Privacy Policy

Velorax ("we", "us", "our") is committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, and protect the information you provide when you use our website at velorax.org and our services.

We comply with the Protection of Personal Information Act (POPIA) of South Africa and respect the data protection rights of all users, including those protected under the General Data Protection Regulation (GDPR) for users in the European Economic Area.

1. Information We Collect

Information you provide directly

When you use our contact form or engage with our services, we may collect:

• Full name
• Email address
• Company name (optional)
• Company website URL (optional)
• Monthly ad spend range (optional)
• Service interest selection
• Message content

Information collected automatically

When you visit our website, we may automatically collect:

• IP address (used for rate limiting and security; stored in our leads database)
• Browser type and user agent string (stored with form submissions)
• Pages visited and time spent
• Referring website
• Device type and screen resolution

We use Vercel Analytics for website performance monitoring. Vercel Analytics is privacy-focused and does not use cookies or track individual users across websites.

2. How We Use Your Information

We use the information we collect to:

• Respond to your enquiries and provide requested services
• Send you a confirmation email when you submit our contact form
• Prepare audit reports, proposals, and project documentation
• Improve our website and services
• Protect against spam, abuse, and security threats
• Comply with legal obligations

We do not sell, rent, or share your personal information with third parties for marketing purposes.

3. Legal Basis for Processing

We process your personal information based on:

• Consent: When you submit our contact form, you consent to us processing your data to respond to your enquiry.
• Legitimate interest: Website analytics and security measures to protect our services.
• Contractual necessity: When you engage our services, we process data necessary to fulfil the agreement.

4. Data Storage and Security

Contact form and audit request submissions are processed and stored as follows:

• Database: Form submissions are stored in a secure Supabase (PostgreSQL) database. Each record includes the form data you submitted, your IP address, browser user agent, whether a confirmation email was sent, and a timestamp. This data is used to manage and respond to enquiries.
• Email: A copy of your submission is delivered to our team via Resend (our email provider). You also receive an automated confirmation email acknowledging your submission.

We implement appropriate technical and organisational measures to protect your data, including:

• HTTPS encryption on all pages
• Content Security Policy (CSP) headers
• Rate limiting on API endpoints (IP-based, with standard rate-limit headers)
• Schema-based input validation (type checks, length limits, allowed values)
• Input sanitisation to prevent injection attacks (HTML stripping)
• Bot detection (honeypot fields)
• Row-level security on database tables
• Environment-based secret management (API keys are never exposed client-side)

5. Third-Party Services

We use the following third-party services that may process your data:

• Vercel — Website hosting and analytics (USA). Privacy Policy
• Resend — Transactional email delivery (USA). Privacy Policy
• Supabase — Database hosting and storage (USA). Privacy Policy

These providers are selected for their strong privacy practices and data protection measures. Your data may be transferred to and processed in the United States, where these providers operate.

6. Data Retention

Contact form and audit request submissions stored in our database are retained for up to 24 months from the date of submission. After this period, records are deleted unless you have become a client, in which case data is retained for the duration of the engagement plus any legally required retention period.

Email copies of submissions are retained in our inbox in accordance with our email provider's retention policies.

You may request deletion of your personal data at any time by contacting us at hello@velorax.org. Upon request, we will delete your data from both our database and email records within 30 days.

7. Your Rights

Under POPIA (and GDPR where applicable), you have the right to:

• Access — Request a copy of the personal data we hold about you
• Correction — Request that we correct inaccurate data
• Deletion — Request that we delete your personal data
• Objection — Object to the processing of your data
• Portability — Request your data in a structured, machine-readable format
• Withdraw consent — Withdraw your consent at any time

To exercise any of these rights, please contact us at hello@velorax.org. We will respond within 30 days.

8. Cookies

Our website does not use cookies for tracking or advertising purposes. Vercel Analytics is cookie-free. Essential cookies may be set by our hosting provider for security and performance purposes only.

9. Children's Privacy

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a minor, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. We encourage you to review this page periodically.

11. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us:

• Email: hello@velorax.org
• Website: velorax.org

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za.