a copy of the personal information we hold about you.
    2. Correction: Request that we update or correct inaccurate or out-of-date information.
    3. Objection: Object to the processing of your information for specific purposes.
    4. Deletion: Request the deletion of your data, subject to legal retention requirements (e.g., SARS).
    5. Complain: Lodge a complaint with the Information Regulator of South Africa if you believe your rights have been infringed.
  8. Contact Information
    All requests, objections, or queries regarding your personal data should be directed to our Information Officer: Email: aidan@darkblue.co.za
  9. Policy Changes
    Darkblue Web & IT Solutions reserves the right to amend this Privacy Policy at any time. Changes will be posted on our website and will take effect immediately.

Powered by Web & IT Solutions