Privacy Policy

Alba Designs ("we", "us", "our"), registered in the Republic of South Africa as 2020/636646/07, is a web and graphic design studio based in Durban, KwaZulu-Natal. This policy explains how we collect, use, store and protect personal information, in line with the Protection of Personal Information Act 4 of 2013 (POPIA).

It covers two situations: people who visit or enquire through this website, and clients who engage us for design or development work.

1. Who we are

Alba Designs is the responsible party (data controller) for the personal information described in this policy. We are a design studio — we do not sell personal information, and we do not operate an advertising network or data brokerage of any kind.

Where we build a website for a client and that website collects information from the client's own customers, the client is the responsible party for that information. In those cases we act as an operator (processor) on the client's behalf, and the client is responsible for publishing their own privacy policy.

2. What information we collect

Information you give us directly

• Enquiry details — your name, phone number, email address and the content of your message when you submit our contact form, email us, call us or message us on WhatsApp.
• Project information — business details, content, copy, images, logos, brand assets and other material you supply so that we can carry out the agreed work.
• Billing information — the details needed to issue and reconcile invoices, such as billing name, entity name, address and payment reference. We do not collect or store card numbers; payments are made directly by electronic funds transfer or through a third-party payment provider.

Information collected automatically

• Basic technical data — IP address, browser type, device type, referring page and pages viewed, collected by our hosting provider and analytics for security and performance purposes.

3. Why we collect it

We only process personal information where we have a lawful basis to do so under POPIA. In practice that means:

We do not send marketing emails or newsletters. If that ever changes, we will ask for your consent first and give you a clear way to opt out.

4. Client content and credentials

To build or maintain a website we sometimes need access to third-party accounts belonging to you — for example a domain registrar, hosting account, content management system or analytics property.

• We ask for the minimum level of access needed to do the work, and prefer delegated or invited access over shared passwords wherever the platform supports it.
• We ask that credentials be sent through a reasonably secure channel, and we do not require you to disclose credentials you are not comfortable sharing.
• Where you supply content containing other people's personal information (staff photographs, testimonials, customer details), you remain responsible for having the right to provide it to us, as set out in our Master Client Services Agreement.
• On request at the end of a project, we will remove credentials from our records. We ask that you also revoke or rotate any access you granted us once the work is complete.

5. Cookies and analytics

This website does not use advertising cookies, tracking pixels or cross-site profiling.

We may use privacy-respecting analytics and standard hosting logs to understand how the site performs — for example which pages are visited and whether anything is erroring. Our site is served through a hosting provider that may set essential cookies required for delivery and security.

Embedded third-party content, such as the Google Maps panel on our contact page, is provided by that third party and may set its own cookies once loaded. Their use of information is governed by their own privacy policy, not ours.

You can block or delete cookies in your browser settings. Doing so will not prevent you from using this website.

6. Who we share information with

We do not sell, rent or trade personal information. We share it only where necessary, and only with:

• Service providers we rely on to operate — our website host, email provider and, where applicable, a spreadsheet or record-keeping tool used to log enquiries.
• Third parties you have asked us to work with — for example a domain registrar or hosting company where we are setting up services on your behalf.
• Professional advisers — such as an accountant or, if it ever became necessary, a legal adviser or debt-recovery process, as contemplated in our Master Client Services Agreement.
• Anyone we are legally required to disclose to — where disclosure is required by law or a lawful order.

Where we engage subcontractors or authorised service providers to help deliver a project, they are required to treat your information confidentially and use it only for that purpose.

7. Cross-border storage

Some of the services we use — including email and website hosting — store information on servers outside South Africa. POPIA permits this where the recipient is subject to laws or binding agreements that provide an adequate level of protection.

We choose established providers that offer contractual data-protection commitments, and we limit what is transferred to what is needed to run our business.

8. How long we keep information

9. How we protect information

We take reasonable technical and organisational measures appropriate to a studio of our size, including:

• Serving this website over HTTPS.
• Restricting access to project material and credentials to the people who need it.
• Using reputable providers for email, hosting and file storage.
• Applying anti-spam measures to our contact form to limit abuse.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a security compromise affects your personal information, we will notify you and the Information Regulator as required by POPIA.

10. Your rights under POPIA

You have the right to:

• Ask what personal information we hold about you.
• Ask us to correct information that is inaccurate, misleading or out of date.
• Ask us to delete information we no longer have a lawful reason to keep.
• Object to processing in certain circumstances.
• Withdraw consent, where our processing was based on consent.
• Complain to the Information Regulator.

To exercise any of these, email us at albawagdesigns@gmail.com. We will respond within a reasonable period. We may need to verify your identity before acting on a request.

The Information Regulator (South Africa) can be contacted at inforegulator.org.za.

11. Children's information

Our services are aimed at businesses and adults. We do not knowingly collect personal information from children under 18. If you believe a child has provided us with personal information, contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top of this page will always reflect the current version. Material changes affecting existing clients will be communicated directly.

13. How to contact us