Privacy
policy.

Last updated 25 July 2026

Who we are

Under Bridges Entity (Pty) Ltd (“Under Bridges”, “we”, “us”) is a creative and digital studio based in Gauteng, South Africa. This policy explains what personal information we collect through underbridges.co.za and in the course of our work, why we collect it, and what you can ask us to do about it.

It is written to meet our obligations under the Protection of Personal Information Act 4 of 2013 (POPIA). Our Information Officer is Joseph Mbedzi, who can be reached at info@underbridges.co.za.

What we collect

When you use this website. If you send an enquiry, we collect your name, email address, company or organisation, the service you are interested in, and whatever you write in the message.

That is the extent of it. This website sets no cookies, runs no analytics, and carries no advertising or tracking scripts. We do not profile visitors or build audiences from them. Our hosting provider keeps standard server logs — IP address, browser type, pages requested — which exist for security and reliability, not for marketing.

When we work together. Delivering a project usually means handling a little more:

• contact and billing details for you and the people we work with at your organisation
• content, brand assets, credentials, and access you share with us so the work can be done
• correspondence between us, and records of what was agreed

Why we collect it

We only process personal information where the law gives us a basis to:

• To answer you. If you send an enquiry, we use your details to reply — that is what you asked us to do.
• To do the work. Quoting, delivering, and supporting a project requires the information above. This is processing necessary to perform our contract with you.
• To meet legal obligations. Invoices and financial records must be kept under the Companies Act and tax legislation.
• To keep the site secure and working. Server logs serve our legitimate interest in a site that stays up and is not abused.

We do not sell personal information, and we do not send marketing you did not ask for.

Who we share it with

We share personal information only with the service providers who help us operate, and only as far as they need it:

• Vercel — website hosting and server logs
• Resend — delivery of enquiry emails to our inbox
• Google Workspace — our email and business documents
• our accountants, and any regulator or authority where the law requires disclosure

Each of these acts as an operator under POPIA: they process personal information on our instruction and are required to keep it secure and confidential. Where a client project depends on other third-party services, we tell you which ones before we build on them.

Where it is processed

Some of these providers process information on servers outside South Africa. Section 72 of POPIA permits this where the recipient is subject to laws or binding agreements that provide protection substantially similar to POPIA, and we only use providers that meet that standard.

How long we keep it

• Enquiries that do not become projects — up to 24 months, then deleted
• Client records — for the life of the engagement and five years afterwards, to satisfy tax and company-law requirements
• Server logs — a short rolling window held by our host

If you would like your information removed sooner and we are not legally required to keep it, ask us and we will.

How we protect it

The site is served only over HTTPS, with strict transport security and a restrictive content security policy that blocks third-party scripts. Credentials for the services we use are held as encrypted environment variables and never committed to code. Access to client data is limited to the people working on your project.

No system is perfectly secure. If a breach compromises your personal information, we will notify you and the Information Regulator as POPIA requires.

Your rights

Under POPIA you may:

• ask what personal information we hold about you, and get a copy
• ask us to correct anything that is wrong, or delete anything we no longer have grounds to keep
• object to processing we base on legitimate interest
• withdraw consent where consent is what we relied on
• complain to the Information Regulator

Write to info@underbridges.co.za and we will respond as soon as we reasonably can, and within 30 days at the latest. There is no charge unless a request is excessive or repetitive.

Complaints to the Regulator

If you believe we have handled your personal information unlawfully, you are entitled to complain to the supervisory authority:

We would rather hear from you first, and will always try to put things right directly.

Changes to this policy

We update this policy when our practices change. The date at the top always reflects the current version, and material changes will be flagged on the site.