Who we are
JOV builds and looks after websites for South African businesses. For everything described on this page about jov.co.za itself, we are the responsible party under the Protection of Personal Information Act, 2013 (POPIA).
| Trading as | JOV |
|---|---|
| Information Officer | Ryan Sayer |
| Contact | hello@jov.co.za |
Who is responsible for what
Our responsibility changes depending on whether you are using jov.co.za or a website we run for a client.
1. On jov.co.za, we decide
When you send us an enquiry or browse jov.co.za, we decide what happens to that information. We are the responsible party, and the rest of this page is about that.
2. On a client's website, the client decides
When we build and host a website for a client, that client decides what to collect from its visitors and why. We process the information on the client's instructions as an operator under POPIA. Information collected there stays separate from other clients and from JOV's own data. We do not use or sell it for our own purposes.
If you are one of our clients: you are the responsible party for your own visitors, which means the privacy notice on your site is your legal responsibility. POPIA section 21 also requires a written operator agreement between us — we provide one, and we will not process your visitors' information without it. We give you ready-made notice wording rather than leaving you to write it, and we can switch visitor analytics off for your site entirely, or run it so that nothing about a visitor outlives their tab. Email hello@jov.co.za.
If you are visiting a client's website, ask that business what its site collects. It can answer your request directly or instruct us to erase your information.
What we collect on this website
What you send us
Our enquiry form asks for your name, email address and what you would like the website to do. Your business name, current website address and how you found us are optional. The form also sends how your visit started: the address of the site that linked you here (the site's name only, never the full page), any campaign tags in the link you followed, and the first page you opened. That is held in your browser only until you send the form or close the tab, and is never stored on your device. Please do not put sensitive information in the message box; the form is intended for project enquiries and is not a secure channel.
The chat on our contact page
If you use the chat, what you type is sent to our server and on to OpenRouter, in the United States, which passes it to the AI model that writes the reply. We do not keep the conversation once the reply is sent. If you ask the chat to fill in our enquiry form, you see the form and decide whether to send it; only a form you send is kept, as an enquiry. Please do not type anything sensitive into the chat.
When you send a form, your browser keeps your name, email address and phone number so the next form or chat can fill them in. They stay on your device and are listed on the cookies page.
Ordinary request information
Serving a web page necessarily involves your IP address, your browser's user agent, the page you asked for and the time you asked for it. Our hosting and security providers process this to deliver the site and to keep it up under attack. We do not build profiles from it and we do not sell it.
Anonymous counts and optional analytics
Before you choose, and after you decline, we still count page views and clicks as anonymous hourly totals. These events carry no visitor or visit identifier and store nothing on your device. They do not create an individual browsing history or a recording. When you choose, we store the choice itself so we can remember it.
Identified analytics and session recording start only after you select Allow analytics, unless your browser refuses them. If you allow them, we record:
- the pages you open, and the order you open them in;
- how long a page was actually visible to you, and how far down it you scrolled;
- links and buttons you click, including when a link takes you to another website;
- how you arrived — the site that linked to you, or a campaign or share tag on the link;
- whether your browser window is phone, tablet or desktop sized, and your browser's language;
- a random id, described below, so a second visit can be recognised as the same browser;
- the country and, where our network provider can tell us, the town your connection appears to come from;
- a one-way scrambled form of your IP address, described below;
- a recording of how you use the pages, described below.
The recording captures what the page looked like and what you did on it — where you moved and clicked, how you scrolled, and how the page changed — so we can watch a visit back and see where the site is confusing. Anything you type into a form is hidden in your browser before anything is sent, so it is never part of a recording. Recordings are tied to the random id below, are seen only by us, and are deleted after 30 days. Declining analytics also stops recording.
Your browser generates the id and stores it on your device. It does not come from your IP address, a device fingerprint, an advertising identifier or data bought elsewhere. The id belongs only to jov.co.za and cannot recognise you on a client's website. Declining analytics or clearing this site's data deletes it, so a later visit starts with a new id.
This is described key by key on the cookies page.
Approximate location and your IP address
We do not store your IP address. Cloudflare, which sits in front of this site, works out a country — and sometimes a town — from the connection at its edge, and we keep that for identified analytics instead of the address. Anonymous counts do not keep a location or a scrambled address for you. Location is approximate. Mobile networks may be placed in the wrong province, and a VPN changes the location that appears to us.
We do keep a one-way scrambled form of the address, computed with a secret key. It cannot be turned back into an address and does not appear in our dashboard. We use it only to spot likely abuse, such as hundreds of apparent visitors coming from one machine, and to recognise a connection we have blocked before. Declining analytics prevents us from recording it.
What we do not do
- No advertising or cross-site tracking cookies, and no ad networks.
- No readable record of your IP address is kept or shown to anybody.
- Your street address is not inferred; what we hold cannot reveal it.
- Personal information is never sold or rented to anybody, for any purpose.
- We do not buy data about you, or enrich what you send us from third-party sources.
- Nothing here makes automated decisions with a legal or similarly significant effect on you.
- The site is not directed at children, and we do not knowingly collect their information.
Signing in to the dashboard
The JOV Dashboard at https://dashboard.jov.co.za is where our clients edit their own website and read the enquiries it receives. It is not part of this website and it is not open to the public: you reach it only if we have created an account for you. Nothing in this section applies to browsing jov.co.za.
You sign in with an account you already have
We do not ask you to invent another password, so there is no password of ours for anybody to steal or for you to reuse. Instead you sign in through an identity provider you already use, it confirms to us who you are, and we issue our own session from that point on.
We ask Google for openid, email, profile — the permissions that identify you, and only those. When you approve the sign-in, Google sends us:
- the identifier Google uses for your account;
- your name, as your Google account states it;
- your email address, and whether Google has verified it;
- your profile picture, if your account has one;
That is the entire list. We never ask for and cannot read your email, your files, your calendar, your contacts or anything else in your Google account, and we do not ask for offline access, so we hold no standing permission that keeps working after you close the browser.
JOV's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Microsoft
We ask Microsoft for openid, email, profile, User.Read — the permissions that identify you, and only those. When you approve the sign-in, Microsoft sends us:
- the identifiers Microsoft uses for your organisation's directory and for your account in it;
- your name, as your work or school account states it;
- your email address;
- your profile photo, if your account has one;
That is the entire list. We never ask for and cannot read your email, your files, your calendar, your contacts or anything else in your Microsoft account, and we do not ask for offline access, so we hold no standing permission that keeps working after you close the browser.
JOV's use and transfer of information received from Microsoft APIs adheres to the Microsoft Privacy Statement.
What we do with it
We use it to put you into the right account and to show your colleagues who made a change. Your name and picture appear to other people on your own team and to us. We store the identifier, your name, your email address and your picture (or, for Google, the address of it) in our database in Centurion, alongside the record of which client sites you may open.
While you use the dashboard, it sends error reports to Sentry and a record of which features you use to PostHog, tied to your account's identifier. Email addresses, ID numbers and phone numbers are masked before an error report leaves your browser or our server. Sentry also records a short, masked replay of some sessions so we can see how a fault happened: every piece of text and every input is hidden, and images are blocked.
What we do not do with it
- It is never sold, rented, or shared with anybody for advertising.
- It is never used to train, fine-tune or evaluate an artificial intelligence model.
- It is not combined with analytics from this website or from any client's website.
- No person at JOV reads it except where you have asked us for support, or where we must investigate abuse or answer a lawful demand.
- It is not transferred to anyone else, other than the hosting provider that runs the database and the error-reporting and usage providers described above, each on our instructions.
Taking it back
You can withdraw our access at your identity provider at any time — for Google, under Third-party apps & services in your Google account. Doing so stops any further sign-in immediately.
To have the account and everything we hold about you deleted rather than merely disconnected, email hello@jov.co.za from the address you sign in with. We delete it within 30 days and confirm when it is done. If the account was created for you by a client of ours, that client can also ask us to close it.
Why we use each kind of information
| Information | Why | Lawful basis |
|---|---|---|
| Your enquiry | To reply, quote, and carry out work you have asked for | Steps toward a contract, and our legitimate interest in answering you |
| Request and security data | To serve the site and defend it against abuse | Legitimate interest in a website that works and stays up |
| Identified analytics and session recordings | To learn which pages are useful, which need improvement, and where people get stuck | Your consent, which you can withdraw at any moment |
| Dashboard sign-in details | To let the right person into the right client account, and nothing else | Performing our contract with you or the client you work for |
| Chat messages | To answer your question and, if you ask it to, fill in the enquiry form for you to check | Your request, since you chose to start the chat, and our legitimate interest in answering you |
| Dashboard error reports and feature usage | To find and fix faults in the dashboard and learn which parts are used | Legitimate interest in a dashboard that works |
| Invoices and correspondence | Tax, accounting and company records | Legal obligation |
Where it is kept
Our database, enquiries, uploaded files and analytics are stored on a server in Centurion, Gauteng.
Some information is processed outside South Africa on the way:
- Requests travel through Cloudflare's global network, which may handle them briefly outside South Africa.
- Emails are sent through Amazon's email service in Sweden.
- Chat messages go to OpenRouter in the United States to be answered.
- Dashboard sign-in goes through Google or Microsoft in the United States, which will know that you signed in to JOV and when.
- Dashboard error reports go to Sentry in the European Union, and dashboard feature usage to PostHog in the United States.
For each of these we rely on section 72(1)(a) of POPIA: the provider is bound by law or by a binding agreement, such as its data processing terms, giving protection substantially similar to POPIA. The full list is under Who else sees it.
How long we keep it
| Enquiries that do not become work | Up to 12 months, then deleted |
|---|---|
| Client project records | For the relationship, and 5 years after it ends for tax and record-keeping |
| Analytics, including location and the scrambled address | Up to 24 months, or immediately on request |
| Session recordings | 30 days, then deleted automatically, or immediately on request |
| Chat conversations | Not kept by us once the reply is sent. A form you send from the chat is kept as an enquiry |
| Dashboard error reports and feature usage | Kept by Sentry and PostHog on their own schedules, then deleted |
| Dashboard sign-in details | While the account exists. Deleted within 30 days of the account being closed |
| Server and security logs | Short-lived, kept by our providers on their own schedules |
Ask us to delete something sooner and we will, unless a law requires us to keep it.
Your rights
Under POPIA you may ask us to:
- tell you whether we hold personal information about you, and give you a copy;
- correct or complete anything that is wrong;
- delete or destroy information we no longer have a good reason to hold;
- stop processing that you object to, where the basis is our legitimate interest;
- stop sending you direct marketing, at any time and at no cost.
You can withdraw analytics consent, which includes recording, at any time. The Cookie settings button in the footer reopens the choice. Declining stops identified tracking and recording immediately, erases the ids and recording counter on your device, and records the refusal. Page views and clicks continue only as anonymous hourly totals, including on later visits. You do not need to email us or give a reason.
If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as a refusal automatically. You will not be asked; only anonymous page-view and click counts are sent, with no identifier or recording. Nothing on our side can override your browser's refusal.
For anything else, email hello@jov.co.za. We will reply within 30 days. We may first ask you to confirm your identity so that we do not disclose your information to another person.
Our PAIA manual describes the records we hold and how to request access to them formally under the Promotion of Access to Information Act.
How to make a complaint
Please start by emailing hello@jov.co.za so we can investigate and respond. You may also lodge a POPIA complaint with the Information Regulator using the details below.
| Regulator | Information Regulator (South Africa) |
|---|---|
| Address | Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 |
| Complaints | POPIAComplaints@inforegulator.org.za |
| Enquiries | enquiries@inforegulator.org.za |
| Website | https://inforegulator.org.za |
Security
Traffic is encrypted in transit. Access to the dashboard and the database is limited to people who need it, sign-ins are rate limited and locked out after repeated failures, and each client's data is separated at the database level rather than by a filter somebody has to remember to apply. Enquiry forms carry anti-abuse measures so that a script cannot flood them.
No system can be perfectly secure. If a breach affects your personal information, we will notify you and the Information Regulator where POPIA requires it. If you find a security problem, please report it privately to hello@jov.co.za so we can investigate.
Changes to this page
We update this page when our practices change and show the latest review date at the top. If a change materially affects what we collect or why, we will ask for consent again. We will not treat silence as agreement.