// Privacy

Privacy Notice

Version 1 — published at thenativecreative.co.za/privacy.html. A plain-English notice under the Protection of Personal Information Act 4 of 2013 ("POPIA"). Every published version is frozen with a SHA-256 hash in our records system; this page is the faithful rendering of version 1.

Who we are

The Native Creative is a sole-proprietor creative studio run by Dillon Kay, trading at thenativecreative.co.za.

Under POPIA, the business that decides how your personal information is used is called the "responsible party". That's us. Our Information Officer is Dillon Kay — the person legally answerable for how your personal information is handled.

What we collect

We collect only what invoicing and honest business records need:

  • Contact details — your name, email address, and postal (billing) address.
  • Contact form — if you use the contact form on this website, we receive your name, email address and message. The form is delivered by a third-party form service whose only job is to pass your message to us.
  • Payment context — when a payment comes in, we record the payment's reference wording from our own bank records: for example, your name or an invoice number as it appears on the payment. We don't ask for your bank account details — payments show up on our own bank statement, and we record only that reference wording, the amount, and the date.
  • Invoice and payment records — quotes, invoices, credit notes, payment amounts and dates, and how payments match to invoices.
  • What we don't collect — no identity numbers, no biometric or health information, no data about you that billing doesn't need. If a future project ever made something like that necessary, we'd tell you before we collected it.

Giving us your contact details is voluntary in the sense that you choose to work with us — but we can't quote or invoice you without them.

Why we use it — and the legal basis

We use your information for exactly one purpose: running our client billing. Quoting your projects, issuing invoices and credit notes, recording and matching payments, and keeping the business records the law requires us to keep.

The legal basis under POPIA is performance of a contract — section 11(1)(b): we may process personal information when it is "necessary to carry out actions for the conclusion or performance of a contract to which the data subject is party". In plain words: you hire us, we invoice you, we keep the paperwork.

Where your information lives

  • Your records live in our own records system ("finance-ops") on our own computer, in South Africa — not on advertising platforms, marketing tools, or overseas servers. Access to the records system is limited to the operator of the business.
  • Every record carries a hash — a digital fingerprint. If the record were ever changed, the fingerprint would stop matching and the tampering would be obvious.
  • Records are write-once: once an invoice is issued, it is locked. Mistakes are corrected by credit notes or a clearly linked re-issue — never by quietly editing history. Who read what is also logged.
  • Who sees your information: you, us, and the banks/payment system when a payment moves. Where the law requires, tax records may have to be shown to SARS. We don't share your information with anyone else for their own purposes.

How long we keep it

POPIA says records shouldn't be kept longer than necessary — except where the law requires keeping them (POPIA s14(1)(a)). We keep records in three classes:

  • TAX_5Y — tax and billing records. Invoices, credit notes, payment records, and the bank evidence behind them. South African tax law (the Tax Administration Act 28 of 2011, s29) requires records to be kept for 5 years from the date of submitting the relevant tax return — or, if no return is due, 5 years from the end of the tax period. We honestly cannot delete these on request before that hold lapses: the law makes us keep them.
  • CONTRACT — the agreement itself. Quotes, accepted agreements, and issued invoices: kept for the life of the business relationship, and at least as long as the law requires.
  • EVIDENCE — the audit trail. The tamper-evident records (hash chains, access logs) that prove our books haven't been altered: kept as long as needed to prove integrity, and at least as long as any tax hold that covers them.

Your rights

POPIA gives you, as the person the information is about, real rights over it:

  • Access (POPIA s23) — ask whether we hold personal information about you, and get the record itself or a description of it — including which third parties have had access to it.
  • Correction and deletion (POPIA s24) — ask us to fix information that is inaccurate, irrelevant, out of date, incomplete or misleading, or to delete or destroy it. We act as soon as reasonably practicable. The honest caveat: where the record is a tax record, it must stay for the 5-year hold described above — retention required by law is exactly the exception POPIA s14(1)(a) allows.
  • How requests are handled (POPIA s25) — access requests follow the procedure of the Promotion of Access to Information Act (PAIA), which requires a response within 30 days of the request, extendable in defined circumstances.
  • Complain — if you're unhappy with how we handled your information or your request, you can complain to the Information Regulator of South Africa: lodge a complaint (POPIA form 5, on inforegulator.org.za) to POPIAComplaints@inforegulator.org.za, or reach the Regulator at enquiries@inforegulator.org.za / 010 023 5200 (toll-free 0800 017 160) — https://inforegulator.org.za

How to use your rights

Email mrdillonkay@gmail.com with:

  • who you are (enough for us to verify your identity),
  • what information it's about,
  • what you want (a copy, a correction, or deletion).

Normal requests are free. A reasonable fee is allowed by law only in unusual cases (like bulk requests) — we'd tell you first, before doing anything. If we can't do what you asked, we'll reply in writing and explain exactly why — for example, a tax record held for the 5-year statutory period.

No marketing lists, no ad-tech, no selling of your data

  • No marketing lists. Your details are never added to a newsletter, a promotional list, or a "customers who might also like…" list. If you receive an email from us, it's about your project, your quote, or your invoice.
  • No ad-tech. No advertising cookies, no trackers, no profiling, and your billing records are never fed into any advertising or analytics platform.
  • No selling. We don't sell, rent, or trade personal information — not to partners, not "anonymised", not ever. There is no version of this where your data is a product.

If any of this ever changed, this notice would change first, and you'd be told before it happened.

Changes to this notice

Every published version of this notice is locked with a hash and a timestamp, and versions are listed openly. If we change something material — what we collect, why, or how long we keep it — the new version is announced before it takes effect.

Sources

  • POPIA (Protection of Personal Information Act 4 of 2013): official text on gov.za — https://www.gov.za/sites/default/files/gcis_document/201409/3706726-11act4of2013protectionofpersonalinforcorrect.pdf (retrieved 2026-09-27)
  • Record-keeping under the Tax Administration Act 28 of 2011, s29 — SARS External Policy GEN-GEN-23-POL02, "Manage taxpayer record retention authorisation" — https://www.sars.gov.za/wp-content/uploads/Ops/Policies/GEN-GEN-23-POL02-Manage-taxpayer-record-retention-authorisation-External-Policy.pdf (retrieved 2026-09-27)
  • Information Regulator of South Africa — contact page, https://inforegulator.org.za/contact-us/ (retrieved 2026-09-27)