This policy explains what personal information raphaelcosta.com collects, why, and the choices you have. It is written to meet South Africa's Protection of Personal Information Act (POPIA), the EU General Data Protection Regulation (GDPR) and the UK GDPR.
Who is responsible
The responsible party (data controller) is Raphael Garcia da Costa, Johannesburg, South Africa. You can reach him about anything in this policy at me@raphaelcosta.com.
What is collected and why
- Messages you send. When you use the contact form or email, your name, email address, organisation and message are used only to reply to you and to manage the enquiry. Legal basis: your consent and our legitimate interest in responding.
- Newsletter. If you subscribe, your email address is used only to send occasional updates. Every email has an unsubscribe link. Legal basis: consent.
- Analytics, only with your consent. If you allow it, Google Analytics 4 records anonymised usage (pages visited, device type, approximate region) so we can see which content is useful. IP addresses are anonymised. Legal basis: consent.
- Security logs. The hosting provider, Cloudflare, processes technical data such as IP address and browser type to deliver the site and protect it from abuse. Legal basis: legitimate interest.
Personal information is never sold, rented or used for advertising.
Cookies
A cookie is a small text file stored by your browser. This site uses the following:
- rc_consent (essential, first-party, 12 months): remembers whether you accepted analytics. Set only after you make a choice.
- _ga and _ga_<id> (analytics, Google, up to 13 months): distinguish visits for statistics. Set only if you click “Accept analytics”.
You can change your choice at any time with the link in the footer. Withdrawing consent deletes the analytics cookies on this site. You can also block cookies in your browser settings.
Who else processes data
- Cloudflare, Inc. (hosting and security)
- Google LLC (analytics, only with consent)
- Resend, Inc. (email delivery and the mailing list), if you use the contact, book or newsletter forms
Some of these providers process data outside South Africa or the European Economic Area. Where they do, transfers rely on adequate safeguards such as standard contractual clauses.
How long information is kept
Enquiries are kept for up to 24 months after the last exchange, then deleted. Newsletter details are kept until you unsubscribe. Analytics data is retained for 14 months.
Your rights
You may ask to access, correct or delete your personal information, object to or restrict its processing, withdraw consent, or receive a copy in a portable format. Email me@raphaelcosta.com and you will receive a reply within 30 days.
If you are not satisfied, you may complain to the Information Regulator of South Africa (inforegulator.org.za), or to your local data protection authority in the EU or UK.
Changes
If this policy changes, the date at the top of the page will change too.