Privacy policy
Last updated
This policy explains how HeyThere ("we", "us") collects, uses, shares and protects personal information when you use this website or contact us. We follow the Protection of Personal Information Act 4 of 2013 (POPIA) and, where it applies to you, the EU and UK GDPR.
Who is responsible
The responsible party is HeyThere (Pty) Ltd, Cape Town, South Africa. Our Information Officer is Marlon Dickerson. To reach the Information Officer, send us a message, starting it with "Privacy request". We don't publish an email address, but we answer every privacy request.
What we collect
- Booking a diagnosis or sending us a message: your first name, work email and message, and, if you choose to give them, your company website, your answers about your sales team, CRM history and budget band, how you heard about us and good times for a call. Optionally, your role, CRM and what isn't working.
- The scorecard: your ten answers stay in your browser. If you ask for the detailed report, we receive your email and your answers.
- Contact form: your name, work email, company (optional), reason and message.
- Our Good Timing newsletter and templates: your email address.
- Market Snapshot requests: a sentence about your best customers and, if you choose, a link to a list of won deals.
- With every form: how you reached the site (campaign tags, referring site, landing page), the page you submitted from and a Google Analytics identifier. We don't collect your IP address in our own records.
- Analytics (always on): pages viewed, link and button clicks and how far you scroll (Google Analytics, advertising features off).
- Session recordings (on unless you switch them off): anonymised recordings of how pages are used, with form fields masked (Microsoft Clarity). See our Cookies page.
- Clicking a link in our emails (identified visits, on unless you switch it off): links in the emails we send you carry a random ID that belongs to your contact record (it isn't your email address). We remove it from the address bar straight away, keep it in the
ht_vidcookie, and record which of our pages you view, when, and which email brought you. If you've switched off identified visits in Cookie settings, or your browser sends Global Privacy Control, we discard it. - Sending us a form as a new contact (identified visits): if you don't have that ID yet, we create one when you submit (the same
ht_vidcookie) and link it to your contact record, so your later visits are recognised in the same way. With identified visits switched off, nothing is created. - The pages you viewed before sending a form (identified visits): your browser keeps a short list of the pages you view here and a few key clicks, with the time (the
ht_journeystorage: the last 50 entries, up to 30 days, never form contents). It stays in your browser until you send us a form; then it's sent with the form, added to your contact record as page views (kept like the visits below) and summarised in a note in our CRM. Switching off identified visits deletes it straight away.
Why we use it, and our lawful basis
- To answer your request (book your call, send your report or template, reply to your message): because you asked us to, and to take steps towards a contract (POPIA s11(1)(b); GDPR art. 6(1)(b)).
- To decide whether we're a good fit and prepare for the call: our legitimate interest in running the business (s11(1)(f); art. 6(1)(f)). We score enquiries on the answers you give; a person always makes the final call.
- Our Good Timing newsletter and occasional guides: only with your opt-in consent (s69; art. 6(1)(a)): you subscribe by submitting the newsletter form or ticking the box on another form. Subscribing is immediate, with no confirmation email; we record what you agreed to and when, and send one welcome email. You can unsubscribe from any email.
- Analytics and session recordings: our legitimate interest in understanding how the site is used and fixing what gets in the way (s11(1)(f); art. 6(1)(f)). Analytics is always on; you can switch off session recordings in Cookie settings.
- Knowing what you read after our emails or a form: so we can follow up on what's relevant to you (for example, not pitching an audit you've already read about) and see which emails help. Our legitimate interest (s11(1)(f); art. 6(1)(f)); we link these page views to your contact record and our CRM. It's on unless you switch off identified visits in Cookie settings (or your browser sends Global Privacy Control), and you can object at any time (see "Your rights").
- Security and spam prevention: our legitimate interest in keeping the site and forms safe.
Who processes it for us
These service providers (operators) process personal information on our behalf, under agreements that require them to keep it secure and use it only for our purposes.
| Provider | What for | Where |
|---|---|---|
| Google Firebase (Hosting, Cloud Firestore) | Hosts the website and stores what you submit, plus one contact record per email address (your email preferences and consent record) and, unless you switch off identified visits, the pages you view after clicking a link in our emails or sending us a form | Firestore: South Africa (Johannesburg). Hosting: global CDN |
| GitHub (Microsoft), GitHub Actions | Runs the scheduled job that forwards your submission to the tools below | United States |
| Notion | Our CRM: a record of each enquiry and booking, for our team, including a short daily note when you return to the site from one of our emails (unless you switch off identified visits) | United States |
| Resend | Sends the emails you ask for (reports, templates, booking links, the Good Timing newsletter) and internal alerts to our team | United States |
| Slack | Internal alerts to our team about new enquiries | United States |
| Google reCAPTCHA Enterprise (Firebase App Check) | Checks that forms are sent by a person, if switched on | United States |
| Google Analytics | Website analytics (always on; advertising features off) | United States |
| Microsoft Clarity | Session recordings and heatmaps (on unless you switch them off) | United States |
We don't sell personal information, and we don't use advertising cookies.
Transfers outside South Africa
Some providers above process data outside South Africa, mainly in the United States and the European Union. We only use providers that are bound by agreements with protections comparable to POPIA (s72), such as standard contractual clauses.
How long we keep it
- Form submissions: 24 months after your last contact with us.
- Enquiries that weren't a fit, where you didn't opt in to emails: deleted after 12 months.
- Consent records (what you agreed to, and when): 5 years, to show we asked properly.
- Your contact record (email address, email preferences, what you downloaded): while you're subscribed or in contact with us, then as for form submissions. If you unsubscribe, we keep your address only on a do-not-email list, so we don't email you again.
- Analytics data: 14 months.
- Page views linked to an email click or a form, including the pages viewed before the form (identified visits): 13 months, then deleted automatically. The summary on your contact record (last visit, most-viewed pages, the last email you clicked) follows the contact record rule above.
- Clients: for as long as the law requires us to keep business records.
Your rights
You can ask us to confirm whether we hold information about you and to see it, correct it, delete it or stop using it; object to processing based on our legitimate interests; and withdraw consent at any time (this doesn't affect what we did before). To stop marketing emails, use the unsubscribe link in any of them. To stop us linking your visits to your contact record, switch off identified visits in Cookie settings, or ask us and we'll switch it off on your record for good. To stop session recordings, switch them off in Cookie settings. To use these rights, send us a message. We'll reply within 30 days.
You can complain to the Information Regulator (South Africa): inforegulator.org.za. If you're in the EU or UK, you can also complain to your local data protection authority.
Security
Submissions go straight into a database that the public can't read, change or delete. Access is limited to the people who need it, and service-account keys are never stored in the website. No system is perfectly secure; if a breach affects you, we'll tell you and the Information Regulator as POPIA requires.
Automated decisions
We don't make automated decisions about you. Everyone who books or sends a message gets the same reply from a person. We use a simple rule on the answers you choose to give (for example, the size of your sales team) to help us decide which messages to answer first. If you have a question about it, send us a message.
Changes
We'll update this page when our practices change and show the date at the top.