Privacy Policy

**Last Updated: May 2026**

## 1. INTRODUCTION, SCOPE, AND PROTECTION OF JURISTIC PERSONS
WaveBit ("we", "us", "our") is a custom web engineering and software solutions provider operating in the Republic of South Africa. We are committed to protecting the constitutional right to privacy and safeguarding the personal information of all individuals and organizations that interact with our digital infrastructure.

In strict compliance with the Protection of Personal Information Act, No. 4 of 2013 ("POPIA"), this Privacy Policy outlines how we collect, process, store, and secure personal information. 

Crucially, in accordance with Section 1 of POPIA, our commitment to privacy extends to both:
*   **Natural Persons:** Identifiable, living individual human beings.
*   **Juristic Persons:** Existing, identifiable legal entities, including but not limited to registered companies, close corporations, partnerships, trusts, and non-profit organizations.

By accessing our website ([wavebit.dev](https://wavebit.dev)), submitting inquiries, or utilizing our active developer APIs (maps, cities, currencies, holidays, and localization), you acknowledge the data processing practices described in this policy.

## 2. ACCOUNTABILITY AND APPOINTED INFORMATION OFFICER
Under Condition 1 (Accountability) of POPIA, WaveBit retains ultimate responsibility for ensuring that all processing of personal information complies with the eight conditions for lawful processing.

We have appointed a dedicated Information Officer to oversee our data protection program, handle data subject participation requests, and maintain compliance. Our Information Officer is formally registered with the South African Information Regulator as legally mandated.

For any privacy-related inquiries, access requests, or compliance concerns, you may contact our Information Officer directly at:
**Email:** info@wavebit.dev
**Subject Line:** POPIA Compliance / Information Officer

## 3. THE EIGHT CONDITIONS FOR LAWFUL PROCESSING
We ensure that all data operations on our platform strictly adhere to the eight core conditions prescribed by POPIA:
*   **Condition 1: Accountability** (We take responsibility for compliance).
*   **Condition 2: Processing Limitation** (Data is processed lawfully, minimally, and with consent/justification).
*   **Condition 3: Purpose Specification** (Data is collected for explicit, defined, and lawful business functions).
*   **Condition 4: Further Processing Limitation** (Further processing must align with the original purpose of collection).
*   **Condition 5: Information Quality** (We take steps to ensure data is accurate, complete, and updated).
*   **Condition 6: Openness** (We maintain transparency regarding our processing activities).
*   **Condition 7: Security Safeguards** (We enforce technical and organizational measures to prevent breach/unauthorized access).
*   **Condition 8: Data Subject Participation** (We respect and facilitate your rights to access, correct, or delete data).

## 4. CATEGORIES OF DATA WE PROCESS AND PURPOSE SPECIFICATION
We restrict our collection of personal information to the minimum data required to execute our professional operations and secure our application infrastructure.

**A. Business Inquiries and Communications (Personal Information)**
When you communicate with us via our web contact form, we collect:
*   **Identifying Information:** Your full name, and where applicable, your business/entity name (juristic person data).
*   **Contact Information:** Your email address, and optionally, corporate contact details.
*   **Inquiry Context:** The text content of your message, project brief, or requested service details.
*   **Verification Metadata:** Cloudflare Turnstile token response metrics (processed transiently in-memory to confirm human identity and block malicious automated spam).

**Purpose:** This information is processed strictly to respond to your service requests, draft technical specifications, negotiate development agreements, and deliver contracted work.

**B. System Telemetry and API Auditing Metrics (Non-Personal Metadata)**
We collect and analyze infrastructure metrics to monitor network performance, prevent abuse, and compute API billing. This data includes:
*   API Key Identification Codes (`wb_...`)
*   Numeric request volume metrics (Total Requests, hourly counts, daily request totals)
*   Timestamp metadata associated with requests (stored in UTC)
*   Standard system response latency logs

**Purpose & Legal Status:** These metrics do not contain personal identifiers, raw IP addresses, or end-user geolocation profiles. Under POPIA, this information does not constitute personal information as it is entirely aggregated and anonymized. We retain these system logs indefinitely for performance audits, infrastructure scaling, and billing reconciliations.

**C. Transient Security and Fraud Mitigation Data**
Our server firewall and security middleware process client IP addresses transiently in active memory to enforce global rate limits (such as preventing brute force login attacks and DDoS attempts on our APIs).

**Purpose & Retention:** This processing is justified under Section 11(1)(f) of POPIA to protect our legitimate interests in ensuring the security and operational continuity of our services. These raw IP addresses are held strictly in temporary server memory and are never written to our database tables.

## 5. CONSEQUENCES OF REFUSING TO PROVIDE PERSONAL INFORMATION
In terms of Section 18(1)(h) of POPIA, we are required to inform you of the consequences of withholding requested personal information:
*   While your visit to our general web pages is entirely anonymous, you must provide your name, email address, and a descriptive message to utilize our contact form or request a quote.
*   If you choose to withhold this necessary communication data, we will be unable to process your online inquiry, provide development estimates, or enter into a service contract with you.
*   If a client refuses to provide valid billing information or regulatory business registration details, we cannot generate legally compliant tax invoices, issue API credentials, or fulfill our contractual development obligations.

## 6. TRANSBORDER DATA TRANSFERS (POPIA SECTION 72)
Our infrastructure operates within secure cloud and host environments. In the course of executing our services, your personal information may occasionally be transferred outside the borders of the Republic of South Africa to international servers. 

Specifically, we utilize Resend Inc. as our email delivery operator, whose servers and relay systems are located in the United States. 

In terms of Section 72 of POPIA, we ensure that all transborder data flows are conducted in compliance with at least one of the following conditions:
*   The recipient operator is subject to a law, binding corporate rules, or a binding agreement that provides a level of protection substantially similar to the principles of POPIA, including provisions that prevent further unauthorized transfer of that data.
*   The transfer is absolutely necessary for the performance of a contract between you and WaveBit, or to implement pre-contractual measures in response to your request.
*   You have explicitly consented to the transfer of your information across international borders to facilitate secure communication.

## 7. THIRD-PARTY OPERATORS (POPIA SECTION 20)
To deliver optimal service, we leverage specialized third-party cloud platforms. Under POPIA, these service providers act as "Operators" processing data on our behalf. 

We require our Operators to implement industry-standard security safeguards. Because they maintain their own compliance frameworks, we strongly encourage you to review their respective privacy agreements:

*   **Resend Inc.** (Email delivery relay platform): Utilized to route your contact form submissions to our operational email inbox (info@wavebit.dev). [View Privacy Policy](https://resend.com/privacy)
*   **Radar Labs, Inc.** (Mapping and Location Intelligence API): Powers our geocoding and suggestion endpoints. No personal names or account identifiers are passed to Radar—only raw coordinates or plain-text queries. [View Privacy Policy](https://radar.com/privacy)
*   **Cloudflare, Inc.** (Form protection and DDoS mitigation): Deploys transient browser verification to protect our server entrypoints from malicious bots. [View Privacy Policy](https://www.cloudflare.com/privacypolicy/)

## 8. SECURITY SAFEGUARDS AND INFORMATION QUALITY
In accordance with Section 19 of POPIA, we maintain appropriate, reasonable technical and organizational measures to protect personal information against loss, unlawful destruction, unauthorized access, or modification. 
*   **Network Security:** All web traffic and API routes are strictly protected by TLS (HTTPS) encryption.
*   **Data Minimization:** We do not store raw transaction payloads, end-user coordinate requests, or private user credentials in our database.
*   **Database Encryption:** Our database engines are hosted on secure, firewalled server operating systems with access restricted to verified system processes.
*   **Information Quality:** Under Section 16 of POPIA, we take reasonable steps to ensure that personal information is kept complete, accurate, and up-to-date. If you believe your registered contact details are inaccurate, please notify our Information Officer.

## 9. DATA RETENTION, DESTRUCTION, AND ANONYMIZATION
Personal information will not be kept in an active state longer than is necessary to achieve the business purposes for which it was originally collected.
*   **Inquiry Data:** Personal information processed through our web forms is retained for a maximum of two (2) years from the date of the last active communication or resolution of the inquiry (whichever is later). After this period, the data is permanently destroyed, securely shredded from our email systems, or completely anonymized.
*   **Contractual Data:** Information associated with signed service agreements or subscription accounts is retained for a minimum of five (5) years to comply with statutory South African tax, accounting, and corporate record-keeping laws.
*   **Anonymized System Data:** General API telemetry and request statistics are entirely detached from personal identifiers. As this data does not contain personal information, it is retained indefinitely for long-term historical analysis.

## 10. YOUR RIGHTS AS A DATA SUBJECT
Under Section 5 of POPIA, you have the following rights regarding your personal information, which we respect and facilitate:
*   **Right to Access:** You may request that we confirm whether we hold your personal information, and request a detailed copy of that record.
*   **Right to Rectification:** You may request that we update, correct, or complete any inaccurate, irrelevant, or misleading personal information.
*   **Right to Deletion (Object to Processing):** You may request that we delete or destroy your personal information where we are no longer legally authorized or required to retain it.
*   **Right to Object to Direct Marketing:** You have the right to object at any time to the processing of your personal information for direct marketing purposes (we do not engage in unsolicited marketing).

To submit a formal request regarding these rights, please contact our Information Officer at info@wavebit.dev. We may require proof of identity before completing your request to prevent unauthorized data disclosure.

## 11. RIGHT TO LODGE A COMPLAINT WITH THE REGULATOR
If you believe that WaveBit has processed your personal information in a manner that violates POPIA, you have the right to lodge a formal complaint with the South African Information Regulator:
*   **Physical Address:** JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
*   **Postal Address:** P.O. Box 31533, Braamfontein, Johannesburg, 2017
*   **General Inquiries:** enquiries@inforegulator.org.za
*   **POPIA Complaints:** POPIAComplaints@inforegulator.org.za
*   **Website:** [inforegulator.org.za](https://inforegulator.org.za/)

## 12. CHANGES TO THIS PRIVACY POLICY
We review and update this Privacy Policy periodically to maintain alignment with legislative changes, regulatory directives, and security standards. Any revisions will be published directly to this page, and the "Last Updated" date at the top of the policy will be modified.

Return Home