Orange & All – Privacy Policy
Oct 17, 2026 ·
1. Who we are and what this policy covers
Orange & All (Pty) Ltd (“O&A”, “we”, “us”) is the Responsible Party, as defined in the Protection of Personal Information Act 4 of 2013 (“POPIA”), for personal information collected through orange-n-all.co.za and through our dealings with prospective and current clients.
Detail | Information |
Registered name | Orange & All (Pty) Ltd |
Registration number | 2020/151696/07 |
Registered address | Available on request from the Information Officer |
Where we handle personal information on behalf of a client (for example, a client’s member or customer data held in a website, CRM or advertising account we manage), we act as an Operator. We process that information only on the client’s written instructions, and the client’s own privacy notice applies to it.
By using our website or sending us your information, you acknowledge that you have read this policy.
2. Personal information we collect
We collect only the information we need to respond to you, deliver our services and run our business.
- Contact and enquiry details: name, email address, phone number, company name, job title and the content of your message, when you complete a contact or quote form or email us.
- Client and onboarding details: business registration and VAT details, billing address, authorised contacts, briefs, approvals and correspondence.
- Billing information: invoicing and payment records. We do not store full card numbers on our website.
- Technical information: IP address, browser and device type, pages viewed, referring page and time spent, collected through cookies and analytics tools.
- Marketing preferences: whether you have opted in to, or out of, our communications.
- Content you supply to us: logos, images, text and data that clients provide for projects. This may include other people’s personal information, which the client is responsible for having the right to share with us.
We do not knowingly collect special personal information (such as health, religion, race or biometric information) through our website, and ask that you do not send it to us.
3. How we collect it
Most information comes directly from you; the rest is collected automatically or from other lawful sources.
- Directly from you: forms, email, WhatsApp, phone calls, meetings, proposals and signed agreements.
- Automatically: cookies, server logs and analytics tools when you browse our website.
- From other sources: publicly available information such as your company website or LinkedIn profile, and referrals from people who have given us your details for business purposes.
Providing information is voluntary, but we may be unable to respond to an enquiry or deliver services without the details we ask for.
4. Why we use your information
We process personal information only for the purposes below, each of which has a lawful ground under POPIA.
Purpose | Lawful ground (POPIA s11) |
Responding to enquiries and preparing quotes | Steps to conclude a contract; legitimate interest |
Delivering services, invoicing and collecting payment | Performance of a contract |
Meeting tax, accounting and other legal obligations | Legal obligation |
Securing and improving our website and services | Legitimate interest |
Understanding website traffic and campaign performance, and showing relevant ads to past visitors (remarketing) | Consent (for non-essential cookies) and legitimate interest |
Sending newsletters or promotional messages | Consent, or an existing client relationship as allowed by POPIA s69 |
Protecting our rights and handling disputes | Legitimate interest; legal obligation |
We do not sell personal information, and we do not use it for automated decision-making that has legal effect on you.
5. Who we share it with
We share personal information only with service providers and authorities who need it, and we require our providers to protect it.
- Hosting and infrastructure providers that host our website and email on a managed server in South Africa (Xneelo) and store project files in cloud storage (Apple iCloud and Google Drive).
- Email, communication and project tools we use to run client work.
- Analytics and advertising platforms, such as Google (Google Analytics and Google Ads, through the Google tag) and Meta (Meta Pixel), and, if we enable them, LinkedIn and Microsoft (Bing), where the relevant cookies are accepted.
- Accountants, banks and payment processors for invoicing, payment and tax purposes.
- Subcontractors and associates who work on a client project under confidentiality obligations.
- Professional advisers, courts and authorities where required by law or to protect our legal rights.
If O&A is sold, merged or restructured, personal information may be transferred to the successor business, which will be bound to protect it on terms no less protective than this policy.
6. Transfers outside South Africa
Some of our providers store or process information outside South Africa, and we transfer it only where POPIA section 72 allows.
A transfer is permitted where the recipient is bound by law, binding corporate rules or an agreement that gives substantially similar protection to POPIA, where you consent, or where the transfer is necessary to perform a contract with you or at your request. Our website and email are hosted in South Africa. Providers that may process information outside South Africa include Google (Analytics, Ads and Drive), Meta, Apple (iCloud) and, if we enable them, LinkedIn and Microsoft.
7. Cookies, analytics and advertising pixels
Our website uses essential cookies by default, and non-essential cookies only after you accept them.
Type | Purpose | Consent needed |
Essential | Site security, load balancing, remembering your cookie choice | No |
Analytics | Understanding which pages are visited and how the site performs | Yes |
Advertising | Measuring and improving our own advertising, and showing our ads to people who have visited our site (remarketing), for example the Google tag (Google Ads measurement and remarketing), the Meta Pixel and, if enabled, the LinkedIn Insight Tag and Microsoft Advertising tag | Yes |
You can accept or decline non-essential cookies in the cookie banner and change your choice at any time through your browser settings. You can also turn off personalised advertising in your Google Ad Settings and Meta ad preferences. Blocking essential cookies may stop parts of the site from working. We will update this policy before we enable any further tracking tool.
8. Direct marketing
We send marketing messages only to people who have opted in, or to existing clients about similar services, and every message carries a way to opt out.
Under POPIA section 69, electronic marketing requires your consent unless you are an existing client and we offered you an opt-out when we collected your details. You can unsubscribe through the link in any message or by emailing hello@orange-n-all.co.za, and we will stop within a reasonable time.
9. Retention and deletion
We keep personal information only as long as needed for the purpose it was collected, or as the law requires.
Information | Retention period |
Unanswered enquiries and contact-form submissions | 12 months |
Client contracts, invoices and financial records | At least 5 years, as required by South African tax and company law |
Website analytics data | 14 months |
Marketing list entries | Until you unsubscribe or ask us to delete them |
When information is no longer needed, we delete it or de-identify it so that it can no longer be linked to you, unless the law requires us to keep it.
10. Security and breach notification
We use reasonable technical and organisational measures to protect personal information against loss, damage and unauthorised access, as POPIA section 19 requires.
These include SSL encryption on our website, access controls and strong authentication on our systems, security monitoring, regular software updates and backups, and confidentiality obligations on everyone who handles information for us. No system is completely secure. If a security compromise affects your personal information, we will notify the Information Regulator and you as soon as reasonably possible, as POPIA section 22 requires.
11. Your rights
Under POPIA you have the following rights over your personal information, and you can exercise them by contacting our Information Officer.
- Access: ask whether we hold information about you and request a copy.
- Correction: ask us to correct or complete information that is inaccurate, outdated or incomplete.
- Deletion: ask us to delete information we no longer have a lawful reason to keep.
- Objection: object to processing based on our legitimate interests, or to direct marketing, at any time.
- Withdraw consent: where processing relies on your consent, withdraw it at any time. This does not affect processing done before you withdrew.
- Complain: lodge a complaint with the Information Regulator (see section 13).
We will respond within a reasonable time and may need to verify your identity first. We may refuse a request only on the grounds POPIA allows, and we will tell you why.
12. Children
Our website and services are aimed at businesses and are not directed at anyone under 18. We do not knowingly collect personal information of children, and if we learn that we have, we will delete it. If you believe a child has sent us information, please contact our Information Officer.
13. Information Officer and complaints
Send privacy questions and requests to our Information Officer first and escalate to the Information Regulator if we do not resolve them.
Contact | Details |
Information Officer | Pieter Steyn |
info-officer[@]orange-n-all.co.za | |
Postal address | Available on request from the Information Officer |
Information Regulator (South Africa) | Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191. Tel 010 023 5200, toll free 0800 017 160, enquiries@inforegulator.org.za |
14. Changes to this policy
We may update this policy when our practices or the law change, and the current version always shows its effective date.
Effective date: 17 October 2026. Version 1.0. If we make a material change, we will tell you through the website or by email where we hold your address.