SIDEQUESTSERVICES

Legal

Privacy Policy

What we collect, why we collect it, and what you can ask us to do about it.

Last updated: 23 September 2026

1. Who We Are

SideQuest Services is a sole proprietorship owned and operated by Shane Albertyn, providing web design, development, hosting, SEO and IT services to businesses in South Africa, together with the SideQuest Services CRM and MediStockZA.

  • Responsible party: Shane Albertyn trading as SideQuest Services
  • Information Officer: Shane Albertyn
  • Trading address: Windgate Park, Pretoria East, Gauteng, 0153, South Africa
  • Email: support@sidequestservices.co.za
  • Telephone: 082 042 1460

This policy describes how we handle personal information under the Protection of Personal Information Act 4 of 2013 (POPIA) and other applicable South African law.

2. Responsible Party or Operator

POPIA distinguishes between the responsible party, who decides why and how personal information is processed, and the operator, who processes it on the responsible party's behalf and on its instructions. Which role we occupy depends on the activity, and it matters because the obligations differ.

  • We are the responsible party for our own business records: website enquiries, quotes, subscription administration, billing, support correspondence, security and audit logs, and our accounting records.
  • We are an operator for the personal information you enter into our systems for your own purposes — your customers, your staff, your suppliers, your patients' practice records. You decide why that information is collected and what happens to it. You are the responsible party for it, and we process it on your instructions.

This applies to the SideQuest Services CRM and to MediStockZA equally. In both, the records you create belong to your business. For MediStockZA, the Service Level Agreement sets these responsibilities out in full.

3. What We Collect

We only collect what we need to answer you and deliver the work.

  • When you use a contact form: your name, email address, the service you selected and the message you write.
  • When you contact us on WhatsApp, by phone or by email: your contact details and whatever you choose to tell us.
  • When you become a client: billing contact details, business address, and the information needed to register domains, set up hosting and issue invoices.
  • Technical information: standard web server logs kept by our hosting provider, such as IP address, browser type and the pages requested.

We do not run advertising trackers or third-party marketing pixels on this website.

Inside our software

Where you use the SideQuest Services CRM or MediStockZA, the information processed may include business and user details, professional identifiers, supplier and representative details, billing records, security and audit logs, uploaded documents, transactions and other information necessary to provide the service.

Where your authorised use involves special personal information or health-related information, you must ensure that the processing is lawful, necessary and appropriately protected. Users should avoid entering unnecessary patient-identifying information into free-text fields, support messages or uploaded documents.

4. Why We Use It

We use your information to respond to your enquiry, to quote, to deliver and support the services you have asked for, to issue invoices and keep accounting records, to secure our systems, and to meet our legal obligations.

We rely on your consent when you submit a form, and on the performance of our contract with you and our legitimate business interests once you are a client. We do not sell your information, and we do not share it with external marketing agencies.

5. Who We Share It With

We share personal information only where it is needed to run the service:

  • Our hosting provider, which stores the website and its data and keeps standard server logs.
  • FormSubmit, the third-party service that delivers this website's contact form submissions to our inbox.
  • Google Fonts. This website loads its typeface from Google's servers, which means Google receives your IP address and basic browser information when a page loads. No cookies are set by this, and we receive no data from it.
  • WhatsApp (Meta), if you choose to contact us through the WhatsApp button. That conversation is governed by WhatsApp's own privacy terms.
  • Cloud infrastructure, email, messaging and storage providers used to run our software products.
  • Domain registrars and payment providers, where a service requires it.
  • Our partner, I NEED IT (PTY) LTD, only where you have specifically asked us to introduce you for marketing services.

Some of these providers process data outside South Africa. Where that happens, we only use providers that offer a comparable level of protection to POPIA.

6. Data Processing Responsibilities

Where we act as an operator, we will process personal information with your knowledge or authorisation and in accordance with lawful instructions, treat the information as confidential, maintain reasonable safeguards, and restrict access to authorised persons.

You are responsible for the lawfulness of the personal information you collect and enter, for appropriate privacy notices to the people it concerns, for reasonable data accuracy, for user access controls, and for responding to requests concerning information you control.

7. How We Protect It

We maintain reasonable technical and organisational safeguards appropriate to the service and the information processed. These may include authentication, access controls, role permissions, secure transmission over HTTPS, logging, backups and incident-response procedures. We keep our systems patched, limit administrative access to what is necessary, and store client documents in access-controlled locations.

You are responsible for reasonable security of your own devices, networks and credentials, and must promptly report suspected compromised credentials or unauthorised access.

8. Security Incidents

We will assess, contain and investigate suspected security incidents. No system is perfectly secure, but where a breach affects personal information we will notify you and the Information Regulator as POPIA requires, through a suitable communication channel.

Where we act as an operator, we will give you the information you reasonably need to meet your own obligations as responsible party.

9. How Long We Keep It

Personal information is retained only for as long as reasonably required for the relevant purpose, contractual obligations, security, disputes, backups and applicable legal requirements.

Enquiries that do not become work are kept for up to 24 months so that we have context if you come back to us. Client and billing records are kept for at least five years, as South African tax legislation requires. After that, information is deleted or anonymised.

When a subscription ends, you may request an available export of your data in a standard format we support. Data may thereafter be deleted or de-identified, subject to applicable legal retention requirements and normal backup cycles.

10. Your Rights and Data Subject Requests

Subject to POPIA and applicable limitations, you have the right to:

  • Ask what personal information we hold about you and request a copy.
  • Ask us to correct or delete information that is wrong, misleading or no longer needed.
  • Object to us processing your information in a particular way.
  • Withdraw consent you previously gave, at any time.
  • Complain to the Information Regulator of South Africa (inforegulator.org.za) if you believe we have not handled your information lawfully.

To exercise any of these, email support@sidequestservices.co.za. We will respond within a reasonable period and may ask you to confirm your identity first. You can also make a request under the Promotion of Access to Information Act by contacting our Information Officer at the same address.

Requests about information a client controls

If your request concerns information held inside a client's CRM or MediStockZA account — for example, records a medical practice keeps about you — that client is the responsible party and the request should be directed to them. Where we act as operator, we will provide them reasonable assistance.

11. Cookies

This website does not set advertising or analytics cookies, and there is no cookie banner because there is nothing to consent to. Your browser may store standard technical data needed to display the page. Pages inside our client portal, the CRM and MediStockZA use a session cookie purely to keep you signed in; it is removed when you sign out or close your browser.

12. Changes to This Policy

We may update this policy as our services change. The version published here is the one that applies, and the date at the top of this page shows when it was last changed. Material changes will be communicated through an appropriate channel before they take effect where required.

Privacy questions or requests: support@sidequestservices.co.za · 082 042 1460.