Privacy Notice

Last updated: 6 September 2026

This Privacy Notice explains how Epoxy Flooring Johannesburg processes your personal information under the Protection of Personal Information Act 4 of 2013 ("POPIA"). It mirrors the disclosures required by section 18 of POPIA.

1. Responsible Party

Epoxy Flooring Johannesburg, operated by Craig Sandeman.
Service-area business covering Johannesburg — no fixed premises.
Email: [email protected].

2. Information Officer

Information Officer: Craig Sandeman, registered with the Information Regulator of South Africa.
Email: [email protected]

3. What we collect

Name, phone number, email address and suburb when you request a quote.
Details of the epoxy flooring project you submit (project type, area, message).
If you call our line: caller ID, call recording, and AI-generated transcript of any voicemail.
Server logs (IP address hash, user agent, pages visited) for security and analytics.

Source: the data subject directly (you).

4. Purpose & lawful basis

Quote response & service delivery — performance of contract / steps to enter a contract at your request (POPIA s.11(1)(b)).
Preparing your quote — installation is carried out by our appointed installation contractor, working on our behalf, so we share your quote details with them to assess the floor and prepare your quote. This is necessary to respond to your enquiry and is disclosed on our quote form.
Direct marketing — only with separate, explicit opt-in. We don't send marketing SMS or emails unless you tick a clearly marked marketing checkbox AFTER your first interaction with us.

5. Operators & sub-processors

We share data only with the following operators, each bound by a written agreement under s.21 of POPIA:

Cloudflare, Inc. — DNS, CDN, Pages hosting, email routing.
Hostinger International Ltd — domain registrar.
Twilio, Inc. — call tracking, voicemail recording.
fal.ai — voicemail audio transcription (Whisper model).
Anthropic, PBC — voicemail field extraction (Claude model). The audio recording itself is not retained by Anthropic; only the text transcript.
Resend, Inc. — transactional email delivery.
Google LLC (Gmail) — owner's inbox for lead notifications.
LeadsManager (Vercel + Supabase) — internal CRM that aggregates leads across Craig's lead-gen sites.
Our appointed installation contractor — the applicator who carries out installations on our behalf. Your full quote details are shared with them so they can assess the floor and complete your project. They are bound to POPIA-compliant handling.

6. Cross-border transfer (s.72)

Some operators above (Cloudflare, Twilio, fal.ai, Anthropic, Resend, Google, Vercel) host data outside South Africa, primarily in the United States and European Union. Each operates under published Data Processing Agreements that incorporate the Standard Contractual Clauses. If you'd rather your details were not transferred outside South Africa, email [email protected] and say so before submitting a quote request (any call made once a phone line is live still passes through Twilio's South African point of presence for caller ID and recording).

7. Retention

Quote enquiries: 3 years from last contact.
Voicemail recordings: 90 days, then audio is deleted (transcripts retained 3 years).
Tax invoices: 5 years (SARS).
Server access logs: 90 days.
Marketing consent records: for as long as you remain opted in, plus 12 months.

8. Your rights

You have the right to:

Access your personal information (s.23).
Request correction or deletion (s.24).
Object to processing, including direct marketing (s.11(3), s.69(3)).
Withdraw consent at any time.
Data portability where technically feasible.
Lodge a complaint with the Information Regulator.

9. Direct marketing opt-out

Reply STOP to any SMS, click unsubscribe in any email, Email [email protected]. Opt-outs are effective within 5 business days.

10. Cookies and tracking

This site uses functional cookies only (session, anti-spam) plus minimal first-party click tracking (phone button taps) to measure ad effectiveness. We also use Google Analytics to understand how visitors use the site; it sets cookies and reports usage in aggregate, and we do not sell this data. No other third-party analytics (Meta Pixel / Hotjar) are loaded.

11. Security & breach notification

The site is served over HTTPS, the database is encrypted at rest, sessions use HttpOnly cookies, and access is audit-logged. If a security breach is reasonably believed to compromise your information, we will notify you and the Information Regulator under s.22.

12. Complaints to the Information Regulator

Information Regulator (South Africa)
Email: [email protected]
Tel: +27 10 023 5200
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

13. PAIA Manual

Our PAIA Manual is available on request from [email protected]. A R50 admin fee may apply for copies.

14. Changes to this notice

Material changes will be flagged in a banner on the site for 30 days before they take effect. The "Last updated" date at the top will always reflect the most recent revision.