Your privacy matters to us. This privacy policy explains what personal information Adriel Corp collects when you visit our website, contact us, buy a service package from our shop or work with us on a project, why we collect it, who we share it with, and the rights you have over it.
Last updated: 14 October 2026
Adriel Corp is a software development house based in South Africa. We process personal information in line with the Protection of Personal Information Act 4 of 2013 (“POPIA”). Where they apply, we also respect the rights of visitors from the European Union and the United Kingdom under the General Data Protection Regulation (“GDPR” and “UK GDPR”), and of California residents under the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”). This policy should be read together with our Cookie Policy and our Terms & Conditions.
1. Who we are and what this policy covers
For the purposes of POPIA, Adriel Corp is the “responsible party” (and, under the GDPR, the “controller”) for the personal information described in this policy. You can reach us at [email protected]. Our physical address is available on request by email.
This policy applies to:
- visitors to our website and readers of our blog;
- people who contact us through our contact form, by email or on social media;
- customers who place orders in our online shop;
- clients, and the representatives of clients, with whom we discuss, quote for or carry out projects; and
- people who send us job applications or enquiries through our careers page.
It does not cover personal information that we process purely on behalf of a client inside the software we build or maintain for that client. That situation is explained in section 12.
2. The personal information we collect
2.1 Information you give us
- Contact form enquiries: your name, email address, phone number (optional), company name (optional), the service you are interested in, your budget range, your message, and a record that you ticked the consent checkbox.
- Shop orders: billing name, company name, billing address, email address and phone number, the package you ordered, order notes, and payment confirmation details. When you pay by EFT or direct bank transfer we receive the payment reference and the details that appear on your proof of payment or bank statement. We do not receive or store your full card details: if card or other online gateways are enabled, those payments are processed by the payment provider.
- Customer accounts: if you create an account in the shop, your username, email address, password (stored in hashed form by WordPress) and order history.
- Project engagements: the names, job titles, work email addresses and phone numbers of your team members, meeting notes, requirements, feedback, invoices and correspondence.
- Job applications: your CV, contact details, qualifications, work history and any other information you choose to send.
- Blog comments: if comments are open, your name, email address, optional website and the content of your comment.
2.2 Information collected automatically
- Server and security logs: our hosting provider and the Wordfence security plugin record technical information such as your IP address, browser type, the pages requested, the date and time of the request, and login attempts (successful and failed). This is used to keep the website secure and available.
- Cookies: WordPress, WooCommerce, Wordfence and our CookieYes consent tool place a small number of cookies, mainly to make the website and shop work, remember your consent choice and protect logged-in sessions. See our Cookie Policy for the full list.
We do not install third-party advertising trackers on the website. If we add an analytics tool in the future, it will only load after you have given consent through the cookie banner, and we will update this policy and the Cookie Policy before doing so.
2.3 Information from other sources
We may receive personal information from payment providers or our bank (confirmation that a payment was made), from the client organisation you work for (when it introduces you as a project contact), or from publicly available business sources such as company websites, when this is relevant to a business enquiry.
2.4 Special personal information
We do not ask for special personal information as defined in POPIA (for example, information about health, religious beliefs, race or ethnic origin, or criminal behaviour). Please do not include it in your messages or applications unless we specifically request it for a lawful reason.
3. Why we use your personal information
POPIA requires us to process personal information lawfully and only for specific, explicitly defined purposes. The table below sets out our main purposes and the legal grounds we rely on.
| Purpose | Examples | Legal ground |
|---|---|---|
| Responding to enquiries | Replying to contact form messages, preparing proposals and quotes | Your consent; steps taken at your request before entering into a contract |
| Processing shop orders | Confirming orders, issuing invoices, matching EFT payments, scheduling workshops and packages | Performance of a contract |
| Delivering projects | Communicating with your team, managing milestones, providing support | Performance of a contract; legitimate interests |
| Accounting and legal compliance | Keeping financial records, tax compliance, responding to lawful requests | Compliance with a legal obligation |
| Website security | Blocking malicious traffic, detecting brute-force login attempts, investigating incidents | Legitimate interests in protecting our systems and users |
| Recruitment | Assessing job applications and contacting candidates | Your consent; steps taken at your request |
| Marketing communications | Occasional updates about our services, only if you opted in or are an existing customer | Consent, or the existing-customer exception in section 69 of POPIA |
We will not use your personal information for a purpose that is incompatible with the purpose for which we collected it, unless you consent or the law permits it.
4. Direct marketing
We respect the rules on electronic direct marketing in section 69 of POPIA. We will only send you marketing emails if you have given your consent, or if you are an existing customer and the message relates to similar services we offer. Every marketing message will tell you how to opt out, and you can unsubscribe at any time by replying to the message or emailing [email protected]. Opting out of marketing does not affect service messages about an order or project you have with us.
5. Who we share your information with
We do not sell your personal information. We share it only where needed for the purposes above, and only with parties that are bound to protect it:
- Hosting provider: our website runs on WordPress and is hosted by a third-party hosting provider, which stores website data, form submissions, order records and server logs on our behalf.
- Payment providers and banks: to process and confirm payments. If additional payment gateways are enabled, they process your payment details under their own privacy policies.
- Email and productivity services: the services we use to send and receive email and to manage projects and documents.
- Professional advisers: such as accountants, auditors and lawyers, where necessary and under a duty of confidentiality.
- Subcontractors: where a project requires specialist support, under written confidentiality and data protection obligations.
- Authorities: where we are required by law, a court order or a regulator, or where disclosure is necessary to protect our rights or the safety of others.
- Business transfers: if Adriel Corp is involved in a merger, sale or restructuring, personal information may transfer to the successor, which will be bound by this policy.
Service providers who process personal information on our behalf act as “operators” under POPIA. We require them to keep it confidential, process it only on our instructions and apply appropriate security measures, as section 21 of POPIA requires.
6. Transfers outside South Africa
Some of our service providers, such as hosting, email or cloud services, may store or process information on servers outside South Africa. Under section 72 of POPIA we only transfer personal information across borders where the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection, where you have consented, or where the transfer is necessary to perform a contract with you or in your interest. Where the GDPR applies, we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses.
7. How long we keep your information
We keep personal information only for as long as we need it for the purpose for which it was collected, or as long as the law requires. As a general guide:
- contact form enquiries that do not lead to work are kept for up to 24 months, then deleted;
- order, invoice and payment records are kept for the periods required by South African tax and company law, which is generally five to seven years;
- project correspondence and records are kept for the duration of the engagement and for a reasonable period afterwards to support warranty, maintenance and legal claims;
- unsuccessful job applications are kept for up to 12 months unless you ask us to delete them sooner;
- security logs are kept for a limited period determined by our security tools and hosting provider, usually a matter of weeks or months.
When information is no longer needed, we delete it, destroy it or de-identify it so that it can no longer be linked to you.
8. How we protect your information
Section 19 of POPIA requires us to take appropriate, reasonable technical and organisational measures to protect personal information. Our measures include encrypted connections (HTTPS), the Wordfence firewall and login protection, the WP Hide & Security Enhancer hardening plugin, regular software updates, strong passwords and access controls limited to people who need the information, and confidentiality obligations for our team and subcontractors.
No system connected to the internet is completely secure. If we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible, as required by section 22 of POPIA, unless the law prevents us from doing so.
9. Your rights under POPIA
As a data subject you have the right to:
- be told that your personal information is being collected, and be told if it has been accessed by an unauthorised person;
- ask whether we hold personal information about you and request a copy of it (section 23);
- ask us to correct, update or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, or that we are no longer authorised to keep (section 24);
- object, on reasonable grounds, to the processing of your personal information where we rely on legitimate interests, and object at any time to direct marketing;
- withdraw your consent at any time, without affecting processing that took place before you withdrew it;
- not be subject to a decision based solely on automated processing that has legal consequences for you (we do not make such decisions); and
- lodge a complaint with the Information Regulator and institute civil proceedings.
9.1 How to exercise your rights
Email [email protected] with the subject line “Privacy request” and tell us what you would like us to do. We may need to verify your identity before acting on the request, to protect your information from being disclosed to the wrong person. We aim to respond within 30 days. Access requests may also be handled under the Promotion of Access to Information Act 2 of 2000 (PAIA), which allows a prescribed fee in some cases; we will tell you in advance if any fee applies. Our PAIA manual is available on request by email.
9.2 Complaints to the Information Regulator
We would appreciate the chance to resolve any concern first, but you are entitled to complain directly to the Information Regulator (South Africa). Its contact details are published on its official website, inforegulator.org.za.
10. Children
Our website and services are aimed at businesses and adults. We do not knowingly collect personal information from children under the age of 18. If you believe a child has provided us with personal information, please contact us and we will delete it.
11. Cookies
We use cookies that are necessary for the website and shop to function, together with security and preference cookies. Non-essential cookies are only set with your consent, which you can change at any time through the “Cookie Settings” link in the website footer. Full details, including names, purposes and durations, are in our Cookie Policy.
12. Personal information we process for our clients
When we build, test, migrate or maintain software for a client, we may have access to personal information held in that client’s systems, such as their customer or employee records. In that case the client is the responsible party (or controller) and Adriel Corp acts as an operator (or processor). We process that information only on the client’s documented instructions, keep it confidential, apply appropriate security measures and do not use it for our own purposes. Where possible we work with test or anonymised data. If you are a customer of one of our clients and want to exercise your rights, please contact that organisation directly; we will assist it in responding.
13. Additional information for visitors in the EU and UK
If you are located in the European Economic Area or the United Kingdom and the GDPR or UK GDPR applies to our processing of your personal information:
- our legal bases are those set out in section 3 (consent, contract, legal obligation and legitimate interests);
- you have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent at any time;
- international transfers are protected by the safeguards described in section 6; and
- you have the right to lodge a complaint with the data protection supervisory authority in the country where you live or work, or where an alleged infringement took place.
To exercise these rights, contact us using the details in section 17. We will respond within one month, which may be extended where the law allows.
14. Additional information for California residents
To the extent the CCPA/CPRA applies to us, California residents have the following rights:
- Right to know: the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties with whom we disclose it. In the past 12 months we have collected identifiers (name, email, phone, IP address), commercial information (orders), professional information (company and job title), internet activity (security logs) and, for job applicants, employment-related information, for the purposes described in section 3.
- Right to delete and right to correct personal information, subject to legal exceptions.
- Right to opt out of sale or sharing: we do not sell personal information and we do not share it for cross-context behavioural advertising. We do not knowingly sell or share the personal information of consumers under 16.
- Right to limit the use of sensitive personal information: we do not use sensitive personal information for purposes that would give rise to this right.
- Right to non-discrimination: we will not treat you differently for exercising your rights.
You or an authorised agent can submit a request by emailing [email protected]. We will verify your request by matching information you provide with information we hold. We treat Global Privacy Control signals as a request to opt out of sale or sharing, although we do not engage in either.
15. Links to other websites
Our website and blog contain links to third-party websites, such as technology documentation, our social media pages and the sources credited on our Image Credits page. We are not responsible for the privacy practices of those websites, and we encourage you to read their privacy policies. See also our Disclaimer.
16. Changes to this policy
We may update this privacy policy from time to time, for example when we add new features, change service providers or when the law changes. The “Last updated” date at the top of the page shows when it was last revised. If we make significant changes, we will take reasonable steps to bring them to your attention, such as a notice on the website or an email to customers.
17. Contact us
If you have any questions about this privacy policy, want to exercise your rights, or wish to contact our Information Officer, please email [email protected] with the subject line “Privacy request”. Our physical address is available on request by email. You can also reach us through our contact page.
Related policies: Cookie Policy · Terms & Conditions · Refund & Cancellation Policy · Disclaimer · DMCA & Copyright Policy