Privacy Policy

This policy explains how WeKode (“WeKode”, “we”, “us”) handles personal information. WeKode is a web development and hosting studio operating in South Africa and Malawi.

• Registered name: registered entity name
• Registration number: company registration number
• Registered address: street address, city, postal code
• Email: [email protected]
• Telephone: +27 68 602 1556
• Website: www.wekode.dev

For the purposes of the Protection of Personal Information Act 4 of 2013 (“POPIA”), WeKode is the responsible party for personal information collected through this website and in the course of our own business. Where we build or host systems on behalf of a client, that client is usually the responsible party and we act as an operator processing information on their documented instructions.

Information you give us

• Contact details — your name, email address, phone number, and company name when you email us, message us on WhatsApp, or reach out through social media.
• Project information — the content of your enquiry, requirements, briefs, and any material you send us to scope or deliver work.
• Billing information — the details needed to invoice you and record payment. We do not collect or store full card numbers; card payments, where offered, are handled by third-party payment providers.
• Referral details — if you take part in our referral programme, the contact details of the person you refer and the details we need to calculate and pay your commission.

Information we collect automatically

• Usage and device data — IP address, browser and device type, operating system, referring page, pages viewed, and time spent on the site, collected through analytics as described in section 5.
• Server logs — our infrastructure records requests made to sites we host, including IP addresses and timestamps, for security, debugging, and abuse prevention.

We do not deliberately collect special personal information (such as health, religious, or biometric data) or the personal information of children through this website.

We only process personal information where we have a lawful basis to do so. In practice that means one of the following:

• To respond to you — answering enquiries, preparing quotations, and discussing potential work. Basis: steps taken at your request before entering a contract.
• To deliver our services — designing, building, deploying, hosting, maintaining, and supporting the systems we agree to provide. Basis: performance of our contract with you.
• To invoice and get paid — issuing invoices, recording payments, and pursuing outstanding amounts. Basis: contract and our legitimate interests.
• To run the referral programme — verifying referrals and calculating commission. Basis: contract and legitimate interests.
• To keep our systems secure and working — monitoring, backups, debugging, and preventing abuse. Basis: legitimate interests and our legal obligations.
• To improve the website — understanding in aggregate how the site is used. Basis: consent, where required, via analytics.
• To meet legal and tax obligations — retaining records we are required by law to keep. Basis: legal obligation.

We do not sell personal information, and we do not use it for automated decision-making that produces legal effects for you.

We may send you information about our services where you have asked us to, or where you are an existing client and the message relates to services similar to those we already provide you. Every marketing message will identify us and give you a straightforward way to opt out.

You can tell us to stop at any time by replying to any message or emailing [email protected]. We will still send you operational messages about work in progress, invoices, and the systems we host for you.

This website uses a small number of third-party services that set cookies or similar identifiers:

• Google Analytics — measures how visitors find and use the site, so we can improve it. It collects usage and device data, including a truncated or full IP address depending on configuration. Google’s handling of this data is governed by its own privacy policy.
• Vercel Analytics — records aggregate page views and performance metrics for the site.

Portions of our portfolio section load client websites inside an embedded frame. Those sites are operated independently and may set their own cookies once loaded; we do not control them.

You can block or delete cookies through your browser settings, and most browsers offer a “do not track” setting. Blocking cookies will not stop you using the site. If a cookie consent banner is added, describe it here and how to change your choice.

We share personal information only where it is necessary, and only with parties who are bound to protect it:

• Infrastructure and hosting providers — the providers whose servers and networks run our own site and the sites we host.
• Analytics providers — Google and Vercel, as described above.
• Communication and productivity tools — email, messaging, and document services we use to run the business.
• Payment and accounting providers — to process payments and keep financial records.
• Professional advisers — accountants and lawyers, where they need the information to advise us.
• Authorities — where we are legally required to disclose information, or need to do so to establish or defend a legal claim.

If our business is sold or restructured, personal information may transfer to the acquiring party, who will remain bound by this policy until they give you notice of any change.

List the actual named sub-processors you use — hosting provider, email provider, accounting software, payment gateway.

We operate in South Africa and Malawi, and some of the providers we rely on store or process information outside those countries.

Where we transfer personal information across a border, we do so only where the receiving country or the recipient offers protection that is substantially similar to POPIA and Malawian data protection law, or where the transfer is necessary to perform our contract with you, or where you have consented. Where required, we put written terms in place with the recipient before transferring.

We keep personal information only as long as we need it for the purpose it was collected, and then delete it or make it anonymous. Broadly:

• Enquiries that do not become projects — e.g. 24 months from your last contact with us.
• Client and project records — for the life of the engagement and e.g. 5 years afterwards, so we can support what we built and defend any claim.
• Invoices and financial records — for the period required by South African and Malawian tax law, which is generally at least five years.
• Server and security logs — e.g. 90 days, unless retained longer to investigate an incident.
• Backups — held on a rolling cycle and overwritten in the ordinary course.

We maintain appropriate technical and organisational safeguards against loss, unauthorised access, and misuse. These include encryption in transit (TLS), access controls and least-privilege administration, active firewalling and DDoS protection, automated daily backups, patching and monitoring of the systems we run, and limiting access to personal information to people who need it.

No system is perfectly secure. If a breach occurs that creates a real risk of harm to you, we will notify you and the relevant regulator as soon as reasonably possible, as required by law.

Subject to the limits set by law, you have the right to:

• ask whether we hold personal information about you, and request a copy of it;
• ask us to correct or complete information that is wrong or out of date;
• ask us to delete information we no longer have grounds to keep;
• object to processing we carry out on the basis of legitimate interests;
• withdraw consent at any time, where we relied on your consent;
• ask us to stop using your information for direct marketing; and
• complain to the relevant regulator.

To exercise any of these, email [email protected]. We may need to verify your identity first. We will respond within the period the law allows, and we do not charge a fee unless your request is clearly unfounded or excessive.

If the personal information is held by us on behalf of a client, we will point you to that client, who is the responsible party for it.

Please raise any concern with us first — most issues are quickest to fix directly. If you are not satisfied, you can complain to the relevant supervisory authority:

• South Africa — the Information Regulator (South Africa), which oversees POPIA. Details are published at inforegulator.org.za.
• Malawi — the data protection authority designated under Malawian law. Confirm the current authority and its contact details before publishing.

Our services are aimed at businesses, and we do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

This site links to and embeds websites we have built for clients, and links to third-party platforms such as WhatsApp and Instagram. We are not responsible for how those sites handle your information. Read their privacy policies before giving them personal information.

We may update this policy as our services or the law change. The effective date at the top of this page shows the current version. If a change materially affects how we use your information, we will take reasonable steps to tell you directly.

For anything relating to this policy or your personal information:

• Information Officer: full name
• Email: [email protected]
• Telephone: +27 68 602 1556
• Postal address: postal address

Under POPIA, a responsible party must register an Information Officer with the Information Regulator. Confirm this registration is in place.