We hold two different kinds of information, and they follow different rules. Some belongs to us. Most of it belongs to our clients, and we are only looking after it for them.
Who we are
TwelveTwo Digital is an AI agency based in George, South Africa, operated by VDM Ventures (Pty) Ltd. We build and run systems for other businesses: websites, lead capture, event registration, WhatsApp and email messaging, quoting, dashboards and internal automation.
You can reach us at kosie@twelvetwo.co.za. Kosie van der Merwe handles privacy questions personally.
The short version
- This website sets no cookies, runs no analytics and has no forms. Reading it leaves us nothing.
- If you email or WhatsApp us, we keep that conversation so we can answer you and do the work.
- Most personal information we touch belongs to our clients. We process it on their instructions, we do not sell it, we do not reuse it for our own marketing, and we hand it back when the work ends.
- If you registered for an event or signed up through a system we built, the business running that event is who decides what happens to your information. We are the ones operating the machinery.
- You can stop messages at any time. Reply STOP on WhatsApp, or click unsubscribe in any email.
Two roles, and why the difference matters
South Africa's Protection of Personal Information Act draws a line between the party who decides why information is collected, called the responsible party, and the party who processes it on their behalf, called the operator. We are one or the other depending on whose information it is.
Our own information, where we are the responsible party
This covers people who contact us, prospective clients we research and approach, and our own client records. We decide what to collect and why, and this policy governs it.
Client information, where we are the operator
This covers everyone who registers, enquires or signs up through a system we built for a client. Our client is the responsible party. They decide what is collected and what it is used for. We process it on their written instructions, under the engagement agreement we sign with them, and we do not decide anything about it ourselves.
In practice that means if you registered for an event, the ministry, company or organiser running that event holds your information. We built and we run the registration and reminder system for them. If you want your information changed or removed, you can come to us and we will act on it, but we will normally confirm with the client first, because it is theirs.
What this website collects
Nothing. There are no cookies, no analytics, no tracking pixels and no forms on twelvetwo.co.za. Contact happens through ordinary email and WhatsApp links, which open your own apps.
Our hosting provider keeps standard server logs, including IP addresses, for security and reliability. We do not use those to identify or profile visitors.
When you contact us
If you email us, message us on WhatsApp, or book a call, we keep your name, contact details and what we discussed. We use it to answer you, prepare proposals and run the work. We keep it in our own systems for as long as there is a live or reasonably expected working relationship, and we do not sell it or pass it to anyone for marketing.
We also do outbound research and outreach to businesses we think we can help, using publicly available business information such as company websites, public directories and business listings. If you would rather not hear from us, say so once and we will remove you.
Information we handle for our clients
This is the part that applies to most people reading this page, particularly if you registered for an event.
What is collected
It depends on what the client asked for, but typically: first and last name, mobile number, email address, town or area, and how many people you are bringing. Registration systems also record your consent, meaning the exact wording you agreed to, the moment you agreed, and the IP address you agreed from. We store that because it is the evidence that answers a complaint, and a reference to the wording would be worthless once the wording changes.
What it is used for
- Confirming your registration or enquiry.
- Sending you reminders and event information on WhatsApp and by email.
- Letting the organiser plan numbers, seating and logistics.
- Recording whether a message was delivered, so nobody is missed or messaged twice.
We do not use client information to market our own services, and we never combine one client's information with another's.
Messages, and how to stop them
WhatsApp messages are sent through the WhatsApp Business Platform, which is operated by Meta. They go to the number you gave, from the client's own WhatsApp business number. Reply STOP at any time and you will be taken off the list. Emails are sent through Mailchimp and every one carries an unsubscribe link. Stopping one channel does not stop the other, so use both if you want both to end.
Who else handles the information
We use established service providers to run these systems. They process information on our and our clients' behalf, under their own agreements, and are not permitted to use it for their own purposes.
- Meta Platforms, for WhatsApp message delivery.
- Intuit Mailchimp, for email delivery and list management.
- Cloudflare, for website hosting, databases and protection against automated abuse.
- Vercel, for website and application hosting.
- Supabase, for our own client and project records.
- Google, for our business email, calendar and document storage.
Some of these providers process information outside South Africa. Where that happens, it is on the basis that the provider is bound by contractual terms requiring a comparable level of protection.
How long we keep it
For our own records, as long as there is a live or reasonably expected working relationship, and afterwards only where we are required to keep it, such as for tax and accounting.
For client systems, as long as we run that system for the client. When an engagement ends we hand the information over to the client and remove our own working copies. The client keeps their own data, because it was always theirs. That is deliberate, and it is written into how we build: you own what we build for you, including the data inside it.
Your rights, and how to get your information deleted
Under POPIA you may ask us to confirm what personal information we hold about you, correct anything that is wrong or out of date, delete information we no longer have grounds to keep, object to us processing your information, and withdraw consent you previously gave.
Email kosie@twelvetwo.co.za and we will come back to you. There is no charge for a reasonable request. If your information sits inside a client's system, we will tell you who the client is so you know whose information it is, and we will work with them to sort it out.
If you are not satisfied with how we handled it, you may complain to the Information Regulator of South Africa at inforegulator.org.za or complaints.IR@justice.gov.za.
Security
We keep access tight and we keep it separate. Client systems are built in the client's own accounts wherever the asset is theirs, such as their domain, their WhatsApp number and their analytics, so removing us is one click on their side and the asset is unharmed. Credentials are held in a password-protected store, never in code or documents, and are rotated when an engagement ends. Data sits with the providers listed above, in encrypted transit and storage.
No system is perfect. If something goes wrong that puts your information at risk, we will tell the affected client and, where the law requires it, the Information Regulator and the people affected.
Children
Our services are built for businesses and organisations, and are not aimed at children. We do not knowingly collect information from anyone under 18. If a client's event is open to families, any information about a child should be provided by their parent or guardian.
Changes to this policy
We will update this page when what we do changes. The date at the top always reflects the current version. If a change materially affects how we handle information we already hold, we will say so rather than quietly edit the page.
Contact
TwelveTwo Digital, operated by VDM Ventures (Pty) Ltd, George, Western Cape, South Africa.
Email kosie@twelvetwo.co.za. Attention Kosie van der Merwe.