Privacy Policy

The short version. We collect the details you give us when you enquire or become a client, plus basic technical logs from our host. We use it to reply to you, deliver the work, and invoice you. We do not sell your information, and we do not run advertising or tracking cookies on this site. You can ask us to show, correct or delete what we hold at any time.

1. Who is responsible
2. What we collect
3. Why we use it
4. Our legal grounds
5. Data inside systems we build
6. Payment information
7. Who we share it with
8. Sending data outside South Africa
9. Cookies and analytics
10. How long we keep it
11. How we protect it
12. Your rights
13. Changes to this policy
14. Contact us

1. Who is responsible

Blu Horizon Agency (Pty) Ltd (registration no. 2023/170496/07), based in Cape Town, South Africa, is the responsible party for the personal information described here, as that term is used in the Protection of Personal Information Act (POPIA).

Questions about privacy go to callem@bluhorizonagency.com.

2. What we collect

Information you give us

Your name, email address, phone number and company name when you book a call or email us.
What you tell us about your business during a discovery call or in messages, including our notes from that conversation.
Billing details needed to invoice you, such as company name, registration number and billing address.

Information collected automatically

Standard server logs kept by our website host: IP address, browser type, pages requested and timestamps. These are used to keep the site running and secure.

We do not ask for and do not want special categories of personal information — health data, ID numbers, religious or political views — unless a specific project requires it, in which case we agree that in writing first.

3. Why we use it

To reply to your enquiry and run the discovery process.
To prepare proposals and deliver the work you have bought.
To invoice you and keep accurate financial records.
To keep in touch about your project, and to send occasional follow-ups about our services. You can opt out of the latter at any time.
To meet legal obligations, such as tax and company record-keeping.

We do not sell your personal information to anyone.

4. Our legal grounds

We process personal information because you have consented, because it is necessary to perform a contract with you, because we have a legitimate business interest in running and improving our services, or because the law requires it.

5. Data inside systems we build

When we build and run a system for a client, that system may process personal information belonging to their customers — for example a lead who fills in an enquiry form.

In that situation the client is the responsible party and we act as an operator on their instructions. We use that information only to run the system, we do not use it for our own purposes, and we return or delete it when the engagement ends. Our clients remain responsible for having a lawful basis to collect it in the first place.

6. Payment information

Card payments are processed by Payfast, a licensed South African payment provider. Your card details go directly to them over an encrypted connection. We never see, handle or store your full card number or CVV. We receive only the payment result, the amount and a reference.

We share personal information only with service providers who help us run the business, and only as much as they need:

Payfast — payment processing.
Google Workspace — email, calendar and documents.
Vercel — website hosting.
Supabase — database hosting for systems we operate.
AI model providers such as Anthropic and OpenAI — where a system we run needs to process text to do its job. We do not allow your data to be used to train their public models.

We may also disclose information where the law requires it, or to establish or defend a legal claim.

8. Sending data outside South Africa

Some of the providers above store data outside South Africa. Where that happens, we rely on providers that offer a comparable level of protection through their own contractual and security commitments, as POPIA requires.

9. Cookies and analytics

This website does not use advertising, tracking or analytics cookies. We do not embed third-party trackers or social pixels. Our host keeps the standard server logs described in section 2 to deliver and protect the site.

If we add analytics later, we will update this page before it goes live.

10. How long we keep it

Enquiries that go nowhere: up to 24 months, then deleted.
Client records: for the length of the relationship.
Invoices and financial records: five years after the end of the tax year they relate to, as South African law requires.

11. How we protect it

We use encrypted connections, multi-factor authentication on our accounts, and least-privilege access — people and systems get only the access they need. No system is perfectly secure, but if a breach ever affects your personal information we will notify you and the Information Regulator as POPIA requires.

12. Your rights

Under POPIA you can ask us to:

Tell you what personal information we hold about you.
Correct anything that is wrong or incomplete.
Delete information we no longer have a lawful reason to keep.
Stop using your information for direct marketing.
Object to processing based on legitimate interest.

Email callem@bluhorizonagency.com and we will respond within 30 days. There is no charge for a reasonable request.

If you are not happy with how we handled it, you can complain to the Information Regulator (South Africa) via inforegulator.org.za.

13. Changes to this policy

We may update this policy. The current version always lives on this page with the date it was last updated. If a change materially affects you, we will tell you directly.

14. Contact us

Blu Horizon Agency (Pty) Ltd
Registration no. 2023/170496/07
Cape Town, South Africa
Email: callem@bluhorizonagency.com
Phone: +27 82 087 7440