Privacy Policy
Last updated
This Privacy Policy explains how Built By Women (“we”, “us”, “our”) collects, uses, shares and protects information about you when you visit builtbywomen.org, contact us, or otherwise interact with our community. It also sets out the rights you have over your personal data and how to exercise them.
We have written this notice in plain language. If anything is unclear, please email privacy@builtbywomen.org and we will explain.
Who We Are
Built By Women is an unincorporated community led by Martin Kruger and based in South Africa. We are the data controller (under the EU General Data Protection Regulation, “GDPR”) and the responsible party (under South Africa’s Protection of Personal Information Act, “POPIA”) for the personal data we collect through this site.
You can reach us at:
- General contact: contact@builtbywomen.org
- Privacy enquiries and rights requests: privacy@builtbywomen.org
Which Laws Apply
We operate from South Africa, so POPIA always applies to us. Because we welcome members and clients from anywhere in the world — including the European Union and the United Kingdom — GDPR also applies to processing of personal data of data subjects in those territories under Article 3(2)(a) GDPR (offering services to data subjects in the Union).
This single policy is written to satisfy both regimes. Where the laws diverge we apply whichever standard is stricter.
EU Representative (GDPR Article 27)
We have not appointed an EU representative. We rely on the exemption in Article 27(2)(a) GDPR: our processing of EU personal data is occasional, does not include special categories of data on a large scale, and is unlikely to result in a risk to the rights and freedoms of natural persons. We keep this position under review and will appoint a representative if our processing profile changes. EU data subjects can always contact us directly at privacy@builtbywomen.org.
Data We Collect
We collect only the information we genuinely need to run the community and respond to you. The categories below cover everything.
Information you give us directly
- Contact form (
/contact): your name, email address, optional business or organisation, optional phone number, and the contents of your message. - Email correspondence: anything you choose to send to
contact@builtbywomen.orgorprivacy@builtbywomen.org. - Client engagements: if we agree to deliver work for you, we will collect whatever the engagement requires — typically billing details, project files and project-related correspondence — under a separate written agreement.
Information collected automatically
- Web-server access logs (handled by our hosting provider, Cloudflare): IP address, user-agent string, referring page, requested URL and timestamp. These are used to keep the site secure and reachable. We do not retain raw access logs ourselves.
- Privacy-respecting analytics (Plausible Analytics): aggregate page-view counts, country, browser family and referrer. Plausible does not set cookies, does not track you across sites, and does not collect personal data. See /cookies for the full breakdown.
Information from third-party platforms
- Discord: if you choose to join our Discord server, the data you share there is governed primarily by Discord’s own privacy policy. We see only what you post in our server and the profile information your Discord account exposes.
- Google Forms (contributor application): when you complete the contributor
form linked from
/join, the data you submit flows directly to Google. We receive a copy in our Google account. Google’s processing is governed by Google’s own privacy policy.
What we do not collect
We do not knowingly collect special-category data (race, religion, health, biometric, political opinions, sexual life, etc.). We do not use tracking pixels, behavioural-advertising identifiers, fingerprinting or session-replay tools. We do not buy data from data brokers.
Why We Use Your Data and Our Lawful Basis
| Purpose | Data | GDPR lawful basis | POPIA basis |
|---|---|---|---|
| Replying to your contact-form message or email | Name, email, message | Art. 6(1)(f) — legitimate interests | Section 11(1)(d) — legitimate interest |
| Delivering services we have agreed to perform | Engagement-specific data | Art. 6(1)(b) — performance of a contract | Section 11(1)(b) — performance |
| Operating and securing the website (server logs, abuse prevention) | IP, user-agent, timestamps | Art. 6(1)(f) — legitimate interests | Section 11(1)(d) — legitimate interest |
| Understanding aggregate site usage (privacy-respecting analytics only) | Page views, country, device family (no PII) | Art. 6(1)(f) — legitimate interests | Section 11(1)(d) — legitimate interest |
| Onboarding members through the contributor form on Google Forms | Name, email, free-text answers | Art. 6(1)(a) — consent (you submit voluntarily) | Section 11(1)(a) — consent |
| Complying with tax, accounting and other legal obligations | Engagement records | Art. 6(1)(c) — legal obligation | Section 11(1)(c) — legal obligation |
We do not rely on your consent for the contact form itself; we rely on legitimate interests. You can object to that processing at any time by emailing us — see “Your Rights” below.
Legitimate-interests summary (contact form)
We have considered the three-part test required for Article 6(1)(f). The purpose (replying to your enquiry) is legitimate; processing your message is necessary to achieve it; and the impact on you is minimal because you chose to contact us, you control what you share, and we do not use your details for anything else. We have documented this assessment in our internal records.
Who We Share Your Data With
We share personal data only with the small number of service providers we need to run the site, and only to the extent necessary for them to do their job. Each of them is contractually bound by a Data Processing Agreement (or equivalent) and may not use your data for their own purposes.
| Provider | Role | Country of processing | Transfer safeguard |
|---|---|---|---|
| Cloudflare, Inc. | Web hosting, content delivery, DDoS protection, server-log processing | Global edge (incl. EU & US) | EU Standard Contractual Clauses; UK Addendum |
| Resend (Resend Solutions, Inc.) | Transactional email delivery for contact-form messages | United States | EU Standard Contractual Clauses |
| Plausible Insights OÜ | Cookieless web analytics | European Union (Germany) | Within EU/EEA — no transfer safeguard required |
| Google LLC | Hosting the contributor application form (Google Forms) and storing responses | United States | EU Standard Contractual Clauses; Data Privacy Framework |
| Discord, Inc. | Hosting our community server (only if you choose to join) | United States | EU Standard Contractual Clauses; Data Privacy Framework |
A current list of sub-processors is maintained in our internal records and provided to clients on request.
We may also disclose personal data where required by law, to protect our rights, or to investigate or address a suspected breach of our Terms.
We never sell your personal data, and we do not use it for automated decision-making or profiling that produces legal or similarly significant effects about you.
International Transfers
Some of our service providers process personal data outside South Africa and outside the European Economic Area. Where that happens, we rely on the mechanisms listed in the table above:
- GDPR transfers outside the EEA rest on the European Commission’s Standard Contractual Clauses (2021/914), supplemented by a transfer-impact assessment where required, and on the EU–US Data Privacy Framework where applicable.
- POPIA transfers rely on the conditions in section 72 of POPIA — most often the contractual clauses agreed with the recipient providing a level of protection substantially similar to POPIA.
How Long We Keep Your Data
We keep personal data only for as long as we need it for the purpose we collected it.
| Data | Retention period |
|---|---|
| Contact-form messages held in our inbox | Up to 24 months from your last contact, then deleted |
| Client project records (contracts, invoices, etc.) | 7 years after end of engagement, to satisfy tax/accounting law |
| Web-server access logs (Cloudflare) | Up to 30 days, then automatically purged |
| Plausible analytics | Retained indefinitely as aggregated, anonymous statistics only |
| Discord activity | Retained per Discord’s own retention policy |
| Google Forms responses | Retained while the contributor pipeline is active, then deleted |
Our internal Retention Schedule explains how each retention period is enforced in practice.
Your Rights
Both POPIA and GDPR give you a strong set of rights over your personal data. We honour the broader of the two in every case.
- Access (Art. 15 GDPR / s. 23 POPIA) — request a copy of the personal data we hold about you.
- Rectification (Art. 16 / s. 24) — ask us to correct inaccurate or incomplete data.
- Erasure (Art. 17) — ask us to delete your personal data where we no longer have a lawful basis to hold it.
- Restriction of processing (Art. 18) — ask us to pause processing while we resolve an issue you’ve raised.
- Data portability (Art. 20) — receive a structured, machine-readable copy of data you provided to us, where processing is by automated means and based on consent or contract.
- Object to processing (Art. 21 / s. 11(3)) — object at any time to processing based on our legitimate interests, including for direct marketing.
- Not be subject to solely automated decisions (Art. 22) — we do not make any such decisions about you.
- Withdraw consent (Art. 7(3)) — where we rely on your consent, you can withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
- Lodge a complaint — see “Complaints” below.
To exercise any of these rights, email privacy@builtbywomen.org. Please include enough information to allow us to identify you and the data you’re asking about. We may need to verify your identity before responding. We will reply within one month (GDPR) or as soon as reasonably possible (POPIA); where the request is complex, we may extend that period by a further two months and will tell you why.
There is normally no charge for exercising these rights. We may charge a reasonable fee, or refuse to act, where a request is manifestly unfounded or excessive.
Complaints
If you believe we are mishandling your personal data, please tell us first so we have an opportunity to put it right.
You also have the right to lodge a complaint with a supervisory authority:
- In South Africa: the Information Regulator — inforegulator.org.za.
- In the European Union: the data-protection authority of the EU member state where you live, work, or believe the alleged infringement occurred. A list is maintained at edpb.europa.eu/about-edpb/about-edpb/members_en.
- In the United Kingdom: the Information Commissioner’s Office — ico.org.uk.
Children
The site is not directed to children under the age of 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please email us and we will delete it promptly.
Security
We use appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration and loss, including:
- HTTPS everywhere on this site.
- Encryption at rest with our sub-processors.
- Least-privilege access controls; secrets stored in our hosting provider’s secret manager and never committed to source control.
- Honeypot and basic spam protection on the contact form.
- Routine review of sub-processor security and DPA terms.
No system is perfectly secure, and we cannot guarantee the absolute security of information transmitted over the internet.
Personal-Data Breaches
If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware (as required by Article 33 GDPR), and we will notify affected individuals without undue delay where the breach is likely to result in a high risk (Article 34 GDPR / section 22 POPIA).
Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. For material changes we will take reasonable steps to notify you directly — for example, by email where we have your address on file.
Contact
Questions about this Privacy Policy or how we handle your data are welcome at any time at privacy@builtbywomen.org.