Privacy Policy | Digitalx

Last updated: 18 October 2026

Who we are and who is responsible

Digitalx Group (Pty) Ltd (registration number 2019/454913/07), trading as Digitalx, operates from Kuils River, Cape Town, Western Cape. For the purposes of the Protection of Personal Information Act 4 of 2013 (POPIA), Digitalx is the responsible party for the personal information described in this policy.

Our Information Officer

Our Information Officer is Keith Vilani, Founder and Chief Executive Officer. Contact: hello@digitalxagency.io, 021 879 3035, or by post at our Kuils River office (address on request). If you have a concern about how your information is handled, please contact us first.

The information we collect

Information you give us

Your name, email address and phone number when you send an order, enquiry or payment
Business details such as company name, website and what your business does
For company registrations: full names, proposed company names and director details through the order form, and certified copies of each director's ID or passport, residential address, email address and phone number, sent through our Submit files page or the client portal, because the filing requires them
Files you upload with an order, through the Submit files page or in the client portal
Messages you send through the contact form: your name, email address, optional phone number and your message
Client portal accounts: your name, email address, phone number, company, project details and a password, which we store only as a one-way scrambled hash. If you turn on Face ID or fingerprint sign-in, your device keeps your biometrics; we store only a public key that cannot be used to recreate them.
Our client list: when you send an order, a message or files, we keep your name, email address, phone number, company and what you asked about, so we can reply, follow up and send you updates about your project. We may sort clients into groups to manage our work.
The name and email address you enter when you pay online
Support requests: your name, email address, optional mobile number and what you tell us about the problem, from our support form, the client portal, emails to our support address or our website assistant
Chats with our website assistant: the messages you type and the page you started on. If you ask the assistant to pass your details to our team or to open a support ticket, it saves the name, email address and phone number you give it.
Billing records: your invoices, payments, recurring services and what you owe, so we can send invoices, receipts and reminders
Domain and hosting orders: the registrant details domain registries require (your name, company, email address, phone number and postal address), the domain and nameservers you choose, and your hosting plan

Information collected automatically

Essential: your cookie choice, stored in your browser
Security: technical information processed by Cloudflare Turnstile to check that order-form submissions come from a person, and a hashed (not readable) version of your IP address used to limit spam
Only if you choose "Accept all": analytics and advertising data through Google Tag Manager, Google Analytics and Google Ads, such as pages visited, device type and how you arrived. See our cookie policy.

Payment information

Online payments are processed by Paystack on its own PCI-DSS compliant checkout. We never see or store your card number, expiry date or CVV. We receive the payment reference, amount, status, and the name and email address you supplied.

Why we process it, and on what basis

To perform a contract with you, or take steps you asked for before one: replying to orders, preparing quotes, delivering services and taking payment.
To comply with the law: CIPC and SARS filings need identity information; tax law requires us to keep records.
With your consent: analytics and advertising cookies, and any marketing messages. You can withdraw consent at any time.
Our legitimate interests: protecting our forms and systems from spam and fraud, and keeping business records.

Who we share it with (our operators)

We do not sell personal information. We share only what each service needs:

Truehost Cloud hosts our website and our email mailboxes, and registers, renews and transfers the domain names you buy through us. Your registrant details are passed to Truehost and to the registry for your domain extension (for example ZACR for .co.za domains), and registries may publish some of them in public WHOIS records under their rules.
Resend delivers form submissions and payment notifications to our mailbox, and our confirmations and project messages to you, by email.
SMSPortal sends our SMS confirmations and project messages to the mobile number you gave us.
Cloudflare (Turnstile) checks order-form submissions for bots.
Cloudflare (Workers AI) runs the AI model that answers our website assistant. The messages you type in the assistant are sent to Cloudflare to produce a reply; Cloudflare does not keep them after replying and does not use them to train AI models. The assistant is clearly marked as AI; please do not share ID numbers, bank or card details or passwords with it.
Paystack processes online payments.
Google (Tag Manager, Analytics and Ads) measures visits and advertising, only if you accept those cookies.
Supabase hosts the databases of custom software we build and manage for clients, where applicable to your project.
CIPC and SARS, where you ask us to file a registration, annual return, beneficial ownership declaration or tax registration.

Until October 2026 our order form was delivered through FormSubmit. It is no longer used. We may also disclose information where a court order, regulator or law requires it.

Information sent outside South Africa

Some of these operators process or store information outside South Africa, including in the United States and other countries (for example Resend, Cloudflare, Google, Paystack's infrastructure and Supabase). Under section 72 of POPIA we only transfer personal information abroad where the recipient is bound by law, binding corporate rules or an agreement giving an adequate level of protection, where you consent, or where the transfer is necessary to perform a contract with you or steps you asked for. If you prefer your own website and email to be hosted in South Africa, tell us.

How we protect it

Encrypted connections (HTTPS) on every page and when order details are sent to us
Confirmations and messages about your project are sent by email and, where you gave us a mobile number, by SMS through SMSPortal. These are service messages, not marketing. Tell us if you prefer email only.
Order and contact form details are not stored on the website; they are emailed to our team and handled in our mailbox
Documents uploaded through the Submit files page or the client portal are emailed to our team and kept in a private area of our server that is not reachable from the web. Only our team, and you in your own client portal, can open them.
Payment records and quotes are stored in a private area of our server that is not reachable from the web
Quotes and invoices are emailed to you as PDF files and can also be opened through a private link with a long random code (for example on WhatsApp or SMS). Anyone who has the link can view that document, so please share it only with people who need it. The scan-to-pay QR code on a PDF only opens our Paystack payment page for that document.
Spam protection, rate limits and server-side checks on every form
Access limited to the people who need it

How long we keep it

Enquiries and quotes that do not proceed: up to 24 months, then deleted.
Client records, invoices and correspondence: at least five years, as tax and company law require.
Identity documents and other uploaded files: as long as the work and legal record-keeping require, then securely deleted from our server and mailbox. You can ask us to delete them sooner.
Client portal accounts: while you are a client, and up to 24 months after the last project ends, then deleted.
Website event and error logs: 12 months, then deleted automatically. They hold reference numbers and technical details, not the contents of your order.
Spam-protection counters: a hashed (unreadable) version of your IP address, deleted automatically after 48 hours.
Payment and quote records: at least five years, for accounting.
Website assistant chats: 12 months, then deleted automatically.
Support tickets: while you are a client and up to 24 months after the ticket is closed, then deleted.
Domain and hosting records: while we manage the domain or hosting for you, then at least five years for accounting.
Analytics data: according to the retention settings in Google Analytics, only where you consented.

Your rights

You may ask what personal information we hold about you and for a copy; ask us to correct or delete information; object to processing based on legitimate interests; withdraw consent at any time (change cookie choices with "Cookie settings" in the footer); and complain to the Information Regulator (inforegulator.org.za). Email hello@digitalxagency.io. We may need to verify your identity before releasing information.

Security incidents

If we believe your personal information has been accessed by an unauthorised person, we will notify you and the Information Regulator as POPIA requires.

Changes to this policy

We update this policy when our services or operators change. The date at the top shows the latest version.