Skip to content
Minimal dark console styled with ceramics and a sculptural branch

Last updated 1 July 2026

Privacy

Privacy Policy

This site has no analytics, no advertising trackers and no third-party embeds. What follows explains the small amount of personal information that is collected anyway, why it exists, how long it is kept, and exactly what you can ask me to do about it.

This site has no analytics, no advertising trackers and no third-party embeds. What follows explains the small amount of personal information that is collected anyway, why it exists, how long it is kept, and exactly what you can ask me to do about it.

01Who this policy covers

This policy applies to bonolomathabela.com and to the design practice operated by Bonolo Mathabela from 14 Keyes Avenue, Rosebank, Johannesburg, 2196, South Africa. For the purposes of the Protection of Personal Information Act 4 of 2013 (POPIA), Bonolo Mathabela is the responsible party for personal information collected through this site and through client engagements.

Where visitors are located in the European Economic Area or the United Kingdom, Bonolo Mathabela acts as data controller for the same information under the UK GDPR and EU GDPR respectively.

The information officer for POPIA purposes is Bonolo Mathabela, reachable at info@bonolomathabela.com.

02What information is collected

This website does not use analytics cookies, advertising trackers or third-party embeds, and it has no login, comment or e-commerce function. As a result, very little information is collected automatically.

Information is collected in the following circumstances:

  • Enquiry forms: the enquiry form on the contact page composes an email in your own mail application. Nothing is transmitted to or stored on this website. Once you send that email, the information it contains is held in the studio email account.
  • Journal subscription: the same mechanism applies. Your email address is added to a subscriber list only once you have sent the message from your own mail client.
  • Direct correspondence: anything you send by email, phone, WhatsApp or post, including project briefs, drawings, budgets and contact details.
  • Engagement records: for clients, the contractual, invoicing and project documentation necessary to deliver and account for the work.
  • Server logs: the hosting provider records standard technical data such as IP address, user agent and requested URL for security and reliability purposes.

03Why the information is used

Personal information is never sold, rented or traded, and it is not used to build advertising profiles or shared with data brokers under any circumstances.

  • To reply to your enquiry and, where relevant, prepare a proposal.
  • To deliver, invoice for and support work you have commissioned.
  • To meet legal obligations, including tax and accounting record-keeping under South African law.
  • To send the journal newsletter, where you have specifically asked to receive it.
  • To protect the site and its visitors against abuse, fraud and technical failure.

04Lawful basis for processing

Under POPIA, processing is justified because it is necessary to conclude or perform a contract with you, because it pursues a legitimate interest in responding to enquiries and running the practice, or because you have consented, as with the newsletter.

Under the GDPR, the equivalent bases are contract (Article 6(1)(b)), legitimate interests (Article 6(1)(f)), consent (Article 6(1)(a)) for marketing communications, and legal obligation (Article 6(1)(c)) for financial records.

Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out beforehand.

05Who information is shared with

Information is shared only where it is necessary to deliver the work or to run the practice lawfully. The categories of recipient are:

  • Specialist collaborators engaged on your project (developers, photographers, copywriters, printers), and only the information they need to perform their part.
  • Suppliers and manufacturers, where an order must be placed or delivered on your behalf.
  • Professional advisers, including accountants and, if it ever became necessary, legal counsel.
  • Service providers who host this website, provide email, or process payments.
  • Public authorities, where disclosure is required by law or court order.
  • Personal information is never sold, rented or traded, and is not shared with data brokers under any circumstances.

06International transfers

Email and website hosting are provided by companies whose infrastructure may be located outside South Africa, including in the European Union and the United States. Where personal information is transferred across borders, it is done in reliance on the recipient being subject to a law, binding corporate rules or a binding agreement that upholds principles of lawful processing substantially similar to POPIA, as permitted by section 72 of the Act.

For transfers out of the EEA or UK, standard contractual clauses are relied upon where the destination has not received an adequacy decision.

07How long information is kept

  • Enquiries that do not become projects: retained for 12 months, then deleted.
  • Client project records: retained for the duration of the engagement and for 5 years afterwards, which supports warranty questions and republication requests.
  • Financial and tax records: retained for 5 years from the end of the relevant tax period, as required by the Tax Administration Act.
  • Newsletter subscriptions: retained until you unsubscribe, after which your address is removed within 30 days.
  • Server logs: retained by the hosting provider on a rolling basis, typically no longer than 90 days.

08Your rights

Under POPIA and the GDPR you have the right to ask what personal information is held about you, to have inaccurate information corrected, to have information deleted where there is no lawful reason to keep it, to object to processing based on legitimate interests, to restrict processing while a dispute is resolved, and to receive a copy of information you provided in a portable format.

To exercise any of these rights, write to info@bonolomathabela.com. Requests are acknowledged promptly and actioned within 30 days. Identity verification may be requested where the request is not obviously from you.

If you are unhappy with the response, you may complain to the Information Regulator (South Africa) at enquiries@inforegulator.org.za, or to your local supervisory authority if you are in the EEA or UK.

09Security

This site is served over HTTPS. Studio email and file storage are protected by multi-factor authentication and full-disk encryption on all devices. Access to client material is limited to Bonolo Mathabela and to collaborators actively working on the relevant project, each of whom is bound by confidentiality terms.

No system is perfect. If a security compromise affecting your personal information ever occurred, you and the Information Regulator would be notified as soon as reasonably possible, in line with section 22 of POPIA.

10Children

This site and this practice are aimed at adults commissioning professional services. Personal information relating to children is not knowingly collected. If you believe a child has provided personal information, write to info@bonolomathabela.com and it will be deleted.

11Contacting the information officer

Bonolo Mathabela, Information Officer. Email info@bonolomathabela.com, telephone +27 82 419 7734, or post to 14 Keyes Avenue, Rosebank, Johannesburg, 2196, South Africa.

Written enquiries about this policy are answered within two working days; formal requests relating to personal information are actioned within 30 days.

Changes to this document

This policy was last updated on 1 July 2026. Material changes will be published on this page with a revised date, and where the change affects how personal information is handled, anyone with an active engagement will be notified by email. Previous versions are available on request.

Warm studio corner with a tree, pendant lighting and a working desk
Dark minimalist desk with a monitor showing code and a desk lamp
LegalTaking projects from September

Questions about this policy, or about how your information is handled?

Write to info@bonolomathabela.com and you'll have a written answer within two working days. Requests relating to your personal information are actioned within 30 days.

Studios

Johannesburg studio14 Keyes Avenue, Rosebank, Johannesburg, 2196, South Africa
Cape Town, by appointmentBuitengracht Street, De Waterkant, Cape Town, 8001, South Africa

Journal subscription

One considered note a month. No campaigns, no selling your address on.

Bonolo Mathabela · Designer & Developer · bonolomathabela.com