Privacy Policy — Christo Lochenberg Developments

Effective Date: 1 January 2026 | Last Updated: 21 October 2026
Document Reference: CLD-LEGAL-POPIA-GDPR-2026-V4
Regulatory Compliance: POPIA (Act 4 of 2013) • ECT Act (Act 25 of 2002) • PAIA (Act 2 of 2000) • EU/UK GDPR

1. Regulatory Commitment & Scope

Christo Lochenberg Developments ("CLD", "we", "us", or "our") is committed to engineering software and operating digital infrastructure with bank-grade security and strict respect for data privacy. This Privacy Policy explains how we collect, process, store, secure, and disclose Personal Information in compliance with:

The Protection of Personal Information Act, No. 4 of 2013 ("POPIA") of the Republic of South Africa;
The Electronic Communications and Transactions Act, No. 25 of 2002 ("ECTA");
The Promotion of Access to Information Act, No. 2 of 2000 ("PAIA"); and
Where applicable to international clients and visitors, the General Data Protection Regulation ("GDPR").

2. Responsible Party vs. Operator (Data Processor) Distinction

Because CLD both operates this public platform/licensing network and engineers bespoke software/ERP systems for enterprise clients, our legal role under POPIA and GDPR depends on the context:

CLD as "Responsible Party" (Data Controller): When you browse this website, submit a project inquiry, subscribe to our engineering journal, register a CLD Customer Portal account, or activate a CLD software license, CLD is the Responsible Party determining the purpose and means of processing your Personal Information.
CLD as "Operator" (Data Processor — POPIA Sections 20 & 21): When CLD develops, integrates, maintains, or provides technical support for a Client's own software application, ERP, CRM, or database containing the Client's own customers, employees, tenants, or financial transactions, the Client is the Responsible Party and CLD acts strictly as an Operator processing data on the Client's instructions and under strict confidentiality. In such cases, the Client is solely responsible for ensuring they have a lawful basis and compliant privacy notice for their own end-users.

3. Categories of Personal & Technical Information We Collect

3.1 Identity, Commercial & Project Blueprint Information

When you request a consultation, submit our Contact Form, or engage CLD for software engineering, we collect:

Full name, job title, company/entity name, and VAT/registration details;
Email address, telephone/mobile number, and physical/billing address;
Project specifications, architectural blueprints, budget parameters, and correspondence history.

3.2 Customer Portal, Authentication & Security Audit Data

When you access the CLD Customer Dashboard or Admin/Staff Portal, our system processes:

Account credentials (passwords are cryptographically hashed using one-way bcrypt/Argon2 algorithms and are never stored in plain text);
Two-Factor Authentication (2FA) TOTP cryptographic secrets and encrypted single-use recovery backup codes;
Role-Based Access Control (RBAC) permissions and security audit logs (login timestamps, IP addresses, and system actions recorded in our activity log for forensic security).

3.3 Software Licensing, Anti-Piracy & OTA Update Telemetry

If you install or operate a CLD-licensed software application (such as Keystone ERP/Accounting, Support Desk, or custom licensed builds), the embedded licensing client automatically transmits technical heartbeat telemetry to our licensing network, including:

Assigned License Key and Customer ID;
Registered application domain name, base URL, and server IP address;
Server environment metadata (PHP version, OS family, hardware/instance fingerprint hash, and currently installed software version);
Verification timestamps, kill-switch status checks, and Over-The-Air (OTA) update execution logs.

3.4 First-Party Website Analytics & Interaction Telemetry

To measure site performance, diagnose errors, and defend against automated bots/brute-force attacks, our internal first-party analytics middleware records:

IP address and approximate geographic region (country/city derived via non-intrusive IP lookup);
Browser type, operating system, device category (desktop/mobile/tablet), and viewport resolution;
Pages visited, referrer URL, UTM campaign parameters, time on page, and UI interaction events (such as filter usage or CTA clicks).

3.5 Blog Comments & Newsletter Subscriptions

When you post a comment on an Engineering Journal article or subscribe to updates, we collect your submitted display name, email address, comment content, and IP address for spam and abuse prevention.

4. Lawful Basis & Purpose of Processing (POPIA Section 11)

We process Personal Information strictly for lawful, specific, and explicitly defined purposes:

Contractual Performance: To scope, engineer, deliver, license, update, and support software systems and fulfill our obligations under client agreements;
Legitimate Interests: To verify software licenses, prevent unauthorized copying/piracy, protect our servers against cyber-attacks, and analyze aggregate website performance;
Statutory & Tax Compliance: To maintain accurate accounting, invoicing, and SARS tax records as required by South African law;
Consent: Where you voluntarily submit an inquiry, subscribe to our newsletter, or enable optional features (which consent you may withdraw at any time).

5. Cookies, LocalStorage & Session Technologies

Our platform uses strictly necessary and functional browser storage technologies rather than intrusive third-party ad-tracking networks:

Essential Security Cookies: XSRF-TOKEN (protects against Cross-Site Request Forgery attacks) and encrypted Laravel session cookies (maintains authenticated portal state);
UI Preference Storage (localStorage): Stores your visual theme preference (theme: 'dark' | 'light') so the interface remembers your selected mode across visits;
Analytics Session Identifier: Associates page views within a single browsing session without cross-site behavioral profiling.

You may clear or block cookies via your browser settings at any time, though disabling essential session cookies will prevent login to the Customer or Admin Portals.

6. Data Sharing, Sub-Processors & Cross-Border Transfers

CLD never sells, rents, or trades your Personal Information to any third party or data broker. We only share data where strictly necessary to operate our services:

Infrastructure & Hosting Providers: Secure web hosting, database servers, and encrypted backup storage providers;
Transactional Communication Relays: Configured SMTP email servers used to dispatch system notifications, 2FA alerts, invoices, and inquiry responses;
Statutory Authorities: Where disclosure is compelled by a valid subpoena, court order, or statutory obligation under South African law.

Where any cloud infrastructure or sub-processor is located outside the Republic of South Africa, transfers are conducted in accordance with Section 72 of POPIA, ensuring the recipient jurisdiction or provider upholds an adequate level of data protection and encryption.

7. Technical & Organizational Security Safeguards (POPIA Section 19)

As an enterprise software architecture practice, CLD implements rigorous technical defenses to protect Personal Information against loss, damage, or unauthorized access:

Transport & Cryptographic Security: Full HTTPS/TLS encryption in transit and one-way cryptographic hashing for all passwords and authentication tokens;
Multi-Factor Authentication: Native Time-Based One-Time Password (TOTP) 2FA and granular Role-Based Access Control (RBAC);
Application Hardening: Strict MVC input validation, parameterized database queries (SQL injection defense), Content Security protections, and automated rate-limiting/brute-force throttling;
Incident Response: In the unlikely event of a confirmed security compromise affecting your Personal Information, CLD will notify the Information Regulator of South Africa and affected Data Subjects as required by Section 22 of POPIA.

8. Data Retention & Secure Destruction

We retain Personal Information only for as long as necessary to fulfill the purposes outlined in this Policy or comply with statutory retention periods:

Client Contracts, Invoices & Financial Records: Retained for a minimum of five (5) years in compliance with the South African Tax Administration Act and Companies Act;
Software Licensing & Security Logs: Retained for the duration of an active software license plus twenty-four (24) months for audit and anti-piracy verification;
First-Party Website Analytics: Retained in aggregated or rotatable log format and periodically purged via Admin maintenance routines.

9. Your Statutory Rights as a Data Subject

Under POPIA (Sections 5 and 23–25) and GDPR, you have the right to:

Request Access: Confirm whether CLD holds Personal Information about you and request a copy of such records;
Request Correction or Deletion: Request that inaccurate, outdated, or excessive Personal Information be updated or erased (subject to statutory tax/contractual retention requirements);
Object to Processing: Object on reasonable grounds to the processing of your Personal Information or opt out of direct electronic communications at any time;
Lodge a Regulatory Complaint: If you believe your privacy rights have been infringed, we encourage you to contact us first so we can resolve the matter promptly. You also have the statutory right to lodge a complaint with the Information Regulator (South Africa):
- Website: https://inforegulator.org.za
- General Enquiries: enquiries@inforegulator.org.za
- POPIA Complaints: POPIAComplaints@inforegulator.org.za

10. Information Officer & Privacy Contact Details

To exercise any of your Data Subject rights, submit a PAIA/POPIA request, or inquire about our security practices, please contact our designated Information Officer:

Information Officer: Christo Lochenberg
Organization: Christo Lochenberg Developments
Location: Centurion, Gauteng, Republic of South Africa
Contact Channel: Via our official Contact & Consultation Portal.