Privacy policy

From this website, we collect only what you submit voluntarily: typically your name, work email, company and a free-text message. Standard server logs (IP address, user-agent, timestamp) are collected automatically for security and abuse prevention.

When you book a discovery call, you do so through an embedded scheduling form provided by HubSpot. That form asks for your first name, surname and email address, and lets you add other guests to the call if you wish; your chosen time is also captured. These details are submitted directly to HubSpot, which we use as our scheduling and customer-relationship tool, and we use them to arrange and hold the call and to follow up about your enquiry.

In the course of providing services to clients, we process personal information on their behalf as a data operator under POPIA and as a data processor under GDPR. The scope, purpose and lawful basis are governed by the Master Services Agreement and Data Processing Agreement we sign with each client.

We load Google Analytics and Google Ads conversion measurement only with your explicit consent. No cookies from these are set until you click “Accept cookies” on the cookie banner. You may withdraw consent at any time via the Cookie settings link in the website footer.

With your consent, we load:

• Google Analytics 4 (GA4): pages visited, session duration, referral source. IP addresses are anonymised.
• Google Ads conversion measurement: when you arrive from one of our Google ads and book a discovery call, a cookie lets us measure that the ad led to the booking. We use this only to measure ad performance — not for remarketing, audience building or cross-site tracking.

We use Google Consent Mode. Before you choose, and if you decline, no advertising or analytics cookies are set from Google; in that case Google receives only cookieless signals it may use to estimate conversions in aggregate, and nothing identifies you. Conversion data is shared with Google LLC, acting as our processor, for this measurement only.

Two embedded services on this site set their own cookies as soon as the relevant part of the page loads, independent of the cookie banner:

• Microsoft Clarity: session recordings and heatmaps to identify usability issues, via cookies such as _clck and _clsk. Clarity also sets a small number of Microsoft advertising-network identifier cookies (the MUID family, shared with Bing) as part of its own service. No personally identifiable information is stored by Clarity itself.
• HubSpot booking widget: the “book a discovery call” form embedded on this page is provided by HubSpot, at our own connect.touchbasepro.com meeting link. Loading it sets a small number of functional cookies, including Cloudflare bot-protection cookies on HubSpot’s and our booking domains, needed to display and secure the form. These are set by HubSpot and Cloudflare, not by us directly, and we do not read them ourselves.

• Consent: analytics and advertising cookies. Withdrawable at any time.
• Legitimate interests: security logs; responding to enquiries; business improvement.
• Contract performance: delivering services to clients under signed agreements.
• Legal obligation: compliance with applicable law and regulatory requirements.

To respond to enquiries, deliver contracted services, fulfil legal obligations, and improve our operations. We do not sell, rent or trade personal information to third parties under any circumstances.

We share personal information only with sub-processors required to operate our services (cloud hosting via Microsoft Azure; analytics via Google and Microsoft; scheduling and customer-relationship management via HubSpot, Inc. for discovery-call bookings; and — with your consent — Google Ads conversion measurement as described above) and with regulators or law enforcement where legally required. Beyond that conversion measurement, we do not share personal information for third-party marketing, and we do not build or share advertising audiences. A current sub-processor list is available on request.

When you book a discovery call, the details you give us in the HubSpot form (first name, surname, email address and any guests you add) are stored in our HubSpot CRM and kept until you ask us to delete them; we do not apply a fixed deletion date to this data. See “Your rights” below for how to ask us to access, correct or delete it.

Other website enquiry data is retained for 24 months from last contact. Client-engagement personal information is retained per the relevant DPA, typically for the duration of the engagement plus 12 months. Server logs are retained for 90 days. Analytics data follows GA4 and Clarity retention settings (13 months).

Depending on where you are based, you have the right to access, correct or delete personal information we hold about you, to object to or restrict processing, to data portability, and to lodge a complaint with the relevant supervisory authority.

• South Africa: rights under the Protection of Personal Information Act (POPIA). See our POPIA notice.
• UK / EU: rights under UK GDPR and EU GDPR (Arts. 15–22). See our GDPR notice.
• California, USA: rights under the CCPA and CPRA. See our California privacy notice.

To exercise any right, email [email protected].

Where personal information is transferred outside its country of origin (for example, to Google, Microsoft or HubSpot infrastructure in the US), we rely on Standard Contractual Clauses or UK International Data Transfer Agreements as approved by the relevant supervisory authority.

Material changes will be communicated by updating the effective date above and, where appropriate, notifying registered contacts directly.