Privacy Policy

01Who this policy covers

Little Goliath (Pty) Ltd, trading as LittleGoliath, is responsible for personal information we use to manage our website, enquiries, customer relationships and business operations. This notice is written for the South African Protection of Personal Information Act, 2013 (POPIA).

For information you place in your own hosted website, database or mailbox, you normally decide why and how it is used. We act as a service provider or operator to the extent we process it on your instructions. Our service agreement and applicable operator arrangements govern that processing; your own visitors and customers also need your privacy notice.

02Information we collect

• Enquiries and project briefs: your name, email, optional phone and business details, website address, requested services and information you choose to include.
• Customer and order records: account details, billing details, quotations, invoices, transaction references, service subscriptions and correspondence.
• Domain and hosting records: registrant and technical-contact details, configuration information, authorised support requests, and content stored as part of your hosting service.
• Technical information: IP addresses, browser and device information, request times, session identifiers, security events and service logs generated when you visit or use our systems.

We receive information from you, your authorised representatives, your use of the service and suppliers involved in fulfilling your order. Do not send passwords, private keys, full card details or unnecessary sensitive information in an enquiry form. Payment providers process payment information under their own notices; their transaction confirmations allow us to reconcile orders.

03Why we use it

We use relevant information to answer questions, prepare quotations, deliver and support services, register or renew domains, manage accounts and payments, prevent abuse, resolve disputes and meet legal obligations. Information required for an order or domain registration must be provided for us to fulfil that request; optional enquiry fields can be left blank.

Our grounds for processing may include steps you request before a contract, performance of that contract, legal obligations, consent where needed, and legitimate interests in running and securing our services, balanced against your rights. We do not treat consent as a condition for unrelated marketing.

04Who may receive information

We share only information reasonably needed for the relevant purpose with authorised staff and service providers such as hosting infrastructure providers, domain registrars and registries, payment processors, communications providers and professional advisers. For example, a registry needs registrant information to process a domain request. Registry rules determine what domain data may be disclosed through registration-data services.

Suppliers acting on our instructions must protect information and use it for the agreed service. Some organisations act independently under their own privacy notices. We may also disclose information where lawfully required, to investigate abuse or to protect legal rights. We do not sell personal information as a mailing list.

05Processing outside South Africa

Some domain, payment, software or infrastructure services may involve processing in another country. Where a cross-border transfer is necessary, we use a lawful basis under POPIA, such as an appropriate protection agreement or a transfer needed for your requested service. Contact us if you need information about the providers or locations relevant to your account.

06Cookies & website features

Our WordPress and WooCommerce website uses cookies or similar storage for functions such as login sessions, shopping-cart contents, security and remembering choices. Blocking these in your browser can affect those functions. A cookie notice is not a promise that all optional scripts are blocked or that every browser “Do Not Track” signal is supported.

If analytics, advertising or third-party embeds are enabled, their purposes and relevant choices should be presented where they are used, with consent obtained where required. Third-party sites you choose to visit have their own privacy practices. You can manage browser cookies and contact us about the features currently active on this website.

07Marketing & service messages

We send electronic direct marketing only where permitted, using the required consent or the limited existing-customer exception. Marketing messages identify the sender and offer a way to stop further marketing. You may object or withdraw consent by using that option or emailing us. Necessary invoices, renewal notices, security alerts and replies to your requests are service communications, not a subscription to marketing.

08How long we keep information

We retain information for the purpose it was collected, the duration of the relationship and applicable accounting, tax, legal or dispute requirements. We assess the type of record and reason for keeping it rather than promising one deletion period for all data. When it is no longer needed and no lawful retention basis remains, we delete, destroy or de-identify it through the relevant systems.

Closing an account does not erase records we are legally entitled or required to keep. Conversely, hosting is not permanent archival storage. Export required website and email data before cancellation; the Email Policy explains the absence of standard mailbox backups.

09Security & incidents

We take reasonable technical and organisational steps appropriate to the information and service, including access restrictions and measures to detect or limit unauthorised activity. No internet service is completely risk-free. Keep credentials secure and report suspicious access promptly.

Where a security compromise triggers POPIA notification duties, we will notify the Information Regulator and affected people as soon as reasonably possible, subject to lawful exceptions or delays. Where we act as an operator, we will notify the responsible client immediately when the legal notification threshold is met and cooperate with the response.

10Your requests & complaints

You may ask whether we hold your information, request access or correction, object to applicable processing, withdraw consent where processing relies on it, or request deletion where we are no longer authorised to retain it. Rights have lawful limits, and withdrawal does not undo processing that was lawful before it. We may need proportionate identity verification to protect your account.

Email info@littlegoliath.co.za with “Privacy request” in the subject and explain your request. Please do not email an identity document unless we have explained why it is needed and arranged a suitable channel. For information controlled by a hosted customer, we may refer you to that customer or assist them.

You may also complain directly to the Information Regulator of South Africa. You do not have to waive that right while contacting us.

11Children, changes & contact

Our services are aimed at businesses and adults. We do not seek children’s personal information through our enquiry forms. If you believe a child’s information has been submitted without appropriate authority, contact us so that we can assess and address it.

We update this notice when our practices or requirements change and identify the revision date below. Questions about personal information can be sent to info@littlegoliath.co.za, marked for the Information Officer, or raised on 079 778 9165.