Who is responsible for your information
Visit Citrusdal is operated by Telos Web Dev (Pty) Ltd ("we", "us"). We are the responsible party for personal information processed through this website.
Our Information Officer is Luan Matthee, who can be reached through the contact form. Mark your message for the Information Officer and it will be passed on.
What we collect
- Business listing information — names, addresses, phone numbers, coordinates and similar details about businesses in the Citrusdal area. Where a sole trader's personal contact details are included, these are treated as personal information.
- Information you send us through the form — if you use the form at /submit/ to add a business, correct a listing or ask about a website, we store what you type: your name, your business name, your email address, your phone number if you give one, and your message. We also store what the message is about, the country your request came from and your browser's user-agent string, which help us tell a real submission from an automated one. We do not store your IP address with the submission. It is kept in a database operated by our host, Cloudflare, and it is readable only by us.
- Events you send to the noticeboard — if you use the form at /whats-on/add/, we store the event's details, the poster if you add one, and the country your request came from. The event details and the poster are published on /whats-on/ and in the noticeboard's public calendar feed, including any "contact for the public" you choose to give. Your own name, email address and phone number are not published: they are kept so that we can ask you about the event, and they are readable only by us. We do not store your IP address with the event. If you send an event through a personal organiser link, we also record which link it came through.
- Information you email us — if you write to us directly, we hold whatever you choose to put in that message.
- Technical information — our host, Cloudflare, records standard request data such as your IP address, browser type, the page you asked for and the page you came from, in order to serve the site and protect it from abuse. We also use Cloudflare Web Analytics to see which pages are read and how fast they load. It is aggregated and cookieless: it does not follow you across other websites and does not build a profile of you.
- Our own page counter — each page you open sends us its address, which page of your visit it is (first, second, third), and the name of the website that linked you here, sent again with each page and tap of that visit so the figures can be grouped by it. When you tap a phone number, WhatsApp, email, a business's website or directions, we record which kind of tap it was, which business it was for and that website's domain name. With each of these we store the country your request came from, whether you are on a phone, tablet or computer, and the day and hour. When you leave a page we also record how long it was on your screen, how far down it you scrolled, and which page of this site you opened next, if any. We use this to see which pages are useful and to show the businesses listed here how many people we send them. We do not store your IP address, set a cookie, give you an identifier or keep a record of a whole visit: each page reports only about itself and the next page opened, so none of it can be traced back to you. If your browser sends a Global Privacy Control or Do Not Track signal, nothing is counted at all.
- Noticeboard counts — on the noticeboard (and its box on the homepage) we count, for each event, how many times it was shown on screen, opened, added to a calendar, shared, or used for directions, and how many times its link or contact details were tapped. We also count how often calendar apps fetch the noticeboard's calendar feed, recording only which kind of app it was (Google, Apple, Microsoft or other). These are daily totals per event: no individual visit, device or person is recorded, and nothing links one count to another. We use them to show organisers how many people their event reached. The same Global Privacy Control, Do Not Track and opt-out rules apply.
We set no cookies on the public site. The page counter keeps a running number of pages and taps in your browser's session storage, which is deleted when you close the tab, and the hiking checklist remembers the routes you tick in your browser's local storage; neither is ever sent to us except as the page number described above. If you open a personal organiser link for the noticeboard, your browser remembers that link in local storage so that you do not need to keep it; the "Not you?" button on the form removes it. The one exception to "no cookies" is the private admin area, which sets a single strictly-necessary session cookie so that the site's operators can stay signed in; it is never set for ordinary visitors. We run no advertising, no remarketing and no cross-site tracking, and there is no newsletter or mailing list.
Why we process it, and our lawful basis
- To operate and improve the guide and its listings (our legitimate interest).
- To respond to your enquiries and listing corrections (at your request).
- To publish the events you send to the noticeboard, and to contact you about them (at your request, and with your confirmation that you may share the event and its poster).
- To keep the site available and secure and to understand which pages are useful (our legitimate interest).
Who we share it with
We do not sell your personal information and we do not share it for advertising. The site depends on a short list of service providers:
- Cloudflare — hosting, content delivery, security and cookieless analytics
- unpkg — the mapping library used on our map page
- OpenStreetMap — the map tiles on our map page
- A notification service — when an event is sent to the noticeboard, a short alert with the event's name, date and place and the sender's name (not their email address or phone number) is sent to the site operators' phone so that it can be checked quickly
The typefaces and the animation libraries used to come from Google Fonts, Fontshare, cdnjs and unpkg. They are now served from this site itself, so your browser no longer contacts those providers and they no longer receive anything about you.
When your browser fetches a script or map tile from a provider above, that provider necessarily receives your IP address and browser details. Several of them process data outside South Africa; where they do, we take reasonable steps to ensure comparable protection as required by POPIA.
How long we keep it
We keep personal information only as long as necessary for the purposes above, or as required by law, after which it is deleted or de-identified. Form submissions are kept while we act on them and are deleted once they are no longer needed. Noticeboard events that we do not publish are deleted after 30 days, and published events are deleted, with their poster and your contact details, a year after the event has taken place. You can ask us to delete yours at any time using the contact details below.
Security
We take reasonable technical and organisational measures to protect personal information against loss, unauthorised access and misuse.
Your rights under POPIA
You have the right to ask what personal information we hold about you, to have it corrected or deleted, to object to its processing, and to withdraw consent. To exercise any of these, use the contact form and say what you would like us to do. We will respond to your request whether or not you give us your name.
If you believe we have not handled your information lawfully, you may lodge a complaint with the Information Regulator (South Africa): inforegulator.org.za, or email enquiries@inforegulator.org.za.
Changes
We may update this policy from time to time. The "last updated" date above reflects the current version.