Legal
Privacy Policy
This policy describes how CodeTonight (Pty) Ltd (“we”, “us”, “our”) handles personal information collected via the GRASP website (grasp-web-chi.vercel.app). We are a South African juristic person. South Africa’s Protection of Personal Information Act 4 of 2013 (POPIA) is our primary data-protection framework; the EU General Data Protection Regulation and UK GDPR apply where they govern the personal data of EU or UK residents.
1. Who we are
CodeTonight (Pty) Ltd is the responsible party (controller) for the purposes of POPIA. Our Information Officer can be contacted at development@codetonight.co.za.
2. Information we collect
We collect only what you voluntarily submit via the NDA request form: your name, organisation, role, work email address, and a brief description of your intended use case. We do not set cookies, run analytics scripts, or collect device fingerprints. The GRASP demonstration tools run entirely in your browser; no inputs or outputs from those tools are transmitted to or stored by us.
3. Purpose of processing
We use the information you provide solely to (a) evaluate whitepaper requests and (b) contact you in connection with the GRASP evaluation programme, in accordance with the purpose-specification requirement of POPIA s 13. We will not sell, licence, or disclose your personal information to third parties for marketing purposes.
4. Legal basis for processing
POPIA (South Africa): processing is based on your consent (POPIA s 11(1)(a)) given when you tick the Confidentiality Undertaking checkbox and submit the request form. You may withdraw consent at any time by contacting us, after which we will no longer process your personal information for new purposes and will delete it within a reasonable period.
GDPR / UK GDPR (where applicable): processing is based on consent (Art. 6(1)(a)). You may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
5. Data storage and processors
The GRASP site is a fully static site hosted on Vercel (Vercel Inc., United States). Form submissions travel directly from your device to your email application via a mailto: link; no form data is transmitted to or stored on any CodeTonight or Vercel server. Vercel does, however, log subject infrastructure data (IP addresses, request timestamps, and HTTP request headers) as part of normal CDN operation; those logs are retained by Vercel in accordance with Vercel’s own privacy policy.
Email messages you send to us are processed by Google LLC (Google Workspace), acting as a sub-processor under a data-processing agreement consistent with POPIA s 21.
6. International transfers
Vercel and Google LLC are entities incorporated in the United States. Any processing they perform constitutes a cross-border transfer of personal information within the meaning of POPIA s 72. Both companies maintain internationally recognised security certifications (including SOC 2 Type II and ISO 27001). Where EU or UK residents are concerned, transfers are governed by standard contractual clauses or equivalent mechanisms recognised under the applicable legislation.
7. Retention
We retain personal information submitted to us for a maximum of 12 months from the date of receipt, or until the evaluation process in which it was provided is concluded, whichever comes first. After that period we will securely delete your personal information from our systems.
8. Security
We take reasonable technical and organisational measures to protect personal information against loss, unauthorised access, disclosure, alteration, or destruction, in accordance with POPIA ss 19 and 22. The Site is served exclusively over HTTPS/TLS. In the event of a security compromise that materially affects your personal information, we will notify you and the Information Regulator as required by POPIA s 22.
9. Your rights
Under POPIA you have the right to request access to, correction of, and deletion of your personal information, and to object to its processing (POPIA s 23). Under the GDPR/UK GDPR (where applicable) you have additional rights of portability, restriction, and the right to lodge a complaint with the relevant supervisory authority. To exercise any of these rights, contact us at development@codetonight.co.za.
10. Access to information (PAIA)
Our PAIA s 51 manual is available on request from development@codetonight.co.za.
11. Changes to this policy
We may update this policy from time to time. The version number and effective date shown above will reflect any changes. Continued use of the Site after an update constitutes acceptance of the revised policy.