Privacy Notice

Last updated: 12 June 2026

This Privacy Notice explains how Epoxy Flooring Cape Town processes your personal information under the Protection of Personal Information Act 4 of 2013 ("POPIA"). It mirrors the disclosures required by section 18 of POPIA.

1. Responsible Party

Epoxy Flooring Cape Town, operated by Craig Sandeman.
Unit 8 Brackenfell Centre, Old Paarl Road, Brackenfell, 7560.
Email: [email protected].

2. Information Officer

Information Officer: Craig Sandeman, registered with the Information Regulator of South Africa.
Email: [email protected]

3. What we collect

Name, phone number, email address and suburb when you request a quote.
Details of the epoxy flooring project you submit (project type, area, message).
If you call our line: caller ID, call recording, and AI-generated transcript of any voicemail.
Server logs (IP address hash, user agent, pages visited) for security and analytics.

Source: the data subject directly (you).

4. Purpose & lawful basis

Quote response & service delivery — performance of contract / steps to enter a contract at your request (POPIA s.11(1)(b)).
Preparing your quote — we share your quote details with our appointed epoxy flooring installation partner, a separate business, so they can assess the floor and prepare a quote. This is done with your consent (the consent checkbox on our quote form) and is necessary to respond to your enquiry.
Direct marketing — only with separate, explicit opt-in. We don't send marketing SMS or emails unless you tick a clearly marked marketing checkbox AFTER your first interaction with us.

5. Operators & sub-processors

We share data only with the following operators, each bound by a written agreement under s.21 of POPIA:

Cloudflare, Inc. — DNS, CDN, Pages hosting, email routing.
Hostinger International Ltd — domain registrar.
Twilio, Inc. — call tracking, voicemail recording.
fal.ai — voicemail audio transcription (Whisper model).
Anthropic, PBC — voicemail field extraction (Claude model). The audio recording itself is not retained by Anthropic; only the text transcript.
Resend, Inc. — transactional email delivery.
Google LLC (Gmail) — owner's inbox for lead notifications.
LeadsManager (Vercel + Supabase) — internal CRM that aggregates leads across Craig's lead-gen sites.
Our appointed epoxy flooring installation partner — a separate business. Your full quote details are released to them so they can assess the floor and quote your project. They are bound to POPIA-compliant handling.

6. Cross-border transfer (s.72)

Some operators above (Cloudflare, Twilio, fal.ai, Anthropic, Resend, Google, Vercel) host data outside South Africa, primarily in the United States and European Union. Each operates under published Data Processing Agreements that incorporate the Standard Contractual Clauses. If you'd rather your details were not transferred outside South Africa, call us instead at 021 802 2861 (the caller-ID and call recording still pass through Twilio's South African PoP).

7. Retention

Quote enquiries: 3 years from last contact.
Voicemail recordings: 90 days, then audio is deleted (transcripts retained 3 years).
Tax invoices: 5 years (SARS).
Server access logs: 90 days.
Marketing consent records: for as long as you remain opted in, plus 12 months.

8. Your rights

You have the right to:

Access your personal information (s.23).
Request correction or deletion (s.24).
Object to processing, including direct marketing (s.11(3), s.69(3)).
Withdraw consent at any time.
Data portability where technically feasible.
Lodge a complaint with the Information Regulator.

9. Direct marketing opt-out

Reply STOP to any SMS, click unsubscribe in any email, Email [email protected]. Opt-outs are effective within 5 business days.

10. Cookies and tracking

This site uses functional cookies only (session, anti-spam) plus minimal first-party click tracking (phone button taps) to measure ad effectiveness. No third-party analytics (GA4 / Meta Pixel / Hotjar) are currently loaded. If we add any tracking third party, a granular consent banner will appear above any analytics scripts firing.

11. Security & breach notification

The site is served over HTTPS, the database is encrypted at rest, sessions use HttpOnly cookies, and access is audit-logged. If a security breach is reasonably believed to compromise your information, we will notify you and the Information Regulator under s.22.

12. Complaints to the Information Regulator

Information Regulator (South Africa)
Email: [email protected]
Tel: +27 10 023 5200
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

13. PAIA Manual

Our PAIA Manual is available on request from [email protected]. A R50 admin fee may apply for copies.

14. Changes to this notice

Material changes will be flagged in a banner on the site for 30 days before they take effect. The "Last updated" date at the top will always reflect the most recent revision.