Privacy policy.
Plain language, as the law intends. This policy covers the Handy Services group — this website, Web Slabs Design (webslabs.handyservices.co.za), SafeStop (safestop.handyservices.co.za) and Workshop Slabs OS — and explains everything POPIA requires us to tell you. Last updated 17 October 2026.
The 30-second version: we collect only what a project needs, we don't sell or share it, we don't run ad trackers, it stays on South African soil under our control, and you can ask us to show, fix or delete it any time at privacy@handyservices.co.za.
1 · Who is responsible
The responsible party under POPIA is Handy Services (registration in progress as the group holding entity), trading with its divisions Web Slabs Design and SafeStop, Centurion, Gauteng, South Africa. Privacy contact: privacy@handyservices.co.za. We are not yet required to register an Information Officer with the Regulator; when we are, their details will appear here.
2 · What we collect, and why
| Information | Examples | Why (lawful purpose) |
|---|---|---|
| Project briefs | Name, company, email, phone, project description, budget | To quote and deliver the service you asked for (contractual) |
| Client records | Contact details, address, correspondence | Managing our working relationship and delivering documents (contractual) |
| Financial records | Quotes, invoices, payments | Accounting and tax — we're required by law to keep these (legal obligation) |
| Technical data | One session cookie for form security; your consent choices | Site security and honouring your cookie choice (see the cookie policy) |
| Waitlist signups | Contact details for the Workshop Slabs OS beta | Notifying you about the product you asked to hear about (consent) |
We do not knowingly collect children's personal information, and the sites are not directed at children. We do not collect special personal information (health, religion, biometrics) through these sites.
3 · Who gets to see it
Short answer: nobody outside the group unless the law or your project requires it.
Inside the group: the owner and authorised staff of the back-office you submitted to. Briefs submitted on the Web Slabs site live in that site's own database; group oversight is exercised through the Combined Ops console, both under your consent to be contacted.
Processors we necessarily use: our hosting/email provider (data hosted on South African servers; email transport), and payment providers if an invoice carries a hosted payment link (you'd deal with them directly; we pass only what the link needs). We have no advertising pixels, no social trackers, no analytics sharing — the sites make zero third-party requests, fonts included.
No cross-border transfers: site data, email and records stay in South Africa. If that ever changes, this policy changes first and you'll be told.
No sales, ever: personal information is never sold, rented or traded.
4 · Security safeguards
The back-ends are engineered, not just promised: credentials and configuration live above the web root (unreachable by URL), admin logins are hidden behind secret keys and protected by brute-force lockouts, two-factor authentication is supported, every administrative action is written to an audit trail, and all traffic runs over HTTPS. Access to client data is limited to people who need it to do the work.
5 · How long we keep it
POPIA says no longer than necessary, so:
- Briefs that never became clients: 24 months from last activity, then deleted or anonymised.
- Client and financial records: 5 years, because tax law requires it.
- Cookies and consent records: 12 months, then re-requested.
- Waitlist entries: until the product launches or you ask us to remove you, whichever first.
6 · Your rights, and how to use them
POPIA gives you the rights to be notified, access your data, correct it, delete it (destroy or de-identify), object to processing, withdraw consent, complain to the Regulator, and not be subject to purely automated decisions. To exercise any of them:
Email privacy@handyservices.co.za — say which right you're exercising (e.g. "access request").
We acknowledge within 2 working days and respond in full within 30 days as the Act requires. We may verify your identity first — that's for your protection, not ours. No fee is charged for a standard request.
If you're unhappy with our answer you may complain to the Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg — inforegulator.org.za.
7 · Breach notification
If a security compromise ever puts your information at risk, we will notify you and the Information Regulator as soon as reasonably possible, in line with POPIA section 22, telling you what happened and what to do about it.
8 · Division-specific notes
Web Slabs Design (webslabs.handyservices.co.za) processes briefs and estimates in its own database under this same policy. SafeStop (safestop.handyservices.co.za) is a separately operated product with its own privacy policy — it works to the same standards, but processes its own data independently. Workshop Slabs OS is in development; its waitlist is handled under this policy.
9 · Changes to this policy
Material changes will be announced on this page with a new "last updated" date. If a change affects how we use information we already hold about you, we'll tell you before it takes effect.
This policy is provided for transparency and to meet POPIA's conditions for lawful processing. It is not legal advice; where the Act and this page ever disagree, the Act wins.