1. Who we are
Central Studio (Pty) Ltd is a digital agency registered in South Africa. We build websites, web and mobile applications, brand identities, and we run social media for our clients.
| Registered name | Central Studio (Pty) Ltd |
|---|---|
| Registration number | 2021/916757/07 |
| VAT number | 4800304463 |
| Address | Afvan Business Park, 10 Haggie Road, Anderbolt, Boksburg, 1459, Gauteng, South Africa |
| hello@centralstudio.co.za |
This policy is written to meet the requirements of South Africa's Protection of Personal Information Act 4 of 2013 (POPIA). Where we work with clients or users outside South Africa, we apply the same standard.
2. This website collects nothing
centralstudio.co.za sets no cookies, runs no analytics, and has no contact form. There is no Google Analytics, no advertising pixel, and no tracking script of any kind on this site. The only way to contact us from this site is an email link, which opens your own email program.
Our hosting provider keeps standard server logs, which may include your IP address, browser type and the pages you requested. These are generated automatically as part of delivering the site securely, are used only to keep it running and to investigate abuse, and we do not use them to identify or profile you.
3. Information we hold, and why
3.1 If you contact us
When you email or message us we hold your name, contact details and whatever you choose to tell us. We use it to answer you, to quote, and to keep a record of what was agreed. The lawful basis is your consent and, once we are working together, the performance of our contract.
3.2 If you are a client
We hold the business and contact information needed to deliver and invoice the work: contact people, billing details, project material, and correspondence.
3.3 Information belonging to our clients' customers
This is the important distinction. When we build or run a system for a client, personal information about their customers passes through it. For that information, our client is the responsible party and Central Studio is an operator under POPIA section 20.
That means we process it only on our client's instruction, we do not use it for our own purposes, we do not sell it, and we do not share it except as described below or as the client directs. If you are a customer of one of our clients and want your information changed or removed, please contact that business directly. If you contact us instead, we will pass your request on and tell you we have done so.
4. Who else processes it
We use established service providers to run our business. Each one only receives what it needs to perform its function.
| Provider | What it does | Where |
|---|---|---|
| Microsoft 365 | Email and document storage | EU / global |
| Supabase | Databases behind the applications we build | Regional, per project |
| Vercel | Website hosting | Global edge, incl. Cape Town |
| Railway | Application hosting | Global |
| Cloudflare | DNS and network security | Global |
| Sentry | Error monitoring for the software we maintain | EU / US |
| Meta Platforms | Managing client Facebook and Instagram pages | Global |
| Analytics and Search Console, on client properties | Global | |
| Anthropic | AI assistance used in our internal work | US |
Some of these process information outside South Africa. POPIA section 72 permits this where the recipient is bound by rules or a contract that provide an adequate level of protection. We rely on each provider's data processing agreement and standard contractual clauses for that purpose.
We do not sell personal information, and we do not share it for anyone else's marketing.
5. How long we keep it
- Enquiries that do not become work — up to 24 months, then deleted.
- Client records — for the life of the relationship, and afterwards for as long as the Companies Act and the Tax Administration Act require us to keep financial records, which is generally five years.
- Client systems we operate — for as long as our client instructs. On the end of an engagement we return or delete the data at their direction.
6. Keeping it secure
We use encrypted connections throughout, restrict access to the people who need it, hold credentials in a password manager rather than in documents or messages, and monitor the applications we maintain for errors and intrusions. No system is perfectly secure, but if a breach affects your personal information we will notify you and the Information Regulator as POPIA section 22 requires.
7. Your rights
Under POPIA you may:
- ask what personal information we hold about you, and get a copy;
- ask us to correct or delete information that is wrong, misleading or no longer needed;
- object to processing based on our legitimate interests;
- withdraw consent at any time, where we relied on consent;
- complain to the Information Regulator.
Email hello@centralstudio.co.za and we will respond within 30 days. We may ask you to confirm a detail so we can be sure the request is really yours.
The Information Regulator (South Africa) can be reached at inforegulator.org.za, or at enquiries@inforegulator.org.za.
8. Children
Our services are aimed at businesses. We do not knowingly collect personal information from children. If you believe we hold information about a child, tell us and we will delete it.
9. Changes to this policy
If we change how we handle personal information we will update this page and change the date at the top. Material changes will be communicated to active clients directly rather than left to be noticed here.
10. Contact
Questions about this policy, or about anything we hold:
hello@centralstudio.co.za
Central Studio (Pty) Ltd, Afvan Business Park, 10 Haggie Road, Anderbolt, Boksburg, 1459