Privacy policy — Isago Architecture privacy policy (POPIA)

Last updated: 15 July 2026 · Version 1.0 (draft for review)

1. Who we are

This Privacy Policy is issued by Isago Architecture CC (Registration No 2007/090302/23, VAT No 4510238548) ("Isago", "we", "us"), an architectural design and consulting firm with offices at 200 Cumberland Avenue, Bryanston, Johannesburg 2191 and 21 Emerald Street, Riviera Park, Mafikeng 2745, South Africa. Isago is the "responsible party" for the purposes of the Protection of Personal Information Act 4 of 2013 ("POPIA").

This policy explains how we collect, use, store, share and protect your personal information when you use www.isago.co.za (the "website") or otherwise interact with us.

2. The information we collect

We only collect personal information that you provide to us directly, namely:

• Enquiry and consultation details — your name, email address, telephone number, project type, nearest office, and the content of your message, when you complete our consultation or contact forms;
• Correspondence — information you share when you contact us by email, telephone or WhatsApp;
• Client and project information — information reasonably required to deliver architectural and project management services, where you appoint us.

Our website hosting provider may record limited technical data (such as IP address and browser type) in standard server logs for security purposes. We do not knowingly collect personal information from children under 18, and we do not collect special personal information (such as health, biometric or religious data) through this website.

3. How and why we use it

We process personal information lawfully, minimally and for specific, defined purposes:

• To respond to your enquiry or consultation request — on the basis of your consent and steps taken at your request prior to entering into an agreement;
• To provide architectural, consulting and project management services — for the performance of our agreement with you;
• To comply with legal and regulatory obligations (including tax, professional and record-keeping requirements); and
• To protect our legitimate interests, such as maintaining the security of our website and establishing or defending legal claims.

4. Direct marketing

We do not currently send electronic direct marketing or newsletters. Should this change, in line with section 69 of POPIA we will only send electronic direct marketing if you have opted in, or if you are an existing client and the communication relates to similar services, and every message will contain a clear unsubscribe option. We do not send unsolicited marketing.

5. Sharing your information

We do not sell personal information, and we do not share it with third parties for their own marketing. We share personal information only with:

• Service providers (operators) who process information on our behalf — such as our website hosting provider, form-processing service and email providers — under obligations of confidentiality and security;
• Professional advisers and consultants engaged on your project, where necessary to deliver our services;
• Regulators, courts or authorities where disclosure is required by law.

6. Cross-border transfers

Some of our service providers (for example, our form-processing and email services) may store or process information on servers located outside South Africa. Where this occurs, we will only transfer personal information as permitted by section 72 of POPIA — that is, where the recipient is subject to laws or binding agreements that provide a substantially similar level of protection, or with your consent.

7. Cookies

This website does not currently use analytics, advertising or tracking cookies. Only strictly necessary technical functionality is used. If we introduce cookies or analytics in future, we will update this policy and, where required, request your consent.

8. Security

We take appropriate, reasonable technical and organisational measures to protect personal information against loss, damage, unauthorised access or unlawful processing, as required by section 19 of POPIA. If we have reasonable grounds to believe that your personal information has been accessed by an unauthorised person, we will notify the Information Regulator and, where required, you, as soon as reasonably possible.

9. Retention

We retain personal information only for as long as necessary to fulfil the purposes set out above, or as required by law (for example, financial records retained in terms of tax legislation, and project records retained in line with professional and contractual requirements). Thereafter, records are securely deleted or de-identified.

10. Your rights

Subject to POPIA and the Promotion of Access to Information Act 2 of 2000 ("PAIA"), you have the right to:

• Request confirmation of whether we hold personal information about you, and request access to it;
• Request correction or deletion of personal information that is inaccurate, outdated, excessive or unlawfully obtained;
• Object, on reasonable grounds, to the processing of your personal information;
• Withdraw any consent you have given, at any time;
• Lodge a complaint with the Information Regulator (South Africa):
  JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
  POPIAComplaints@inforegulator.org.za · enquiries@inforegulator.org.za · inforegulator.org.za

To exercise any of these rights, contact our Information Officer (below). Requests for access to records are handled in terms of our PAIA manual, available on request.

11. Information Officer

Natalie Gettliffe — Information Officer
Email: info@isago.co.za
Tel: 011 463 7911 (Johannesburg) · 018 381 6762 (Mafikeng)

12. Changes to this policy

We may amend this policy from time to time. The current version will always be published on this page with its effective date. Material changes will be highlighted on the website.

13. Governing law

This policy is governed by the laws of the Republic of South Africa.