Privacy Policy

1. Who we are

Acendia Digital ("Acendia," "we," "us," "our") is a growth-marketing and lead-response infrastructure business based in Pretoria, South Africa. We provide marketing, advertising, WhatsApp automation, and related services to businesses, and we operate this website.

This Privacy Policy explains how we collect, use, share, and protect personal information when you visit our website, interact with our advertising (including on Meta platforms such as Facebook and Instagram), fill in a form, message us on WhatsApp, or otherwise engage with us — whether you are located in South Africa, the United Kingdom, the European Economic Area (EEA), or elsewhere.

2. Scope — the laws this policy is written to meet

Because Acendia works with clients and runs advertising in South Africa, the United Kingdom, and the European Union, this policy is designed to meet:

• POPIA (Protection of Personal Information Act, South Africa)
• UK GDPR and the Data Protection Act 2018 (United Kingdom)
• EU GDPR (Regulation (EU) 2016/679), for visitors and customers in the EEA
• Meta Platforms' Business Tools Terms, Data Processing Terms, and advertising policies, which require advertisers using Meta Pixel, Conversions API, and Custom Audiences to disclose this to website visitors

Where these laws differ, we apply the stricter standard to the relevant individual (for example, EU/UK visitors receive full GDPR-standard rights; South African individuals receive POPIA rights).

3. Personal information we collect

We collect information depending on how you interact with us:

Information you give us directly

• Name, email address, phone number, WhatsApp number
• Company name, job title, and business details
• Information submitted through contact forms, quote requests, quiz/lead forms, or consultation bookings
• Messages and content you send us via WhatsApp, email, or contact forms

Information collected automatically

• IP address, browser type, device type, operating system
• Pages viewed, time on site, referring URL, general location (city/country level)
• Cookies and similar tracking technologies (see Section 7)

Information from advertising platforms (Meta/Facebook, Google, LinkedIn)

• Data collected via the Meta Pixel and/or Conversions API, including pages viewed, button clicks, form submissions, and purchase or lead events on our website
• Hashed contact information (such as a hashed email or phone number) if you interact with our ads or are included in a Custom Audience we build from our own customer/lead lists
• Ad interaction data (clicks, views, engagement) provided to us by Meta, Google, or LinkedIn in aggregated or individual form

Information from third parties

• CRM and business-lead data (we use platforms such as GoHighLevel to manage enquiries)
• Data from business databases used for B2B outreach (e.g. Apollo), where you are a business contact rather than a consumer

We do not knowingly collect special category data (such as health, religious belief, or biometric data) through this website, and we ask that you do not submit such information to us via our forms or WhatsApp.

4. How and why we use your information

We use personal information for the following purposes, and on the following legal bases (relevant to EU/UK GDPR):

Under POPIA, we process personal information only where necessary for one of the justifiable grounds set out in the Act (consent, contract, legal obligation, protecting a legitimate interest, or the proper performance of a public duty), and we collect only what is adequate, relevant, and not excessive for these purposes.

5. Advertising on Meta (Facebook & Instagram) — specific disclosures

We use Meta Business Tools, including the Meta Pixel and/or Conversions API, on this website.

These tools collect data about your visit — such as pages viewed, links clicked, and actions like form submissions — and share it with Meta Platforms, Inc. (and, for EEA/UK visitors, Meta Platforms Ireland Limited).

We use this data to measure the performance of our ads, build Custom Audiences (including from hashed contact information you've provided to us, where you've consented to marketing), build Lookalike Audiences, and retarget visitors with relevant ads on Facebook and Instagram.

Meta may combine this information with other data it holds about you in accordance with Meta's own Data Policy, available at facebook.com/policy.php.

For EU/UK visitors, use of the Meta Pixel and non-essential cookies requires your prior opt-in consent, which we obtain via our cookie banner before any tracking cookies are set. If you do not consent, you can still use our website normally.

Where we and Meta jointly determine the means of processing (for example, through Custom Audiences created from data we upload), Meta and Acendia may act as joint controllers, as set out in Meta's Controller Addendum. Meta's data protection terms describe the division of responsibilities between us.

You can control how Meta uses your data for ads via the Ad Preferences settings in your Facebook or Instagram account, and opt out of interest-based advertising at facebook.com/ads/preferences.

6. Sharing your information

We do not sell personal information. We share information with:

• Service providers and processors who help us run our business, including GoHighLevel (CRM), our WhatsApp API provider, email/hosting providers, and analytics tools — all under data processing agreements requiring them to protect your data
• Advertising platforms (Meta, Google, LinkedIn) as described in Section 5, for ad measurement and audience building
• Professional advisors (accountants, lawyers) where necessary
• Regulators or authorities where required by law
• A buyer or successor in the event of a merger, acquisition, or sale of business assets

7. Cookies and tracking technologies

We use cookies and similar technologies for:

• Strictly necessary cookies — required for the website to function (no consent required)
• Analytics cookies — to understand how visitors use our site
• Advertising/marketing cookies — including the Meta Pixel, used for retargeting and ad measurement

For visitors in the UK and EEA, we display a cookie consent banner on first visit. Non-essential cookies (analytics and advertising) are only set after you actively opt in. You can withdraw consent at any time through your browser settings or our cookie preference tool [insert link if using a consent management platform].

8. International data transfers

We are based in South Africa. Where we transfer personal information about UK or EEA individuals to South Africa, or to service providers based in the United States (such as Meta) or elsewhere, we take steps to ensure an adequate level of protection, including:

• Relying on the UK Extension to the EU-US Data Privacy Framework or EU Standard Contractual Clauses, where applicable to our processors (e.g. Meta)
• Entering into data processing agreements with our service providers
• Assessing, where required, whether additional safeguards are needed for transfers to countries without an adequacy decision

Under POPIA, we ensure that any cross-border transfer of personal information out of South Africa complies with section 72, including that the recipient is subject to laws, binding agreements, or other provisions that provide an adequate level of protection substantially similar to POPIA.

9. Data retention

We retain personal information only for as long as necessary to fulfil the purposes described in this policy, including:

• Enquiry and lead data: for the duration of our relationship with you, plus a reasonable period afterward for record-keeping
• Marketing consent records: until you withdraw consent, plus a period to evidence that consent was given
• Advertising/Pixel data: in line with Meta's own retention rules and our ad platform settings
• Financial and tax records: as required by South African and applicable tax law

10. Your rights

If you are in the UK or EEA (UK/EU GDPR), you have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete data
• Request erasure ("right to be forgotten")
• Restrict or object to processing (including objecting to direct marketing at any time)
• Data portability
• Withdraw consent at any time, without affecting processing carried out before withdrawal
• Lodge a complaint with your local supervisory authority — in the UK, the Information Commissioner's Office (ICO), ico.org.uk; in the EU, your national data protection authority

If you are in South Africa (POPIA), you have the right to:

• Be notified that personal information is being collected
• Access and request correction or deletion of your personal information
• Object to the processing of your personal information
• Not be subject solely to automated decision-making that significantly affects you
• Lodge a complaint with the Information Regulator of South Africa (inforegulator.org.za)

To exercise any of these rights, contact us using the details in Section 1. We will respond within the timeframes required by applicable law.

11. Children's privacy

Our website and services are directed at businesses and business decision-makers. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

12. Security

We implement reasonable technical and organisational measures to protect personal information against loss, unauthorised access, alteration, or disclosure, consistent with our obligations under POPIA, UK GDPR, and EU GDPR.

13. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be communicated where required by law.

14. Contact us

If you have questions about this Privacy Policy or how we handle your personal information, contact:

Acendia Digital
Email: privacy@acendiadigital.com
Address: Ajax Road, Pretoria, South Africa

If you are not satisfied with our response, you have the right to complain to the Information Regulator (South Africa), the ICO (UK), or your local supervisory authority (EEA).