Privacy notice

This notice is given by Yoros, the trading name of Stéan Bouwer, a sole proprietor in the Republic of South Africa. Under the Protection of Personal Information Act 4 of 2013 — POPIA — he is the responsible party for the personal information described here.

Information officer: Stéan Bouwer, contact@yoros.co.za.

There is one processing purpose behind everything below: answering an enquiry, and then doing the work if it becomes an engagement. That is the whole register.

No personal information reaches me from its public pages. There is no newsletter signup, no analytics, no advertising and no cookies. There is no account to create, and nothing you do on these pages is sent anywhere or associated with you.

Those three words — its public pages — are load-bearing, and they were added on 2026-09-01 rather than written at the start. The site now also carries a login, used by me and by clients where an engagement calls for it. That is the one place this site holds anything about a person, and it has its own section below.

There is one form, and it is worth being exact about — this page said "no form" until 2026-08-31, and that stopped being true on the day the diagnostic intake shipped. The intake asks about your organisation and what you are trying to change. What you type into it is kept in your own browser and nowhere else, so that closing the tab does not cost you twenty minutes of work. There is no step that sends it to me: no request carries it, no server receives it, and I cannot read it. If you want me to see what it produced, you tell me — by email, by phone, or on a call.

Four values are therefore stored in your own browser, and none holds anything I can see: that intake draft, a key recording that the opening animation has played so it does not play again, and two that keep the background of an article or a project page from repeating. The cookie notice names all four, says how long each one lasts, and says how to remove them.

The site is hosted by Vercel, which processes standard server request data — including your IP address — to deliver the pages and defend against abuse. That is infrastructure rather than a choice I have made about you, and it is the only processing that happens without you doing anything.

Fonts are self-hosted, so loading a page makes no request to a font provider.

Almost nobody does. There is no account to create and no public sign-up: the only logins that exist are mine and, where an engagement calls for it, a client's, issued by me. If you have never been given one, this section does not describe you and nothing in it happens.

Where a login does exist, the site holds what is needed to operate it. The credential itself is a passkey or an authenticator app code — I never see a password, because there are none. Alongside it sits an audit trail of sign-in attempts, successful and failed, recording the time, the action, the browser's user-agent string, and a keyed one-way hash of the IP address rather than the address itself. The failed attempts are the point: a run of them is the only thing that would ever tell either of us that someone was trying.

That data lives in a Supabase database. It is kept for as long as the login exists and for twelve months after it ends, for security review, and then deleted. An attempt that cannot be tied to a login, such as a failed sign-in with a key the site does not know, is deleted twelve months after it was made. It is used for nothing but operating and defending the login.

If any of this changes — and it will, when booking is added — this page changes with it. It said "before the feature ships rather than after", and the intake is where that promise was broken rather than kept: the form shipped first and this page caught up afterwards. What replaced the promise is a check that fails the build when a value is stored in your browser that the cookie notice does not name.

If you email, call or message me on LinkedIn, I hold what you send: your name, your contact details, and whatever you tell me about your business. I use it to reply to you and, if we work together, to do the work.

The lawful basis is straightforward. Before an engagement, it is your own request — you asked me a question and I cannot answer it without reading it. During one, it is the contract between us. Neither needs separate consent, and I do not ask for any, because a consent request you cannot refuse is not consent.

Nobody who is not working on your engagement.

I do not sell personal information, rent it, or share it for anyone else's marketing. Where a client engagement requires a subcontractor or a named specialist, I say so before it happens rather than after.

Email is carried by an ordinary mail provider and is stored there. That is a processing arrangement rather than a disclosure, and it is worth knowing that email is not a confidential channel by nature. If something genuinely should not be in an inbox, say so and we will find another way to move it.

The suppliers who handle any of it, in full. POPIA calls these operators — they process on my instruction and for no purpose of their own.

That is the whole list. If it grows, this page grows with it.

Vercel runs the parts of the site that work on request, the login among them, in Washington, D.C., in the United States, and serves the pages themselves from whichever of its locations is nearest you.

The suppliers above operate outside the Republic, so personal information handled by them is processed abroad. POPIA permits that where the recipient is bound by rules or a contract giving effect to protection substantially similar to POPIA's own, which is the basis relied on here: each of them is engaged on their standard data-processing terms, which carry those obligations.

Where information is sent abroad because it is necessary to perform a contract with you — a meeting invitation reaching your calendar, for instance — that is permitted on its own footing.

I have said this plainly rather than omitting it because a one-person practice in South Africa running on foreign infrastructure is the ordinary case, not a disclosure that needs softening.

For as long as there is a reason to, and no longer.

An enquiry that goes nowhere is deleted once it is clear it has. An engagement's records are kept for as long as the work and the law require — South African tax legislation sets the floor, not my preference — and then deleted.

POPIA gives you the right to ask what personal information I hold about you, to have it corrected if it is wrong, to have it deleted, to object to how it is being used, and to withdraw a consent you gave.

Ask, and I will do it. There is nothing to fill in and there is no fee. Write to contact@yoros.co.za and I will respond within the period POPIA allows, usually much sooner — there is one of me and not much data.

A formal request for access to a record is made under PAIA rather than under POPIA — a different Act, and a different procedure. Write to contact@yoros.co.za and I will send you the prescribed form and the steps that follow it.

You may complain to the Information Regulator of South Africa directly, and you do not have to raise it with me first. Their contact details are published at inforegulator.org.za.

I would rather hear about it, but that is my preference and not a condition.

The public pages hold no data, so there is nothing on them to breach. What the login holds is described above: passkeys and authenticator codes rather than passwords, and an audit trail whose IP field is a keyed one-way hash rather than an address. Neither a stolen database nor I can turn that hash back into where you were sitting.

The rest of what I hold sits in ordinary business systems — email, a laptop, a cloud drive — with the ordinary protections: full-disk encryption, multi-factor authentication, and no shared logins.

I am not going to claim more than that. A one-person practice describing enterprise security controls it does not have is worse than one describing what it actually does.

Were a breach to happen and were it to put you at real risk, POPIA requires notification of both you and the Regulator, and I would.

If this notice changes, the new version appears here with its own effective date and version. Anything material is dated rather than slipped in.