Book Consultation
Home/Privacy Notice

Privacy Notice

How Sombuluka Business Services collects, uses and protects personal information submitted through this website.

Last updated: 1 June 2026

1. Who We Are

Sombuluka Business Services (Pty) Ltd, trading as Sombuluka Business Services, operates the website at www.sombuluka.com.

In this notice, “we”, “us” and “our” refer to Sombuluka Business Services. “You” refers to any person who visits or submits information through the website.

We are a responsible party as defined in the Protection of Personal Information Act 4 of 2013 (POPIA). This notice explains what personal information we collect through sombuluka.com, why we collect it, how we handle it and what your rights are.

2. Information Officer

The Information Officer responsible for overseeing compliance with POPIA is:

The Information Officer is registered with the South Africa Information Regulator as required by POPIA.

3. What Personal Information We Collect

We collect personal information only when you actively provide it by submitting the contact or consultation form on this website. We use Google Analytics 4 to understand how visitors use the website; this is loaded only after you give Analytics consent. We do not use advertising cookies, retargeting pixels or marketing analytics. We do not purchase or receive personal information from third parties.

The categories of information we collect are described in sections 4 to 7 below.

4. Contact Form

When you submit the contact form at /contact/, we collect:

  • Full name (required)
  • Company or organisation name (optional)
  • Email address (required)
  • Phone number (optional)
  • Service of interest (selected from a list)
  • Preferred contact method
  • Your message
  • Confirmation that you have read and agreed to this Privacy Notice

This information is transmitted to us by email and is not stored in a database on the website server. We do not retain contact form submissions in any website file or log.

5. Consultation Booking Form

When you submit the consultation booking form at /consultation/, we collect:

  • Full name (required)
  • Email address (required)
  • Phone number (optional)
  • Company or organisation name (optional)
  • Business stage
  • Industry / sector
  • Number of employees
  • Services needed (selected from a list)
  • Biggest business challenge
  • Urgency level
  • Monthly budget range
  • Preferred contact method
  • Additional notes
  • Confirmation that you have read and agreed to this Privacy Notice

This information is transmitted to us by email with a PDF summary attached. It is not stored in a database or file on the website server after transmission.

6. Web Server Logs and Session Data

Like all websites, our web hosting server automatically records technical information each time a browser requests a page. These server logs may include:

  • IP address of the device making the request
  • Date and time of the request
  • URL requested
  • HTTP response code
  • Browser type and version (user-agent string)
  • Referring URL (the page you came from, if any)

Server logs are held by the hosting provider and are used for security monitoring, diagnosing errors and managing server performance. They are not used to identify or profile individual visitors. Retention is governed by our hosting provider’s standard log rotation policy.

We also use PHP sessions to enforce rate limiting on form submissions. A session is a temporary server-side record linked to your browser via a session cookie. Session data contains only a timestamp and does not include any personal identifying information. PHP session data is cleared automatically when your browser session ends or the session expires.

7. Cookies and Local Storage

This website uses a small number of strictly necessary technologies and, with your permission, optional ones.

Necessary (always active)

  • PHP session cookie: a short-lived browser cookie created by the server when you submit a form. It links your browser to a temporary session record used only for rate limiting. It expires when you close your browser or after a short inactivity period.
  • Cloudflare Turnstile: sets a technical token in your browser to verify that a form submission comes from a human. See section 13 for details.

Functional (visitor-controlled)

  • Google Maps embed: if you choose to allow functional content on the Contact page, your browser loads a Google Maps iframe, which may set cookies from Google. See section 15 for details.

Analytics

This website uses Google Analytics 4 (GA4) to understand how visitors find and use the site, and to measure the performance of service and consultation enquiry pages. GA4 is loaded in your browser only after you give Analytics consent. If you reject optional cookies or do not give consent, GA4 is not loaded and no data is sent to Google for analytics purposes.

When active, GA4 may collect information such as: pages visited, approximate session duration, device type, browser type and general location (country or region derived from IP address). We do not intentionally send names, email addresses, phone numbers, message content or consultation answers to GA4.

You can withdraw Analytics consent at any time using the Cookie Settings button at the bottom of this page. Withdrawing consent prevents future collection but does not retroactively delete data already collected by Google.

Google processes Analytics data on servers in the United States and other countries outside South Africa. Google’s privacy policy applies: policies.google.com/privacy

Analytics consent is optional and is not required to use the website, submit forms or receive a response from Sombuluka.

Marketing

No marketing or advertising cookies are currently active on this website.

Cookie preferences

You can view and update your cookie preferences at any time using the Cookie Settings button at the bottom of this page. Your preferences are stored in your browser’s local storage under the key sombuluka_consent. This data is not transmitted to us or to any third party.

For a full list of cookies by category, see our Cookie Policy.

8. How We Use Your Information

We use personal information submitted through the website for the following purposes:

  • To respond to your enquiry or consultation request
  • To understand the nature of the service you are seeking
  • To contact you using the method you indicated
  • To assess whether and how we can assist your business
  • To comply with applicable legal and regulatory obligations

We do not use your information for marketing purposes unless you separately give us clear permission to do so. Submitting a contact or consultation form does not enrol you in any mailing list.

We do not sell, rent or trade your personal information to any third party.

9. Lawful Basis for Processing

Under POPIA, we process personal information on the following grounds:

  • Consent: you give your consent when you tick the privacy checkbox and submit a form. You may withdraw consent at any time by contacting us (see section 22), though this does not affect lawfulness of processing before withdrawal.
  • Legitimate interest: responding to a business enquiry and maintaining the security of our website are legitimate interests that do not override your rights under POPIA.
  • Legal obligation: we may be required to retain or disclose information where required by South African law.

10. How Long We Keep Your Information

Form submission data is transmitted to us by email and is not retained on the website server after transmission. Retention of the email itself is subject to our internal email management practices and any applicable legal or professional obligations.

PHP session data (containing only a timestamp) is cleared automatically when your browser session ends or when the session expires server-side.

Server logs are held in accordance with our hosting provider’s standard log rotation policy.

Your cookie preference record (stored in your browser’s local storage) is held until you clear it via Cookie Settings or clear your browser data.

11. Third-Party Service Providers

The following third-party services are used on or by this website. Each processes data subject to its own privacy terms.

  • Cloudflare, Inc. (United States): Cloudflare Turnstile is used for bot-prevention verification on forms. Cloudflare processes technical signals from your browser when you complete a form. No personal identifiers are shared with Cloudflare beyond what is technically required for verification.
  • Google LLC (United States): Three Google services are in use: (a) Google Places API, called server-side to retrieve business review data for the homepage, and your browser does not contact Google for this purpose; (b) Google Maps, a browser-loaded embed on the Contact page, only loaded after you give functional cookie consent; (c) Google Analytics 4, loaded in your browser only after you give analytics cookie consent, used to understand website usage patterns. See sections 14 and 15, and the Analytics subsection of section 7 above.
  • Web hosting provider: our cPanel shared hosting provider stores the website files and processes server logs. Details of the provider’s data processing arrangements are available on request.

We do not use advertising networks, social login services or payment processors on this website.

12. International Transfers

Cloudflare and Google are United States-based companies. Their services involve the transfer of some technical data outside South Africa. Both companies participate in international data transfer mechanisms and publish their own privacy policies and data processing terms. We encourage you to review these if you have concerns about cross-border data flows.

Form submissions are transmitted via our SMTP email server hosted at mail.sombuluka.com. The location of the hosting provider’s data centre may be confirmed on request.

13. Cloudflare Turnstile

Our contact and consultation forms use Cloudflare Turnstile, a challenge-response service that helps us verify that forms are submitted by humans and not automated bots.

When you load a page containing a form, Cloudflare Turnstile runs a technical check in your browser. This may involve analysing browser signals (such as browser type, screen size and interaction patterns). Cloudflare processes this information on its servers and returns a verification token to our form. We do not receive or store any of the raw signals that Cloudflare analyses.

The Cloudflare Turnstile public site key (0x4AAAAAADn2YsOAwuo7tZ52) is embedded in the form HTML. The corresponding secret key is stored privately on our server and is never exposed in public files, browser code or responses.

Cloudflare’s privacy policy: cloudflare.com/privacypolicy/

14. Google Places API (Server-Side Only)

Our homepage displays business review information sourced from the Google Places API. This integration is handled entirely server-side: our PHP server requests review data from Google using an API key and caches the result for up to six hours. Your browser does not contact Google to retrieve review data, and no Google cookies or tracking scripts are set for this purpose.

The data returned is normalised (summarised and reformatted) before being sent to your browser. The raw Google API response is not exposed to visitors.

When this feature is active, our server’s outbound IP address is communicated to Google as part of the API request. No visitor IP addresses or identifying information are included in the request.

15. Google Maps Embed (Browser-Loaded)

The Contact page includes an embedded Google Maps map showing our office location. This embed is not loaded by default. It is gated behind your functional cookie consent.

If you choose to allow functional content, your browser loads an iframe from Google’s servers. At that point, Google’s own cookies and connection to their servers applies. Google may collect your IP address, browser information and location preferences.

You can always open the map directly in Google Maps without loading the embed on our website. A direct link is provided on the Contact page.

Google’s privacy policy: policies.google.com/privacy

16. Security

We take reasonable technical and organisational measures to protect personal information from unauthorised access, misuse and loss. These include:

  • HTTPS (TLS encryption) for all communications between your browser and our website
  • Storing private credentials (SMTP passwords, API keys) outside the publicly accessible website directory
  • Bot-prevention verification on all forms
  • Rate limiting on form submissions
  • No storage of form data in website databases or flat files

No method of electronic transmission or storage is completely secure. We cannot guarantee absolute security and do not make that warranty.

17. Your Rights Under POPIA

Under the Protection of Personal Information Act 4 of 2013, you have the right to:

  • Access: request confirmation of whether we hold your personal information and request a copy
  • Correction: request that inaccurate, incomplete or outdated information is corrected
  • Deletion: request that personal information is deleted where we are no longer lawfully entitled to retain it
  • Objection: object to the processing of your personal information where our legal basis is legitimate interest
  • Withdraw consent: withdraw previously given consent at any time (this does not affect lawfulness of processing carried out before withdrawal)
  • Complain: lodge a complaint with the South Africa Information Regulator (see section 23)

To exercise any of these rights, contact us using the details in section 22. We will respond within a reasonable time and in accordance with our obligations under POPIA.

18. Automated Decision-Making

We do not make any automated decisions about individuals based on personal information collected through this website. A human reviews every enquiry and consultation request received.

The form bot-prevention check (Cloudflare Turnstile) makes an automated assessment of whether a submission is from a human or a bot, but this is a technical security measure and does not constitute a decision with legal or significant effect on any individual.

19. Children’s Privacy

This website is not directed at children under the age of 18. We do not knowingly collect personal information from children. If you believe a child has submitted information through our website, please contact us and we will promptly delete it.

20. Links to Other Websites

This website contains links to external websites, including Google Maps, social media profiles (Facebook, Instagram, LinkedIn) and WhatsApp. These sites are operated by third parties and have their own privacy policies. We are not responsible for their content or practices, and this privacy notice does not cover them.

21. Changes to This Notice

We may update this privacy notice from time to time to reflect changes in how we operate the website or changes in legal requirements. The “Last updated” date at the top of this page shows when it was most recently revised. Material changes will be highlighted on the website where practicable.

Continued use of the website after any change is published does not constitute acceptance of the new notice. We encourage you to review this page periodically.

22. Contact Us

For any questions about this privacy notice, to request access to your information, or to request correction or deletion, please contact us:

23. How to Contact the Information Regulator

If you are not satisfied with how we have handled your personal information, you have the right to lodge a complaint with the South Africa Information Regulator.

You also have the right to seek judicial redress under POPIA.

24. Access to Records (PAIA)

The Promotion of Access to Information Act 2 of 2000 (PAIA) gives you the right to request access to records held by private bodies. A PAIA Manual will be made available in accordance with applicable legal requirements once finalised.

To request records in the meantime, contact the Information Officer at the details in section 22.

CallWhatsAppBook