Clear about your information.

Who we are

This website and its related website-preview, client-intake and client-portal services are operated by Mat Hartley / Mat Hartley Consulting (“Mat Hartley”, “we”, “us” or “our”). We provide website design, marketing, CRM, automation, research and related digital services.

This policy applies to:

• websites.mathartley.com and related services on mathartley.com;
• website-preview applications, website intake and client portals;
• Meta lead forms connected to our services;
• communications through email, telephone or WhatsApp; and
• information held in our customer relationship management system.

Our commitment to privacy

We are committed to processing personal information lawfully, reasonably, transparently and securely under the Protection of Personal Information Act 4 of 2013 (“POPIA”) and other applicable South African law.

When a particular activity requires consent, we ask for it clearly. Submitting an application authorises us to deal with that application; it does not automatically subscribe you to unrelated newsletters or ongoing marketing.

Information we may collect

Personal and contact information

• Full name, email address, telephone or WhatsApp number;
• job title, role and preferred communication method; and
• communications, appointments and follow-up history.

Business and project information

• Business name, website, industry, services, location and service areas;
• business goals, target customers, budget, timing and decision-making authority;
• website requirements, pages, functionality, feedback and approvals;
• logos, brand guides, company profiles, brochures, copy, photographs and videos; and
• reference websites and documents uploaded through an intake or client portal.

Lead and CRM information

• Enquiry source, advert or campaign, UTM information and submission time;
• qualifying answers, lead status, follow-ups and intake progress;
• preview, quotation, approval, invoice, payment and support history; and
• consent wording, date and operational audit records.

Technical information

• IP address, browser, device, operating system and approximate location;
• pages visited, referring page, campaign and form interactions; and
• session, error, security and performance information.

Please do not send passwords or sensitive records through ordinary forms. Do not upload identity documents, financial account details, health information or credentials unless we specifically request them and provide a suitable secure process.

How we collect information

We may collect information:

• directly from you through forms, calls, meetings, email, WhatsApp and uploads;
• through Meta or another lead-generation platform;
• through our intake, CRM and client-portal services;
• through essential cookies, security logs and enabled analytics tools;
• from service providers acting on our behalf; and
• from public business websites, listings, social pages, reviews and industry sources.

If you give us information about another person, you confirm that you are authorised to do so.

Public website and business research

When you apply for a website preview, we may review the current website you provide, public business listings, public social-media pages, online reviews, competitor websites and relevant public industry information. This helps us understand the business, diagnose the existing website and plan an appropriate strategy or preview.

We do not attempt to enter password-protected systems or private accounts without express permission.

How we use information

We may use information to:

• receive, assess and qualify website-preview applications;
• contact you, send the website intake and manage project follow-up;
• research the business, market and existing website;
• plan, design, build, review, launch, host and support website work;
• prepare quotes, agreements, invoices and client records;
• provide CRM, marketing, automation and portal services;
• measure advertising and website performance;
• prevent fraud, spam, abuse and security incidents;
• improve our services, systems and processes; and
• meet legal, accounting, tax and contractual obligations.

We do not sell personal information.

Why we may process information

Depending on the circumstances, processing may be justified because:

• you consented;
• it is necessary to respond to your request or take steps before an agreement;
• it is necessary to perform an agreement;
• it protects your legitimate interests or our legitimate business interests;
• it is required by law; or
• the information was deliberately made public by you or the relevant business.

You may withdraw consent where processing depends on consent. Withdrawal does not undo processing that was lawful before withdrawal.

Website-preview applications and qualification

The preview campaign is intended for established businesses that already have a website and are considering a professional replacement or upgrade. We may use application answers to classify or prioritise an enquiry according to the website supplied, decision-making authority, project timing, indicative investment and completeness of the brief and materials.

Automated rules may assist with spam detection, scoring, prioritisation and workflow routing. Important decisions remain subject to human review. We do not use solely automated processing to make decisions that produce legal or similarly significant effects without appropriate safeguards. Submitting an application does not guarantee that a preview will be produced.

AI-assisted research and production

We use modern software and artificial-intelligence tools to assist with research, website analysis, strategy, copy, design concepts, coding, quality assurance, workflow automation and support. We limit information supplied to these tools to what is reasonably required and do not intentionally submit unnecessary sensitive personal information.

AI-assisted work is directed and reviewed by a person before it is presented as final client work. Some technology providers may process information outside South Africa; international processing is handled as described below.

Uploaded logos, content and documents

You retain ownership of materials you provide. By sending or uploading them, you confirm that you own them or have permission to use them, and that we may process and reproduce them to research, design, build and support the relevant website or preview.

We do not knowingly reuse private project materials for an unrelated client. Completed, publicly launched work may be displayed in our portfolio or marketing unless an agreement says otherwise or you ask us not to.

Meta, WhatsApp and other platforms

If you respond through Facebook or Instagram, Meta processes the interaction under its own privacy terms before sending the lead to us. If we communicate through WhatsApp, email or another platform, that provider also processes communications under its own terms. Those platforms operate independently and are responsible for their separate privacy practices.

Who may receive information

We disclose only what is reasonably necessary to trusted providers that help us deliver services, including providers of:

• hosting, domains, cloud storage, backups and cybersecurity;
• CRM, forms, client portals, email and WhatsApp communication;
• analytics, advertising and campaign measurement;
• website development, code hosting, AI and research tools;
• payments, accounting and invoicing; and
• legal, accounting and other professional advice.

We may also disclose information when lawfully required, to investigate fraud or a security incident, to protect rights and systems, during a business sale or restructuring, or on your instruction.

International processing

Some hosting, cloud, communication, advertising and AI providers operate in other countries. Where information leaves South Africa, we take reasonable steps to ensure an appropriate level of protection, suitable contractual or organisational safeguards, necessity for a requested service, or another lawful basis permitted by POPIA.

Advertising, analytics and cookies

Essential cookies or session tokens may support website operation, security, saved applications and private client areas. If optional analytics or advertising tools such as Meta Business Tools are enabled, they may process campaign identifiers, page visits, browser or device information and conversion events for measurement or remarketing where permitted.

You may control or delete cookies through your browser and the relevant platform's advertising settings. Blocking essential cookies may prevent secure features from working. Where a consent control is shown, use it to manage optional cookies.

Direct marketing

A website-preview application authorises contact about that application by telephone, email or WhatsApp, including intake reminders, preview updates and relevant follow-up. We only send unrelated or ongoing marketing where an appropriate lawful basis exists.

You may object or opt out at any time through an unsubscribe link, by replying “STOP” where applicable, or by emailing mat@mathartley.com. Service messages about an active enquiry, project, invoice, security issue or client account are not promotional messages.

How long we retain information

We keep information only for as long as reasonably required for its purpose or by law. Our general working periods are:

Uploaded working material, system logs and backups follow operational and security schedules. We may keep information longer for a legal dispute, investigation, security matter or lawful obligation, and retain limited opt-out records so that the choice can be honoured.

Security

We use reasonable technical and organisational measures intended to protect information against loss, damage, unauthorised access or disclosure, unlawful processing, alteration and destruction. Measures may include encrypted transport, secure hosting, access controls, restricted permissions, private file storage, signed access, logging, monitoring, backups and service-provider review.

No internet-based service can be guaranteed completely secure. Users must protect credentials issued to them.

Security incidents

If there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we investigate, contain and address the incident. Where POPIA requires it, we notify the Information Regulator and affected people as soon as reasonably possible. Operators processing information for us are required to report relevant compromises so that we can meet our obligations.

Your rights under POPIA

Subject to applicable law, you may ask us to:

• confirm whether we hold personal information about you and provide access;
• correct or update inaccurate information;
• delete or destroy information we are no longer authorised to retain;
• identify third parties that have received your information where applicable;
• restrict or object to certain processing and direct marketing;
• withdraw consent where processing depends on it; or
• explain a decision involving your information and lodge a complaint.

We may need to verify identity before acting and may limit a request where law permits or requires us to retain the information. Email mat@mathartley.com with the subject Privacy Request.

Children

Our website-preview and business services are intended for adults acting for businesses. We do not knowingly collect children's personal information through this service. Contact us if you believe a child submitted information without appropriate authorisation.

Third-party links

Our website and previews may link to third-party websites or services. We do not control their privacy, security or content. Review the relevant third party's privacy policy before supplying information.

Changes to this policy

We may update this policy when services, systems, providers or legal obligations change. The current version is published here with its effective date. Material changes may also be communicated directly where appropriate.

Contact us

We investigate and respond to privacy questions, objections, requests and complaints within a reasonable period.

Information Regulator South Africa

If you believe your information has been processed unlawfully, you may lodge a POPIA complaint through the Information Regulator's eServices portal.

Submit a POPIA complaint →Visit the Information Regulator →