Home  /  Privacy notice
Legal · POPIA

Privacy notice

This notice explains how The Brains Factory collects, uses and protects your personal information, and the rights you have under South Africa's Protection of Personal Information Act (POPIA).

Last updated: 21 August 2026

1. Who we are

The Brains Factory ("we", "us", "our") is a South African software company based in Bryanston, Johannesburg, building custom software, websites and enterprise systems since 2004. For the purposes of POPIA, we are the responsible party for the personal information described in this notice.

Our Information Officer, appointed under POPIA, is responsible for making sure we handle personal information lawfully:

  • Information Officer: Schumelle Daniels
  • Email: info@brains.co.za
  • Postal address: PostNet 119, Private Bag X21, Bryanston, 2012

2. What personal information we collect

We only collect the personal information you choose to give us. When you complete the contact form on this website, we collect:

  • Your name – so we know who we are talking to.
  • Your email address – so we can reply to your enquiry.
  • The content of your message – the details of the project or question you send us, including anything you choose to include in that message.

We do not require any special personal information (such as health, religious or financial details) to answer an enquiry. Please do not send us information you would not want to share by email.

Our website may also collect limited technical information (such as your browser type and general usage) through standard hosting logs. This website does not use analytics tools and does not set cookies. The only third-party services your browser contacts are Google Fonts, which delivers the site's typefaces and receives standard request data such as your IP address, and Formspree when you submit the contact form (see section 5).

3. Why we collect it and how we use it

We use the personal information you submit through the contact form only for the following purposes:

  • To respond to your enquiry and to correspond with you about it.
  • To understand what you would like us to build and to prepare a scope, quote or proposal if you ask for one.
  • To keep a record of our communication with you for legitimate business and legal purposes.

We do not use your information for automated decision-making, and we do not sell your personal information to anyone.

4. Our lawful basis for processing

Under POPIA we process your personal information because you have given it to us voluntarily and consented to us using it to respond to your enquiry, and because doing so is necessary to take steps, at your request, towards a possible working relationship. You can withdraw your consent at any time by contacting us using the details below.

5. Who we share it with

We treat your information as confidential. We may share it only where necessary with:

  • Our team – the people at The Brains Factory who need it to respond to you.
  • Trusted service providers (operators) who process information on our behalf, under agreements that require them to protect it. Specifically: Formspree, Inc., which receives and forwards contact-form submissions, Google Workspace, which provides our email, and Microsoft Azure, which hosts our own web server.
  • Authorities or advisers where we are required to do so by law.

Where any of these providers process information outside South Africa, we take reasonable steps to ensure a comparable level of protection, as required by POPIA. In particular, contact-form submissions are processed by Formspree in the United States before being delivered to us, and our email runs on Google Workspace, which may process it on Google's global infrastructure.

6. How long we keep it

We keep the personal information you send through the contact form only for as long as we need it for the purposes described above, or for as long as the law requires us to keep it, after which we delete or de-identify it.

Our standard retention period for contact-form enquiries is 24 months from our last contact with you.

7. How we protect it

We take reasonable, appropriate technical and organisational measures to safeguard personal information against loss, unauthorised access and misuse, in line with our two decades of building secure systems. No method of transmission over the internet is completely secure, but we work to protect your information and to keep those measures under review.

8. Your rights under POPIA

As a data subject you have the right to:

  • Ask whether we hold personal information about you, and request access to it.
  • Ask us to correct or delete personal information that is inaccurate, irrelevant, excessive, out of date or obtained unlawfully.
  • Object, on reasonable grounds, to our processing of your personal information.
  • Withdraw any consent you have given, without affecting processing that already took place.
  • Lodge a complaint with the Information Regulator (see below).

To exercise any of these rights, please contact our Information Officer using the details in section 1. We may need to verify your identity before acting on a request.

9. Complaints to the Information Regulator

If you believe we have not handled your personal information lawfully, you may lodge a complaint with the Information Regulator of South Africa:

We would, however, appreciate the chance to address your concern first, so please feel free to reach out to us before you do.

10. Changes to this notice

We may update this notice from time to time as our practices or the law change. When we do, we will revise the "last updated" date at the top of this page. Please check back occasionally to stay informed.

11. Contact us

If you have any questions about this notice or about how we handle your personal information, please get in touch: