What we keep and what we don't.

Who we are.

Setout is a contract administration practice operating as a sole proprietorship in Bloemfontein, Free State, South Africa. References to "Setout", "we", "us" or "our" in this policy mean the same thing.

Setout is the "responsible party" under the Protection of Personal Information Act 4 of 2013 ("POPIA") for the personal information we collect through this website. To reach our Information Officer, email hello@setout.co.za.

What we collect.

We collect personal information you give us when you:

• ·Submit the contact form — your name, email address, organisation, topic and the contents of your message.
• ·Join a templates pack waitlist — your name, email address and (optionally) organisation.
• ·Buy a templates pack — we receive your name, billing address and email address from PayFast after a successful payment. We never see or store your card details; those stay with PayFast.

We do not use tracking cookies. We use Plausible Analytics to count page views in aggregate; Plausible is cookieless and does not collect or share personal information.

Why we collect it.

We use the information only for the reason it was given:

• ·To reply to your enquiry or brief.
• ·To deliver the templates pack you bought.
• ·To notify you once (only once) when a waitlist pack ships.
• ·To meet our tax and recordkeeping obligations under South African law.

We do not run a newsletter. We do not sell, rent or trade your information. We do not send marketing email unless you specifically requested it.

Who we share it with.

We use a small number of third-party operators to run the site. Each of them processes your information on our instructions, and each has its own data protection commitments:

• ·PayFast (South Africa) — processes card payments and issues receipts. PayFast is bound by South African law and by the Payment Card Industry Data Security Standard (PCI-DSS).
• ·Resend (Ireland / EU) — sends transactional emails (fulfilment links, replies to enquiries).
• ·Cloudflare (global) — hosts the website and routes incoming email to our mailbox.

Some of these operators are located outside South Africa. Where we transfer personal information across borders, we do so only to operators that provide an adequate level of protection equivalent to POPIA's requirements (POPIA section 72(1)(a)).

How long we keep it.

We keep your information only as long as we need it for the purpose it was collected:

• ·Contact-form messages: deleted within 12 months unless they relate to active work.
• ·Waitlist subscriptions: deleted once the pack has shipped and we have notified you, unless you become a paying customer.
• ·Purchase records: kept for at least five years to meet SARS recordkeeping obligations.

Your rights.

POPIA gives you the right to:

• ·Ask us what personal information we hold about you.
• ·Ask us to correct or delete information that is inaccurate or no longer needed.
• ·Object to our use of your information, where the use is based on consent or legitimate interest.
• ·Withdraw consent you have given.
• ·Lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za.

To exercise any of these rights, email hello@setout.co.za. We will respond within 30 days.

How we protect it.

The site runs on HTTPS. Form submissions are protected with anti-spam measures and rate limiting. We use signed download links that expire in 14 days, so a purchase link does not become a permanent backdoor. We do not store passwords or card details.

Changes to this policy.

We update this page when something material changes. The date at the top reflects the last revision. We will not change this policy retroactively to make it weaker.