Privacy Policy

This Privacy Policy sets out how Shrug ("Shrug", "we", "us", or "our") collects, uses, stores, discloses, and otherwise processes personal information in connection with https://shrug.co.za, our business communications, and related operational systems (including invoicing, electronic contracting, and project delivery tools).

We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA"), other applicable South African law, and, where relevant, comparable principles under foreign law for persons outside South Africa who interact with us.

By using our website, submitting an enquiry, or entering into a commercial relationship with us, you acknowledge that you have read this Policy. Where consent is required by law for a particular processing activity, we will obtain it.

1. Responsible party and contact

For purposes of POPIA, the responsible party is Shrug. Privacy and access requests should be directed to:

• Email: hello@shrug.co.za
• Site: https://shrug.co.za

Where we appoint or designate an Information Officer for POPIA compliance, that person may be contacted at the same email address unless we publish updated particulars.

2. Scope

This Policy applies to personal information relating to:

• visitors to and users of https://shrug.co.za;
• persons who contact us by email or other channels;
• prospective, current, and former clients, and their representatives, employees, or authorised contacts;
• suppliers, contractors, and other business contacts to the extent we process their personal information in the ordinary course of business.

This Policy does not govern third-party websites, applications, or services that we do not control, even if linked from our site. Client products we build may have their own privacy notices; those notices govern end-user data in those products unless we expressly agree otherwise in writing.

3. Definitions

Terms such as "personal information", "processing", "responsible party", "operator", and "data subject" have the meanings assigned in POPIA. "You" means the relevant data subject.

4. Categories of personal information we process

Depending on your interaction with us, we may process the following categories:

4.1 Identity and contact information

Name, title, company or trading name, role, email address, telephone number, physical or postal address, and similar identifiers you provide.

4.2 Commercial and project information

Enquiry contents, project requirements, assumptions, scope discussions, proposals, contracts, statements of work, correspondence, credentials necessary to deliver work (held under confidentiality), billing details, payment references, and tax-related particulars required for invoicing.

4.3 Technical and usage information

Internet protocol (IP) address, browser type and version, device and operating system indicators, referring URLs, pages requested, timestamps, and similar log data generated by hosting, security, or content delivery infrastructure. We do not operate third-party advertising trackers on this marketing website.

4.4 Special personal information

We do not seek special personal information (as defined in POPIA) through this website. Please do not submit such information unless we expressly request it for a lawful purpose and with appropriate safeguards.

5. Sources of personal information

We collect personal information:

• directly from you when you email us, fill forms, sign contracts, or pay invoices;
• from your authorised representatives or colleagues when they engage us on your organisation's behalf;
• automatically through our website and infrastructure logs when you access our systems;
• from public or third-party sources only where lawful and relevant (for example, company registry details you ask us to use in a contract).

6. Purposes of processing

We process personal information for the following purposes:

1. to respond to enquiries and communicate with you;
2. to evaluate fit, prepare quotations, negotiate and perform contracts, and deliver professional services;
3. to issue and administer invoices, process payments, and maintain accounting records;
4. to operate electronic signature and document workflows (including DocuSeal or equivalent);
5. to secure, maintain, troubleshoot, and improve our website and business systems;
6. to comply with legal, tax, regulatory, and professional obligations, and to establish, exercise, or defend legal claims;
7. where permitted, to send service-related notices (for example, scheduling, invoices, or contract updates). Marketing communications, if any, will be sent lawfully and with an unsubscribe mechanism where required.

7. Lawful bases under POPIA

We rely on one or more of the following grounds, as applicable:

• Consent, where you have given informed consent for a specific purpose;
• Contract, where processing is necessary to conclude or perform a contract with you, or to take steps at your request before entering a contract;
• Legal obligation, where processing is required by law;
• Legitimate interest, where processing is necessary for our legitimate interests (or those of a third party) and those interests are not overridden by your rights and interests - for example, securing our systems, responding to business enquiries, and keeping appropriate commercial records.

8. Operators and disclosures

We do not sell personal information. We may disclose personal information to:

• Operators / service providers who process information on our behalf, including hosting and infrastructure providers, email providers, invoicing and accounting platforms, electronic signature platforms, analytics limited to security or operations (if any), and professional advisers (legal, accounting) under confidentiality;
• Payment and banking channels as needed to receive or reconcile payment;
• Regulators, courts, or law enforcement where required or permitted by law, or to protect our rights, users, or the public;
• A successor entity in connection with a merger, acquisition, or restructuring, subject to appropriate confidentiality and notice where required.

Where we use operators, we take reasonable steps to ensure they process personal information only for authorised purposes and with appropriate security measures, consistent with POPIA.

9. Cross-border transfers

Some operators may store or process information in jurisdictions outside the Republic of South Africa. Where we transfer personal information outside South Africa, we will do so in accordance with POPIA section 72, including by ensuring that the recipient is subject to a law, binding corporate rules, or binding agreement that provides an adequate level of protection, or that another permitted ground applies (including your consent where appropriate).

10. Security

We implement reasonable and appropriate technical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. No method of transmission or storage is completely secure. You are responsible for keeping credentials you control confidential and for notifying us promptly of suspected unauthorised access related to our engagement.

11. Retention

We retain personal information only for as long as necessary for the purposes set out in this Policy, or as required or permitted by law. Indicative periods include:

• Enquiry correspondence: retained while useful for follow-up and relationship management, then deleted or archived;
• Contracts, invoices, and project records: retained for the duration of the engagement and thereafter for periods required for accounting, tax, limitation of claims, and professional record-keeping (often several years after the engagement ends);
• Security and server logs: retained for operational and security periods appropriate to the system, then rotated or deleted.

When retention is no longer required, we will delete, destroy, or de-identify information in a manner that prevents reconstruction where reasonably practicable.

12. Your rights as a data subject

Subject to POPIA and applicable exemptions, you may request to:

• be notified that personal information about you is being collected or accessed;
• access personal information we hold about you;
• request correction, destruction, or deletion of inaccurate, irrelevant, or excessive information;
• object to processing in certain circumstances;
• object to processing for direct marketing;
• not be subject to a decision based solely on automated processing that produces legal effects, where POPIA so provides;
• withdraw consent where processing is based on consent (without affecting prior lawful processing);
• lodge a complaint with the Information Regulator.

To exercise these rights, email hello@shrug.co.za with sufficient detail to identify you and the request. We may require reasonable verification of identity before responding. We will respond within the timeframes required by law.

13. Children

Our website and services are directed at businesses and adults. We do not knowingly collect personal information from children under 18 without competent person consent where required by law. If you believe we have collected such information in error, contact us and we will take appropriate steps.

14. Cookies and similar technologies

Our marketing site may use essential cookies or local storage required for security, load balancing, or basic site function. We do not use advertising cookies on this site. If we introduce non-essential analytics cookies in future, we will update this Policy and obtain any consent required by law.

15. Third-party links

Our website may contain links to third-party sites. We are not responsible for their privacy practices. You should review the privacy policy of each site you visit.

16. Changes to this Policy

We may amend this Privacy Policy from time to time. The "Effective date" above will be updated when material changes take effect. Continued use of the website or our services after changes constitutes notice of the updated Policy, except where applicable law requires a different form of notice or consent.

17. Complaints

If you have a concern about our processing of personal information, please contact us first so we can attempt to resolve it. You also have the right to complain to the Information Regulator (South Africa):

• Website: inforegulator.org.za
• Email (general enquiries / complaints as published by the Regulator): refer to the Regulator's official contact particulars on its website.

18. Related terms

Use of this website is also subject to our Terms of Use. Paid engagements are governed by the applicable signed agreement, which prevails over this Policy to the extent of any direct conflict regarding contractual obligations (without limiting your statutory privacy rights).