This notice explains how Tsela (Pty) Ltd, trading as Tsela & Co. (registration number 2026/795884/07) ("Tsela", "we", "us") collects and uses personal information, as the Protection of Personal Information Act, 2013 (POPIA) requires. POPIA protects information about people and about businesses, so this notice covers both.
1. Who we are
Responsible party: Tsela (Pty) Ltd t/a Tsela & Co. · 186 Louis Botha Avenue, Houghton Estate, Johannesburg, 2198 · 074 697 6684 · joeodame@tselaco.com
Information Officer: Joe Odame, Director · joeodame@tselaco.com
2. What we collect and why
| Whose information | What we collect | Why | Lawful basis |
|---|---|---|---|
| Businesses we'd like to work with | Business name, published business email or social account, the name of a founder or contact where it's published, and where we found it | To ask once whether you'd like to hear from us | Our legitimate interest. Electronic marketing only with your consent |
| People who contact us or book a call, workshop or health check | Name, business, email, phone, booking details, your answers, and the link or campaign that brought you to us (for example a social post) | To reply, give you what you asked for, arrange calls and learn which of our posts and ads work | Your request, or steps towards a contract; our legitimate interest |
| Performance Center account holders | Name, business, email, a hashed password (we never see or store the password itself), an encrypted key for your authenticator app if you switch one on, the Terms version you accepted, the time and IP address of sign-up and sign-in, and a security log of account events | To run your account, keep it secure and record what you agreed to | Contract; our legitimate interest in security |
| Clients | Contact and billing details, briefs, meeting notes and material you share | To deliver the work, invoice you and meet our legal and tax duties | Contract; legal obligation |
| Data in the ad, analytics or store accounts you connect | What we need to see in those accounts, using read-only access wherever it's enough (see section 4) | To analyse performance, create and run the ads you approve, and report to you | We act for you, as your operator. You stay the responsible party |
| Payers | Name, email, amount and payment reference. Card details go into PayFast's secure page, and we never see your full card number | To take and record payment | Contract; legal obligation |
| Website visitors | The technical data any website receives (IP address, browser, pages requested). Our fonts load from Google Fonts, which receives your IP address. See section 3 for what we store in your browser | To show the site and keep it secure | Our legitimate interest |
Giving us your information is voluntary, but without contact details we can't reply to you, and without account details we can't open an account for you.
We don't buy or rent contact lists, and we don't sell personal information. We don't knowingly collect children's information.
3. Cookies and your browser
- Sign-in cookie: when you sign in to the client area, we set one secure cookie that keeps you signed in. The site can't work without it, so we don't ask first.
- Your chosen section: we save a small note in your browser of whether you chose Campaigns, Strategy or Websites, so we can take you back there next time. It stays in your browser for 90 days and isn't used for tracking or advertising.
- Campaign link details: if you arrive from one of our posts or ads, we keep the link's campaign tags for your visit and add them to any email you choose to send us.
- Analytics cookies (Google Analytics): only if you accept. They count visits and show us which pages people use and which actions they take (for example sending an enquiry or clicking to book a call), so we can improve the site.
- Advertising cookies (Meta pixel): only if you accept. They tell Meta (Facebook and Instagram) that you visited and whether you took a key step, such as sending an enquiry, booking, signing up or starting a checkout, so we can see which of our ads work and show them to the right people. We don't send Meta your name, email address or the contents of any form.
- Your choice: nothing in these two groups loads until you click Accept (or choose one with "Choose"). Reject is just as easy, and the site works the same either way. We remember your choice for 12 months, and you can change it at any time with "Cookie settings" at the bottom of every page. Google and Meta use this data under their own privacy policies.
4. Data from your Google, Meta and TikTok accounts
When you connect an ad, analytics or store account to the Performance Center, you sign in on that platform's own screen and choose what to allow. We then:
- use the data only to provide the Center to you: reporting, measuring which ads bring customers, and creating and running the ads you approve. We don't sell it, use it for our own advertising, or share it with anyone except the service providers in section 6;
- don't use it to develop, improve or train general AI or machine-learning models;
- let people at Tsela see it only when you've asked us to, to fix a problem, for security, or where the law requires it.
Tsela & Co.'s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
To disconnect and delete your data: remove the connection in the Performance Center (Connections), or remove Tsela & Co. on the platform itself (for Meta: Settings → Business integrations; for Google: your Google Account → Security → Third-party apps & services; for TikTok: Ads Manager → Account settings → Authorized apps). Then email joeodame@tselaco.com with "Delete my data" in the subject. Step by step: Delete your data. We delete the data we received from that platform within 30 days and confirm by email.
5. Direct marketing
- We send one electronic message asking whether you'd like to hear from us, and we send more only if you say yes.
- Reply NO, or email joeodame@tselaco.com, and we'll stop. We keep a note of your opt-out so we don't contact you again by mistake.
- If you ask, we'll tell you where we found your contact details.
6. Who we share it with
Only as needed, with service providers who process it for us under written terms:
- Email, files, calendar and booking pages: Google Workspace
- Website, Performance Center and sign-in hosting and databases: Netlify, and the cloud hosting provider that runs our Performance Center server and database
- Payments: PayFast
- AI tools that help us analyse, draft and create ads, for example Anthropic's Claude. We use only tools whose terms keep your information confidential and don't let it be used to train their models
- Website analytics and advertising, if you accept their cookies: Google (Google Analytics) and Meta (the Meta pixel)
- Ad and analytics platforms you connect (Meta, Google, TikTok), through their official access tools. Your use of these platforms is governed by their own terms
- Freelance marketplace: Upwork, if you hired us there
- Our accountant, and SARS or other authorities where the law requires it
7. Information sent outside South Africa
Some of these providers store or process data outside South Africa, for example in the United States or the European Union. We use providers bound by written data protection terms that give protection substantially similar to POPIA, or we rely on your consent or on performing our contract with you (POPIA section 72).
8. How long we keep it
- Prospects who don't reply or say NO: only the opt-out note and where we found your details, so we can honour your choice.
- Free health check: we remove our access on day 14 and delete your data within 30 days, then confirm by email.
- Client and Center data: we remove access when the engagement ends and delete or return your data within 30 days, then confirm by email.
- Closed Performance Center accounts: deleted within 30 days. Security logs are kept for up to 12 months.
- Business and tax records: 5 years, as the Tax Administration Act requires.
9. How we protect it
2-step verification on our accounts; access only for those who need it; passwords stored as one-way hashes; secure sign-in cookies; read-only access to your accounts wherever possible; and a security-incident log. If we have reasonable grounds to believe your personal information has been accessed or acquired without authority, we'll tell you and the Information Regulator as soon as reasonably possible.
10. Your rights
You can ask to see, correct or delete your personal information, object to how we use it, or withdraw consent at any time. Email joeodame@tselaco.com. We'll acknowledge your request within 2 business days and complete it within 30 days, unless the law requires us to keep the information. Our manual under the Promotion of Access to Information Act (PAIA) is available on request at the same address.
If you're not happy with our answer, you can complain to the Information Regulator: inforegulator.org.za · enquiries@inforegulator.org.za · 0800 017 160.
11. Changes
We'll update this notice when our practices change, and show the date at the top. Our Terms explain how we work with clients.