Effective date: 25 October 2026. Last updated: 25 October 2026.
1.1 Introduction
This policy explains how Sheetal Cross (“I”, “me”, “my”) processes personal information when you visit http://www.sheetalcross.com, contact me or subscribe to updates. I process personal information in line with the Protection of Personal Information Act 4 of 2013 (POPIA). By using the website you acknowledge this policy. Where I need your consent, I ask for it separately.
1.2 Who is responsible
The responsible party is Sheetal Cross. My Information Officer is Sheetal Cross. Contact details are at the end of this policy.
1.3 What I collect, why, and on what basis
| Source | Information | Purpose | Lawful basis |
|---|---|---|---|
| Contact form and email | Name, email address, subject, message, and anything you choose to include | Respond to your enquiry or story tip | Your consent; steps you ask me to take |
| Newsletter (if switched on) | Name, email address, confirmation record | Send updates you asked for | Consent (double opt-in) |
| Website use | IP address, browser and device type, pages visited, referring site, security logs. The visitor counter shows totals only | Keep the site secure and working; understand use; show the visitor counter | Legitimate interest (security) |
I do not knowingly collect special personal information (such as health, religion, race, trade-union membership, biometric or criminal information) or information about children. Please do not include these in forms or messages.
1.4 Who receives your information
I do not sell personal information. I share it only with service providers (“operators”) who process it on my behalf under written agreements and security obligations, and where the law requires. Current operators:
| Service | Provider | Location |
|---|---|---|
| Website hosting and backups | Domains.co.za (reseller hosting) | South Africa |
| Email delivery and newsletter | The hosting provider’s mail server (Domains.co.za). The site has no newsletter | South Africa |
| Spam protection and security | Wordfence security plugin (Defiant Inc.) plus form checks built into the site | United States (security data only) |
| Analytics (only with consent, or cookie-free) | None. The visitor counter is cookie-free and keeps only a total | Not applicable |
1.5 Transfers outside South Africa
Some operators may store or process information outside South Africa. I only transfer personal information where the recipient is bound by law, a binding agreement or binding rules that give substantially similar protection to POPIA, where you consent, or where the transfer is necessary to perform a contract with you (POPIA section 72).
1.6 How I protect your information
I use reasonable technical and organisational safeguards, including encrypted connections (HTTPS), restricted and two-factor-protected administrator access, regular software updates, malware and intrusion monitoring, and encrypted off-site backups. No system is perfectly secure. If a security compromise affects your personal information, I will notify the Information Regulator and you as POPIA section 22 requires.
1.7 How long I keep information
| Information | Retention |
|---|---|
| Enquiries and messages | 24 months after the last contact, then deleted |
| Newsletter subscription | Until you unsubscribe; a minimal suppression record is kept so you are not re-added |
| Security and access logs | 90 days |
| Backups | Rolling 30 days |
1.8 Your rights
You may ask me to confirm whether I hold information about you and to give you a copy (POPIA section 23); to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (section 24); to object to processing (section 11(3)); and to withdraw consent at any time, without affecting processing done before withdrawal. A prescribed fee may apply to access requests where the law allows. Email my Information Officer. I may need to verify your identity first, and I aim to respond within 30 days.
1.9 Direct marketing
I send electronic direct marketing only with your consent (POPIA section 69), or to people I have already dealt with about similar services, with a clear way to opt out. Every message includes an unsubscribe link.
1.10 Children
This website is not directed at anyone under 18. I do not knowingly collect information about children. If you believe a child has sent me information, contact me and I will delete it.
1.11 Journalism
Where I process personal information solely for journalistic purposes, I do so in line with the Press Code of Ethics and Conduct for South African Print and Digital Media and my Editorial Standards page, which also explains how to ask for a correction. Information that sources and members of the public give me for a story is kept confidential, and sources stay anonymous unless they ask otherwise, to the fullest extent permitted by law.
1.12 Cookies and third-party sites
See the Cookie Policy. Links to other websites and social platforms are outside my control, and their own privacy policies apply to them.
1.13 Changes
I may update this policy. The date at the top shows the latest version. Material changes will be flagged on the website.
1.14 Complaints
Contact me first so I can try to resolve your concern. You also have the right to complain to the Information Regulator (South Africa):
Website: http://www.inforegulator.org.za
POPIA complaints: POPIAComplaints@inforegulator.org.za
General enquiries: enquiries@inforegulator.org.za
Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
1.15 Contact
Information Officer: Sheetal Cross | info@sheetalcross.com.