Privacy Policy

Last updated: 27 October 2026

This policy explains how CHOOSE GoDiRECT / CybrDNA collects, uses, shares and protects personal information, as required by the Protection of Personal Information Act 4 of 2013 (POPIA).

1. Who we are

Detail
Responsible party	GoDiRECT

Our Information Officer is registered with the Information Regulator and is responsible for making sure we comply with POPIA. Contact them about anything in this policy.

2. Who this policy covers

This policy applies to personal information about:

• our clients and their staff, and people who ask us for quotations;
• visitors to our website and people who contact us;
• our suppliers and business contacts.

It does not cover personal information that our clients collect on their own websites and mailboxes that we host. Each client is responsible for that information and needs their own privacy policy (see clause 11).

In this policy, “we”, “us” and “our” mean CHOOSE GoDiRECT / CybrDNA, and “you” means the person whose personal information we process. “Personal information” has the meaning given in POPIA and includes information about companies and other juristic persons.

3. Personal information we collect

Type	Examples
Identity and contact details	Name, company name, job title, e-mail address, telephone number, physical and postal address
Business and tax details	Company registration number, VAT number, ID number where needed for domain registration or credit checks
Account details	Usernames, account settings, services and plans you use, support requests
Billing details	Invoices, payments, proof of payment, bank details you give us for refunds
Domain registration details	Registrant name, organisation, contact details required by domain registries
Technical details	IP addresses, server and access logs, device and browser information, website and e-mail usage statistics
Communications	E-mails, messages, call notes and feedback you send us
Marketing preferences	Whether you want to receive news and offers from us

We do not knowingly collect special personal information (such as health, religion, race or biometric information) about you. Do not send it to us unless we ask for it.

4. How we collect it

• From you — when you ask for a quotation, accept our terms, sign up, pay, contact us or use our services.
• Automatically — our servers and website record technical details such as IP addresses and logs when you use our services or visit our website.
• From others — domain registries, our hosting Service Provider, payment providers, credit bureaus (only with your consent or as the law allows), and people who refer you to us.

5. Why we use it

We use personal information only for these purposes, each with a lawful basis under section 11 of POPIA:

Purpose	Lawful basis
Providing website hosting, e-mail, domain names and support	Needed to perform our contract with you
Registering and renewing domain names with registries	Needed to perform our contract; required by registry rules
Invoicing, collecting payment and keeping accounting records	Contract; legal obligation (tax and company laws)
Keeping our servers and your services secure, preventing spam, fraud and abuse	Our legitimate interest and yours
Responding to enquiries and complaints	Legitimate interest; contract
Telling you about service changes, maintenance and renewals	Contract
Sending news and offers about our own services	Your consent, or as an existing client for similar services (clause 8)
Meeting legal obligations and protecting our legal rights	Legal obligation; legitimate interest

We will not use your personal information for a new purpose that is not compatible with these purposes without telling you and, where needed, asking for your consent.

6. Who we share it with

We never sell your personal information. We share it only where needed for the purposes in clause 5:

• Our hosting Service Provider (currently xneelo (Pty) Ltd), which operates the servers your services run on.
• Domain registries and registrars, such as the ZA Central Registry for .za domains and international registries for .com and similar domains. Some registrant details may be published in public domain databases (WHOIS/RDAP), as the registry rules require.
• Payment providers and banks, to process payments and refunds.
• Our accountants, auditors, attorneys and debt collectors, who are bound by confidentiality.
• Software and e-mail service suppliers we use to run our business, such as accounting, CRM and e-mail delivery systems.
• Government bodies, regulators, courts and law enforcement, where the law requires it or to protect our legal rights.

Everyone who processes personal information for us (an “operator” under POPIA) must do so under a written agreement, only on our instructions, and with appropriate security measures.

6.1 Online payments through Paystack

When you choose Paystack, relevant contact, billing, order and transaction information is shared with Paystack South Africa (Pty) Ltd and its payment partners to process and verify your payment, prevent fraud, handle refunds and meet legal obligations. Payment details entered in Paystack checkout are handled by Paystack. GoDirect does not store your full card number or card security code (CVV); we retain transaction references and payment status for invoicing and support.

Paystack may process information outside South Africa as described in its South African Privacy & Cookie Policy. For questions about your GoDirect order or refund, contact info@godirect.co.za or +27 82 342 1511. For Paystack-specific processing and privacy rights, consult Paystack’s policy.

7. Transfers outside South Africa

Some of our suppliers (for example, international domain registries and cloud software providers) store information outside South Africa. We transfer personal information across borders only where section 72 of POPIA allows it, for example where the recipient is bound by laws, binding rules or an agreement that give protection substantially similar to POPIA, or where the transfer is needed to perform our contract with you.

8. Direct marketing

• We send electronic marketing (e-mail, SMS or WhatsApp) only to clients about our own similar services, or to people who have given us their consent.
• Every marketing message includes an easy way to unsubscribe, free of charge. You can also e-mail us at any time to opt out.
• Opting out of marketing does not stop service messages such as invoices, renewal notices and maintenance alerts, which we must send to provide your services.

9. Cookies and website analytics

• Our website uses cookies: small files stored on your device. Essential cookies make the website work (for example, keeping you signed in).
• With your consent, we also use analytics cookies [such as Google Analytics] to understand how visitors use our website. These collect information like pages visited and approximate location, not your name.
• You can refuse or delete cookies in our cookie banner or in your browser settings. Some parts of the website may not work without essential cookies.

10. How we protect it

We take reasonable technical and organisational measures to protect personal information against loss, damage and unauthorised access, as section 19 of POPIA requires. These include:

• encrypted connections (SSL/TLS) for our website, control panels and e-mail;
• firewalls, malware scanning and regular software updates on our systems;
• strong passwords and two-factor authentication on our staff accounts where available;
• access limited to staff and suppliers who need it, under confidentiality obligations;
• regular server backups through our Service Provider.

No system is completely secure. Please protect your own passwords and devices, and tell us immediately if you suspect your account has been misused.

11. Information on websites and mailboxes we host

• When we host a client’s website or e-mail, the client is the responsible party for the personal information stored there (for example, their customers’ details, contact-form submissions and e-mails). We act only as an operator that stores it on the client’s behalf.
• We process that information only to provide and secure the hosting service, or where the law requires. We do not use it for our own purposes.
• Clients must have their own privacy policy and must comply with POPIA for the information they collect.
• If someone asks us about personal information on a client’s website, we will refer them to that client.

12. Security breaches

If we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible, as section 22 of POPIA requires. If the breach affects information on a website or mailbox we host for a client, we will tell that client promptly so that they can meet their own obligations.

13. How long we keep it

We keep personal information only for as long as we need it for the purposes in clause 5, or as long as the law requires.

Information	How long we keep it
Client account, invoices and payment records	5 years after the account closes (tax and company law requirements)
Website files, databases and mailboxes we host	Deleted 30 days after the service ends, as set out in our hosting terms
Support requests and correspondence	3 years after the last contact
Server and security logs	Up to 12 months
Quotation requests that do not lead to a contract	12 months
Marketing list	Until you unsubscribe

After that, we delete or destroy the information, or de-identify it so that it can no longer identify you.

14. Your rights

Under POPIA you have the right to:

1. Know whether we hold personal information about you, and ask for a copy of it and a list of the third parties who have had access to it.
2. Correct or delete personal information that is inaccurate, out of date, incomplete, misleading or unlawfully obtained, or that we are no longer allowed to keep.
3. Object to us processing your personal information on the basis of legitimate interest, and to direct marketing at any time.
4. Withdraw consent where we rely on your consent. This does not affect processing that took place before you withdrew it.
5. Complain to the Information Regulator (clause 17).

To use these rights, e-mail our Information Officer. We may ask you to prove your identity first, to protect your information. We will respond within 30 days. Requests for copies of records are dealt with under the Promotion of Access to Information Act 2 of 2000 (PAIA) and our PAIA manual, available at [link], and a prescribed fee may apply.

We may not be able to delete information we must keep by law (for example, invoices), or while your services are active.

15. Children

Our services are meant for businesses and adults. We do not knowingly collect personal information about children under 18. If you believe we have done so, contact us and we will delete it.

16. Changes to this policy

We may update this policy from time to time. The latest version is always on our website, with the date it was last updated. If we make important changes, we will tell our clients by e-mail.

17. Contact and complaints

• Questions or requests: our Information Officer at [privacy@…] or [telephone].
• Complaints: please contact us first so that we can try to resolve your concern. We will reply within 10 business days.
• The Information Regulator: if you are not satisfied, you may lodge a complaint with the Information Regulator of South Africa. Website: inforegulator.org.za · E-mail: enquiries@inforegulator.org.za. Complaint forms (Form 5) are on the Regulator’s POPIA forms page.