Privacy Policy

Note before publishing: this policy is a working draft prepared for GoTo Communications. Complete every field marked [INSERT], confirm the registration and address details, and have it checked by a legal adviser before it goes live. Delete this paragraph once done.

1. Who we are

GoTo Communications (Pty) Ltd, registration number [INSERT], is a strategic communications, marketing and AI consultancy based in Bloemfontein, Free State, South Africa. In this policy, "we", "us" and "our" mean GoTo Communications (Pty) Ltd.

We are the responsible party for the personal information described here, as that term is used in the Protection of Personal Information Act 4 of 2013 (POPIA).

• Postal and physical address: [INSERT STREET ADDRESS], Bloemfontein, Free State, South Africa
• Email: hello@gotocommunications.co.za
• Telephone and WhatsApp: +27 71 871 1311
• Information Officer: [INSERT FULL NAME], privacy@gotocommunications.co.za

2. What we collect

2.1 Information you give us

• Enquiries. Name, organisation, work email address, telephone number, sector, the problem you select, and whatever you write in the message field.
• Newsletter. Email address and your recorded consent to receive it.
• Bookings. If you book a session through our scheduling provider, the details you enter there, including name, email address and the times you select.
• Engagements. If you become a client, the information needed to deliver the work and to invoice you, which may include contact details for your staff, billing details and any material you share with us during discovery.

2.2 Information collected automatically

• Essential cookies and local storage. Used to remember your cookie choice and your light or dark display preference. These do not identify you.
• Optional analytics. Loaded only if you select "Accept all" on the cookie banner. If you select "Essential only", no analytics or other optional scripts are loaded.
• Server logs. Our hosting provider records standard technical information, including IP address, browser type and pages requested, for security and troubleshooting.

2.3 Embedded content

Our contact page embeds a Google Maps frame. Loading that frame causes your browser to contact Google, which may set its own cookies and receive your IP address. That processing is governed by Google's privacy terms, not ours.

3. Why we process it, and on what basis

• To respond to your enquiry. Processing is necessary to take steps at your request before entering an agreement.
• To deliver and administer engagements. Processing is necessary to perform our agreement with you.
• To send the monthly Executive Brief. Processing is based on your consent, given by ticking the subscription box. You may withdraw it at any time.
• To secure and improve the site. Processing is based on our legitimate interest in running a safe, working website, balanced against your rights.
• To meet legal obligations. Tax, accounting and record-keeping requirements under South African law.

We do not sell personal information. We do not use it to build advertising profiles.

4. Who we share it with

We share personal information only with operators who process it on our behalf, under written agreements requiring appropriate security. These currently include:

• Our form-handling provider, which delivers enquiry and subscription submissions to our inbox
• Our scheduling provider, which manages consultation bookings
• Our email, hosting and file-storage providers
• Our accounting provider, for invoicing and statutory records

Some of these providers process information outside South Africa. Where that happens, we rely on the safeguards permitted under section 72 of POPIA, including binding contractual terms that give effect to principles substantially similar to those in POPIA.

We disclose information to third parties otherwise only where the law requires it, or where you have asked us to.

5. Artificial intelligence

We use AI tools in our own work. Where client or enquiry information is involved, we apply the same rules we recommend to clients: data classes are mapped before a tool is approved, personal and confidential information is excluded from general-purpose consumer tools, and processing decisions are documented. We do not submit your personal information to AI tools for the purpose of training public models.

6. How long we keep it

• Enquiries that do not become engagements: 24 months from last contact, then deleted.
• Newsletter subscriptions: until you unsubscribe, plus a suppression record so we do not contact you again in error.
• Client records: for the duration of the engagement and at least five years afterwards, as required by tax and company legislation.
• Server logs: as determined by our hosting provider, typically not more than 12 months.

7. How we protect it

We apply reasonable technical and organisational measures appropriate to the risk: access controls and multi-factor authentication on business accounts, encryption in transit, restricted access on a need-to-know basis, supplier due diligence, and a documented incident response procedure. No system is perfectly secure, and we do not claim otherwise. If a security compromise affects your personal information, we will notify you and the Information Regulator as required by section 22 of POPIA.

8. Your rights

Under POPIA you may:

• Ask us to confirm what personal information we hold about you, and request a copy
• Ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully
• Object, on reasonable grounds, to processing based on legitimate interest
• Withdraw consent to direct marketing at any time, without affecting processing that took place before withdrawal
• Complain to the Information Regulator

To exercise any of these, email privacy@gotocommunications.co.za. We respond within 30 days. We may ask you to verify your identity first. Requests are free, except that a prescribed fee may apply to a formal request for access to a record.

Information Regulator (South Africa)

• Website: inforegulator.org.za
• Complaints: POPIAComplaints@inforegulator.org.za

9. Cookies and your choices

When you first visit, you choose between "Accept all" and "Essential only". Essential cookies and local storage cannot be switched off because the site cannot remember your choice without them. Optional scripts load only after you accept them. You can change your mind at any time: reopen cookie settings, or clear this site's data in your browser.

10. Children

This site is intended for organisations and working professionals. We do not knowingly collect personal information from children under 18. If you believe we have, contact the Information Officer and we will delete it.

11. Changes to this policy

We review this policy at least annually and whenever our processing changes materially. The version number and effective date at the top of this page show the current version. Material changes will be notified to newsletter subscribers by email.

12. Related documents

• POPIA Notice: the short, point-of-collection summary required by section 18
• Terms of Service: the terms on which we provide services