Firewater Interactive CC (“Firewater”, “we”, “us”, “our”) is a digital agency based in South Africa. This Privacy Policy explains how we process personal information when you use our websites, contact us, or engage our services, and when we run campaigns for our clients that involve handling their customers’ data.
This notice is designed to align with the Protection of Personal Information Act, 2013 (POPIA). It should be read together with any client contracts and our Cookie Notice.
Responsible party (for our own sites and business operations):
Firewater Interactive CC, 16 Fricker Road, Illovo, Johannesburg, Gauteng, 2191, South Africa.
Email: privacy@firewater.net
Information Officer: For a private body, the Information Officer is the “head” as defined under PAIA. Firewater’s head delegates day‑to‑day privacy queries to the contact above. Formal POPIA/PAIA requests may be addressed to the Information Officer at the same postal and email addresses.
This policy covers processing when you visit firewater.net, contact us, apply for a job, or we provide services to you. It also covers processing when we run campaigns for our clients that involve handling their customers’ personal information.
The categories of personal information we may process include:
We do not seek to collect special personal information (such as health, biometrics, or religious beliefs). If a campaign requires it, we will only process it where permitted by POPIA and the Information Regulator’s guidance, and as instructed by the responsible party.
We process personal information only where there is a lawful justification under POPIA, including:
Typical purposes include: running and measuring campaigns; hosting landing pages; managing leads; A/B testing and analytics; client reporting; customer service; invoicing; and protecting our rights.
STOP to SMS.We use cookies and similar technologies for site functionality, security and analytics (for example, Google Analytics). You can control cookies via your browser settings and available opt‑out tools provided by analytics vendors.
We use trusted operators (service providers) to host our infrastructure, deliver campaigns, send communications, and provide analytics and support. We require them to keep information confidential, use it only on our documented instructions, apply appropriate security, and assist us to meet POPIA obligations.
We may also share information where required by law, to protect our rights, during corporate transactions, or with our professional advisers (subject to confidentiality).
Some operators or systems may be located outside South Africa. When we (as responsible party) or our clients (as responsible party) transfer personal information cross‑border, we ensure that the recipient is subject to a law, binding corporate rules, or binding agreement that provides an adequate level of protection, or another condition for transfer under section 72 POPIA applies. We keep records of such arrangements.
Special personal information: We avoid processing special categories unless permitted by law and necessary for the campaign/service, in which case we implement additional safeguards and (where required) obtain explicit consent.
Children: We do not knowingly process children’s personal information without the consent of a competent person (such as a parent/guardian) or another lawful ground recognised by POPIA. If we learn we have collected such information unlawfully, we will delete it.
We implement reasonable and appropriate technical and organisational measures to secure personal information, including access controls, encryption in transit, network monitoring, and staff confidentiality undertakings.
If a security compromise occurs that creates a real risk of harm, we (or our client, where they are the responsible party) will notify affected data subjects and the Information Regulator as required by section 22 POPIA, and we will cooperate with investigations and mitigation.
We retain personal information only as long as necessary for the purposes described or as required by law, after which we securely delete or de‑identify it. Typical retention periods:
| Category | Examples | Typical retention |
|---|---|---|
| Campaign engagement data | Email/SMS interaction logs, landing‑page analytics | up to 24–36 months |
| Lead records | Form submissions, competition entries | up to 24 months after last activity, unless required longer for legal claims |
| Client project files & finance | Statements, invoices, contracts | 7 years (tax and commercial law) |
| Support correspondence | Tickets and email threads | up to 24 months |
| Recruitment | CVs, interview notes | up to 12 months unless consent obtained to keep longer |
Subject to limits in POPIA and PAIA, you have the right to:
You may exercise your rights or ask questions by emailing privacy@firewater.net. We’ll verify your identity before acting and respond within timelines set by law.
If you are not satisfied, you can complain to the Information Regulator (South Africa):
General enquiries: enquiries@inforegulator.org.za
Complaints (POPIA): POPIAComplaints@inforegulator.org.za
Website: inforegulator.org.za
We may update this policy from time to time. Material changes will be communicated on this page and, where appropriate, directly to you.
“POPIA” means the Protection of Personal Information Act, 2013.
“Personal information” means information relating to an identifiable natural person (and, where applicable, a juristic person).
“Responsible party” means the person who determines the purpose of and means for processing personal information.
“Operator” means a person who processes personal information for a responsible party in terms of a contract or mandate.
“Special personal information” includes, for example, health, biometrics, and religious beliefs.
“Child” means a natural person under 18 years who is not legally competent without the assistance of a competent person.
This policy is intended to reflect POPIA requirements in a practical way for Firewater’s operations. It does not constitute legal advice.