Privacy policy

1. Who we are

ETASCO (Pty) Ltd (registration number 2021/393820/07) is the responsible party for personal information collected through etasco.co.za. We design training and eLearning, and build websites and web apps, for organisations across South Africa. If you use ETASCO Learn, section 12 explains how your information is handled there.

• Information Officer: Egan Tarr, Director
• Email: admin@etasco.co.za
• Phone: 083 457 3899
• Registered office: 18 Populier Street, Kanonkop, Middelburg, 1055

2. What we collect

When you send an enquiry

The quote form asks for:

• your name, company, and email address
• your phone number (optional)
• what you need, a description of your project, and your ideal timeframe and budget range (optional)
• your consent for us to use these details to respond

If you email, phone or WhatsApp us directly, we receive whatever you choose to share, such as your name, number and message.

When you browse the site

Like most websites, our hosting provider automatically records basic technical information, such as your IP address, browser type and the pages requested. This is used to run the site securely and fix problems, not to identify or profile you.

We don't use analytics, advertising or tracking cookies.

3. Why we use it

• to reply to your enquiry, arrange a call and prepare a quote
• to deliver and manage work you ask us to do
• to keep the website and our systems secure, including blocking spam
• to meet our legal, tax and accounting obligations

We process your information because you consent to it when you send an enquiry, because it's needed to take steps towards a contract you asked for, or because we have a legitimate interest in running a secure business. We don't sell your information, and we won't send you marketing unless you ask us to.

4. Who we share it with

We share personal information only with service providers ("operators") who help us run the website and respond to you, and who are bound to keep it confidential and secure:

• Website hosting: Vercel Inc., based in the United States, which runs this website.
• Email hosting: our business email provider, which delivers enquiries to our inbox.
• Database: Supabase, which stores a secure copy of each enquiry on servers in Ireland, in the European Union.
• Backup spreadsheet: Google, which keeps a copy of each enquiry in a private Google Sheet that only ETASCO can open.

We may also disclose information where the law requires it, for example to a regulator or under a court order.

5. Information sent outside South Africa

Some of our service providers store data outside South Africa. Our enquiry database is in the European Union, which has data protection laws that give at least the same level of protection as POPIA. Our website host, Vercel, is based in the United States, and Google, which holds our backup spreadsheet, is based in the United States and stores data in several countries. Where we use any provider abroad, we make sure that they're bound by laws or agreements that protect your information to POPIA's standard, as section 72 of POPIA requires.

6. How long we keep it

• Enquiries that don't lead to work are deleted within 24 months of our last contact with you.
• If you become a client, we keep project and billing records for as long as we work together, and afterwards for as long as the law requires (for example, for tax and company records).
• You can ask us to delete your information sooner (see section 8).

7. How we protect it

• The website uses an encrypted (HTTPS) connection.
• Enquiries are stored in a database and a private spreadsheet that can't be read from the public internet; only our own systems can add to them, and only authorised people at ETASCO can view them.
• Access to our email and systems is protected by passwords and limited to people who need it.
• If we believe your information has been accessed without permission, we'll tell you and the Information Regulator, as POPIA requires.

8. Your rights

Under POPIA, you have the right to:

• ask whether we hold personal information about you, and request a copy of it
• ask us to correct information that's wrong, or delete information we no longer need
• object to us using your information, or withdraw your consent
• refuse direct marketing
• complain to the Information Regulator

To use any of these rights, email our Information Officer at admin@etasco.co.za. We may ask you to confirm your identity first. For requests to access other records, see our PAIA manual.

9. Complaints

If you're unhappy with how we've handled your information, please contact us first so we can put it right. You can also complain to the Information Regulator:

• Website: inforegulator.org.za
• Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• Phone: 010 023 5200 (toll-free 0800 017 160)
• General enquiries: enquiries@inforegulator.org.za
• POPIA complaints: POPIAComplaints@inforegulator.org.za
• PAIA complaints: PAIAComplaints@inforegulator.org.za

10. Your browser and this site

If you switch the site to its light theme, your browser remembers that choice on your own device. It isn't sent to us and isn't used to track you. If we ever add analytics or tracking cookies, we'll update this policy and ask for your consent first.

11. Children

This website is meant for businesses and organisations. We don't knowingly collect personal information from anyone under 18.

12. ETASCO Learn, our learning platform

ETASCO Learn is the learning platform we host and manage for client companies, on sites such as yourcompany.learn.etasco.co.za.

Who is responsible for your information

• When a company uses ETASCO Learn to train its people, that company is the responsible party for their information. We process it on the company's behalf, as its operator, under a written agreement, and only to provide the platform.
• If you're a learner, your employer decides how your information is used. Contact your training admin first, through the Help page on your learning site. We'll help your employer answer your request.
• We're the responsible party for the details we keep about our client companies: contact people, job titles, phone numbers and billing details. We use them to manage the account and to invoice.

What the platform holds

• your name, and your work email address or employee number
• your role, groups, the courses assigned to you and their due dates
• your course progress, scores, quiz answers, time spent and completion dates
• your certificates: number, check code, issue date and expiry date
• questions you send to your training admins
• sign-in records, including your IP address and browser details
• a log of admin actions, and of the emails sent to you and whether they were delivered

We don't ask for ID numbers, health information or dates of birth. Please don't type them into messages or other free-text fields.

Who can see it

• Your company's training admins see their own company's people and results. Each company's data is kept separate, so companies can't see each other's.
• Authorised ETASCO staff can open a company's site to support it. These visits are recorded in that company's activity log.
• Anyone with a certificate's number and check code can confirm it on the company's certificate check page. That page shows the holder's name, the course, the dates and whether the certificate is valid, but never an email address or a score.

Service providers

• Supabase: database, sign-in and file storage, on servers in Ireland, in the European Union. Supabase Inc. is based in the United States.
• Vercel: runs the platform. Vercel Inc. is based in the United States; the platform's servers run in Dublin, Ireland, in the European Union. Requests reach Vercel through its worldwide network, usually at the point nearest you.
• Resend: sends the platform's emails, such as sign-in codes, invitations and reminders, from its European Union region.

Cookies

ETASCO Learn uses one cookie to keep you signed in and, if you choose a light or dark theme, one to remember that choice. There are no analytics, advertising or tracking cookies. If a course includes a YouTube or Vimeo video, that service may set its own cookies when the video loads.

How long it's kept

• Your information is kept while your company uses ETASCO Learn.
• Your company's admins can remove a person for good. Their name and contact details are deleted, and their results and certificates stay without a name, so a certificate can still be checked.
• When a company stops using ETASCO Learn, we give it a copy of its data, then delete it within 90 days, and from our backups within 12 months.

13. Changes to this policy

We may update this policy from time to time. The date at the top shows when it last changed. The current version is always on this page.