Privacy

This Privacy & POPIA Notice explains how Abyssal collects, uses, stores, shares, protects and disposes of personal information. It is intended to meet the transparency requirements of the Protection of Personal Information Act 4 of 2013 ("POPIA"), including the notification requirements that apply when personal information is collected.

Information Officer registration: No. 2026-067200 (registered 19 September 2026; current Information Officer appointed 18 October 2026).

1. Who we are

Abyssal is a South African sole proprietorship owned by Berenice Ann Wendy Lindeque, trading as Abyssal. Abyssal provides digital services including Web Development, Process Automation, Data Analytics, and related digital consulting, support and implementation services.

For POPIA purposes, Abyssal may act as a responsible party where Abyssal determines why and how personal information is processed. Where Abyssal processes personal information strictly on a client's instructions as part of a project, Abyssal may act as an operator for that client.

Responsible party	Berenice Ann Wendy Lindeque trading as Abyssal
Information Officer	Berenice Ann Wendy Lindeque
Information Regulator registration number	2026-067200
Email	hello@abyssal.co.za
Website	abyssal.co.za
Telephone	071 403 0238
Physical address	1 Ringwood Drive, Parklands, Cape Town, 7441

Privacy, access, correction, deletion and objection requests may be sent to hello@abyssal.co.za.

2. Who this notice applies to

This Notice may apply to: website visitors; people who make enquiries; prospective clients; current and former clients; client employees and representatives; suppliers and service providers; contractors or subcontractors; project stakeholders; newsletter or marketing subscribers, where applicable; people whose personal information appears in data supplied by a client for an agreed project; and other people who interact with Abyssal in a business context.

3. Personal information we may collect

The personal information Abyssal collects depends on the nature of the interaction or project.

Identity and contact information — name and surname; business or organisation name; job title or role; email address; telephone or WhatsApp number; business address; professional contact details.

Enquiry, discovery and project information — enquiry and intake form responses; business requirements and project objectives; discovery notes; meeting preferences; project correspondence; approvals and decisions; files, documents, content and assets supplied for a project; change requests and support records; time entries, support usage and service-consumption records.

Commercial and financial information — proposals and quotations; signed agreements; invoices; billing details; payment records; transaction references; accounting and tax-related records. Abyssal does not require or intend to collect banking passwords, card PINs or similar payment credentials.

Technical and system information — where required for a project: system or platform names; account or user identifiers; administrator or technical contact details; system configuration information; logs; domain, hosting or application information; authorised system-access information. Passwords, private keys, API secrets and authentication tokens should not be submitted through ordinary forms or normal email unless an appropriate secure method has specifically been agreed. Where Abyssal must retain authorised credentials for delivery, warranty or retainer support, those credentials may be stored in a dedicated encrypted credential manager with access restricted to authorised users.

Email delivery and interaction information — for selected business and transactional emails, Abyssal may use features provided by its email or accounting platforms to record limited interaction information, such as delivery status, whether an email was opened, the date and time an open was recorded, whether a linked transaction was viewed, and related metadata. This is used as an operational signal for follow-up, project communication and account administration. An open or view status is not treated as proof that a recipient read, understood or accepted the contents of an email or transaction.

Website information — abyssal.co.za does not use analytics tools or advertising technologies. Like any website, its hosting provider (Netlify) may automatically log technical request information — such as IP address, browser and device type, the page requested and the time — to deliver the site and protect it against misuse. If you use the Start a project form, Abyssal receives the information you enter: your name and email address, your answers about the project, and anything optional you add (organisation, phone number, website and links). The form does not accept file uploads. If you use the Contact form, Abyssal receives your name, email address, message and, if you add it, your phone number.

Client-supplied personal information — for Automation and Data Analytics projects, clients may provide datasets or access to systems containing personal information relating to their employees, customers, suppliers or other people. Where Abyssal processes that information only on the client's documented instructions, the client generally remains responsible for determining the lawful purpose and basis for that processing.

4. Where we obtain personal information

Abyssal may collect information: directly from you; through the Start a project and Contact forms on abyssal.co.za (submissions are received and stored by Netlify Forms); through other approved forms; by email; from email and accounting platforms that provide delivery, open or transaction-view status; during calls, meetings or guided onboarding; from files or systems supplied or authorised by a client; through accounting and invoicing processes; from referrals; from publicly available professional or business sources; from another person acting on behalf of your organisation; from service providers involved in an agreed project; or from technical systems where this is necessary to provide the agreed service.

Where information is not collected directly from you, Abyssal will process it only where an appropriate lawful basis exists and the information is relevant to the purpose.

5. Why we process personal information

Abyssal may process personal information to: respond to enquiries; assess project fit and requirements; arrange discovery meetings; prepare proposals and quotations; enter into and perform contracts; onboard clients; deliver Web Development, Process Automation and Data Analytics services; communicate with clients and project stakeholders; monitor delivery and interaction status of selected business and transactional emails where this is useful for appropriate follow-up or account administration; manage approvals, revisions, support, warranty matters and change requests; issue invoices and manage payments; maintain accounting, tax and business records; maintain client and project records; administer authorised access to systems; secure Abyssal systems and information; prevent misuse, fraud and security incidents; comply with legal and regulatory obligations; establish, exercise or defend legal rights; manage testimonials, case studies and portfolio permissions where separate permission has been given; improve Abyssal's services and processes; and send permitted newsletters or marketing communications where applicable.

Information submitted through the Start a project or Contact form is used to review and respond to that enquiry or message. It is not added to any mailing list.

Abyssal will not intentionally use personal information for an incompatible purpose without an appropriate lawful basis.

6. Lawful grounds for processing

Depending on the circumstances, Abyssal may process personal information where: you have consented; processing is necessary to take steps at your request before entering into a contract; processing is necessary to perform a contract; processing is required by law; processing protects a legitimate interest of the data subject; processing is necessary to pursue a legitimate interest of Abyssal or a third party, where permitted by POPIA; or another ground permitted by POPIA applies.

Where processing relies on consent, consent may generally be withdrawn, subject to lawful limitations and without affecting processing that was lawful before withdrawal.

7. Is providing information mandatory?

Some information is optional. On the Start a project form, your name, email address and project answers are required so that Abyssal can respond; organisation, phone number, website and links are optional. On the Contact form, your name, email address and message are required; a phone number is optional.

Certain information may also be required to: prepare an accurate proposal or quotation; verify a project contact; enter into an agreement; issue an invoice; provide access to a service; complete a project; or comply with legal, accounting or tax requirements. Where required information is not provided, Abyssal may be unable to provide the requested service or may need to delay or limit delivery.

8. Special or sensitive personal information

Abyssal does not seek to collect special personal information unless it is genuinely necessary for an agreed project or another lawful purpose. Please do not include special personal information in website enquiries.

Where a project involves sensitive, confidential or special personal information: the minimum necessary information should be used; client-hosted storage may be preferred; de-identified, reduced or sample data should be used where practical; access should be restricted; and additional contractual or technical safeguards may apply. Clients should inform Abyssal where supplied information is particularly sensitive or subject to internal restrictions.

9. Sharing personal information

Abyssal does not sell personal information.

Personal information may be shared, where necessary, with: the relevant client organisation; authorised client representatives; cloud-storage and collaboration providers; form providers; accounting and invoicing providers; email and communication providers; time-tracking and project-administration providers; credential-management providers; website hosting and deployment providers; source-control platforms; database and application infrastructure providers; security providers; accountants, tax advisers or legal advisers; approved subcontractors or specialists; and regulators, courts, law-enforcement bodies or other public authorities where lawfully required. Only the information reasonably necessary for the relevant purpose should be shared.

Current or anticipated technology providers may include Netlify (website hosting and Start-form submissions), Cal.com (discovery-call bookings), Tally (client project forms), Microsoft, Titan Mail, Zoho Books, Phased, Proton Pass, GitHub, Supabase (database hosting), Resend (email delivery), Cloudflare (file storage and backups) and Sentry (error monitoring), depending on the relevant project and business process. The services used may change over time.

10. Client project storage

Abyssal uses three general storage models.

Abyssal-managed workspace — suitable for ordinary project files such as website content, brand assets, project documentation, review files, non-sensitive samples and final deliverables.

Client-hosted workspace — preferred where sensitive information is involved, where the client already has an approved business environment, or where the client's internal policy requires information to remain under client control.

Split workspace — general project documentation may be managed by Abyssal while sensitive source information remains in the client's own environment.

Abyssal will avoid unnecessary copies of client data.

11. International and cross-border processing

Some cloud and technology providers used by Abyssal store or process personal information outside South Africa. In particular, enquiries and messages submitted through the Start a project and Contact forms are stored by Netlify in the United States. Discovery calls booked through Cal.com are stored by Cal.com in the United States.

Where personal information is transferred outside South Africa, Abyssal will seek to ensure that the transfer is permitted under section 72 of POPIA. This may include situations where: the recipient is subject to a law, binding corporate rules or binding agreement that provides an adequate level of protection; the data subject has consented to the transfer; the transfer is necessary for performance of a contract with the data subject; the transfer is necessary for a contract concluded in the interests of the data subject; or another condition permitted by POPIA applies. The exact location and level of protection may depend on the service provider and the relevant project configuration.

12. Information security

Abyssal takes reasonable technical and organisational steps appropriate to the nature of the information and the risks involved. These may include: multi-factor authentication; strong authentication controls; least-privilege access; authenticated file sharing; device security; software and operating-system updates; encryption where provided and appropriate; separation of client-facing and internal project material; secure credential-handling practices, including use of an approved encrypted credential manager where Abyssal retains credentials; revocation of access when no longer required; backups where appropriate; data minimisation; use of de-identified or reduced data where practical; retention and deletion controls; incident-response procedures; and periodic review of service providers and systems.

No storage or transmission method is completely risk-free, but Abyssal will take reasonable steps to protect personal information against loss, damage, unauthorised destruction, unlawful access and unlawful processing.

13. Security compromises

If Abyssal has reasonable grounds to believe that personal information for which Abyssal is the responsible party has been accessed or acquired by an unauthorised person, Abyssal will follow the applicable POPIA security-compromise process. This may include: investigating and containing the incident; taking steps to reduce harm; notifying the Information Regulator; notifying affected data subjects as required; and reviewing and improving relevant safeguards.

Where Abyssal is acting only as an operator for a client, Abyssal will notify the responsible client in accordance with the applicable legal and contractual requirements.

14. Retention and deletion

Abyssal will not intentionally retain personal information for longer than necessary for the purpose for which it was collected, unless: another lawful purpose permits continued retention; a contract requires retention; applicable law requires retention; the information is reasonably required for legal claims; the client requests or agrees to continued storage; or another legitimate retention requirement applies.

Website enquiries — enquiries and messages submitted through the Start a project and Contact forms are deleted from Netlify within 12 months of submission where no project follows. Where a project follows, the enquiry becomes part of the project records.

Project working files — as a general working rule, ordinary project working files may be retained for approximately 90 days after project closure, unless: an active retainer exists; another written agreement applies; legal or accounting obligations require longer retention; the client requests continued storage; or a different project-specific retention period has been agreed.

Financial and legal records — accounting, tax, contractual and similar records may be retained for the period required by applicable law or legitimate business requirements.

When information is no longer required, Abyssal may securely delete, destroy or de-identify it.

15. Portfolio, case studies and testimonials

Abyssal does not assume permission to publish client work. Where Abyssal wishes to use a client name, logo, screenshots, project details, a case study or a testimonial, Abyssal will obtain the relevant permission through the Project Permissions & Testimonial process or another appropriate written approval.

Abyssal will not intentionally publish confidential business information, private datasets, credentials, personal information or proprietary information without appropriate permission. The concept projects shown on abyssal.co.za are fictional and use illustrative data.

16. Direct marketing and newsletter communications

Where Abyssal offers newsletters or direct-marketing communications, personal information will be used for those purposes only where permitted by applicable law. Recipients will be given a reasonable method to unsubscribe or object to further direct marketing. Transactional communications concerning an enquiry, contract, project, invoice, support matter or security issue are not the same as marketing communications.

17. Cookies and similar technologies

abyssal.co.za does not set cookies and does not use analytics or advertising tools.

The site keeps two small items in your browser's session storage, which your browser clears when you close the tab:

• whether the opening animation has already played, so it does not repeat on every page; and
• your unfinished answers on the Start a project form, so they are not lost if you move between steps or reload. They are removed when the enquiry is sent.

Neither item is sent to Abyssal. If Abyssal later adds cookies, analytics or similar technologies, this section will be updated before they are used, and consent will be requested where required.

18. Your rights

Subject to POPIA and any lawful limitations, you may have the right to: be informed when personal information is collected; request confirmation of whether Abyssal holds personal information about you; request access to your personal information; request correction of inaccurate, irrelevant, excessive, outdated, incomplete or misleading information; request deletion or destruction where permitted; object to certain processing; object to direct marketing; withdraw consent where processing is based on consent; lodge a complaint with the Information Regulator; and be notified of an applicable security compromise where required by law.

Abyssal may need to verify your identity before processing certain requests.

19. Access, correction, deletion and objection requests

Requests may be sent to Berenice Ann Wendy Lindeque, Information Officer — Abyssal, at hello@abyssal.co.za.

Please provide enough information for Abyssal to identify you, understand the request and locate the relevant records. Where appropriate, prescribed POPIA or PAIA forms may be used. Abyssal will respond within a reasonable period and in accordance with applicable legal requirements. Some information may need to be retained despite a deletion request where retention is required or permitted by law.

20. Complaints

If you are concerned about how Abyssal has processed your personal information, you may first contact Berenice Ann Wendy Lindeque, Information Officer — Abyssal, at hello@abyssal.co.za.

You also have the right to lodge a complaint with the Information Regulator (South Africa):

• Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191, South Africa
• Telephone: 010 023 5200 · Toll-free: 0800 017 160
• General enquiries: enquiries@inforegulator.org.za
• POPIA complaints: POPIAComplaints@inforegulator.org.za
• Website: inforegulator.org.za (online complaints through its eServices portal)

21. PAIA and access to records

Requests for access to Abyssal records may also be governed by the Promotion of Access to Information Act 2 of 2000 ("PAIA"). Abyssal's PAIA Manual explains the categories of records held, how to submit a PAIA request, the applicable procedures and fees, and the remedies available if a request is refused. The PAIA Manual is available on this website and on request.

22. Changes to this notice

Abyssal may update this Notice where services, technology providers, personal-information processing, legal or regulatory requirements, or business structure or contact details change. The current version, with its effective and last-updated dates, is published on this page. Where a change materially affects how personal information is processed, Abyssal will provide additional notice where appropriate.

Plain-English summary

Abyssal collects and uses only the personal information reasonably needed to understand enquiries, run projects, provide services, manage billing and records, protect systems and information, and meet legal obligations. Abyssal does not sell personal information. Where sensitive client data is involved, Abyssal prefers to keep that data in the client's approved environment where practical.

If Abyssal does not need a copy of information, Abyssal should not keep one.