Your data, plainly.

We sell evidence, so we will not be vague about yours. This is what we collect on this website, why, where it lives, and the rights you have over it, under South Africa’s POPIA and, for visitors it applies to, the EU’s GDPR.

1. Who we are

This website is operated by Kitchfors CC t/a The Rebellion (registration number 2008/263232/23), a performance marketing agency based in Cape Town, South Africa, with team members in Prague and Gothenburg (“The Rebellion”, “we”, “us”). For the purposes of the Protection of Personal Information Act, 2013 (POPIA) we are the responsible party, and for the purposes of the EU General Data Protection Regulation (GDPR), where it applies to visitors from the European Economic Area or the UK, we are the controller of the personal information described here.

Privacy questions, requests and complaints: [email protected], or use the contact form. Postal address: 7 Roodevos Crescent, Langebaan, Western Cape.

2. What we collect, and why

Enquiry forms. The contact form collects your name, email address and message. The Reality Check Audit form additionally collects a monthly investment band, a starting timeline and, optionally, the service you are interested in. We use this information for one purpose: to respond to your enquiry and, if you become a client, to run the engagement. Lawful basis: consent (you chose to send it) and the legitimate interest of responding to a request you initiated (GDPR art. 6(1)(a) and (f); POPIA s 11(1)(a) and (f)).

Rate-limiting data. When you submit a form we store a salted cryptographic hash of your IP address, used only to limit abusive repeat submissions. The raw IP address is not kept at rest and the hash cannot be reversed into it.

Bot protection.Forms are protected by Cloudflare Turnstile, which runs invisibly (there is no checkbox) and processes technical signals (including your IP address, transiently) to distinguish people from bots. This is a security measure (POPIA s 19; GDPR art. 32). Cloudflare’s handling of this data is described in the Cloudflare Turnstile Privacy Addendum.

Analytics and marketing cookies, only with your consent.With your opt-in via the cookie banner, we use Google Analytics 4 to understand how the site is used, and the Meta pixel to measure our own advertising. These load through Google Tag Manager and fire only after you consent; declining changes nothing about how the site works. You can withdraw consent at any time via “Cookie preferences” in the footer.

Booking links.If you book a call through our scheduling link, the booking is handled by Google Calendar’s appointment service under Google’s own terms and privacy policy.

3. Where your information lives

Form submissions are stored in a database on our South African hosting provider, xneelo, in a restricted environment. Access is limited to the people who need it to answer your enquiry.

Some of our processors operate outside South Africa and the EEA: Google (Tag Manager, Analytics, Calendar), Meta and Cloudflare may process data in the United States and elsewhere. Where they do, the transfer relies on their published safeguards, including the EU–US Data Privacy Framework and standard contractual clauses (GDPR ch. V; POPIA s 72).

4. How long we keep it

Enquiry data is kept for as long as needed to deal with your enquiry and for a reasonable period afterwards for business records: 24 months from last contact, unless a longer period is required by law or you become a client (in which case the engagement contract governs). Consent choices are stored in your browser for 12 months or until you clear them.

5. Who we share it with

Nobody, for their purposes. We do not sell or rent personal information. It is shared only with the operators listed above (hosting, security, analytics, advertising measurement) acting on our instructions, or where the law requires disclosure.

6. Your rights

Under POPIA (ss 23–25 and related provisions) and, where applicable, the GDPR (arts 15–21), you may: ask what we hold about you and get a copy; have it corrected or deleted; object to processing; restrict processing while a dispute is resolved; receive the data you gave us in a portable format; and withdraw any consent, which stops future processing based on it. Requests go to [email protected] and we respond within a reasonable time, at most within the periods the law allows.

If you are not satisfied with our answer you may complain to the Information Regulator (South Africa) at inforeg.org.za or [email protected], or, for GDPR matters, to the supervisory authority in your EU member state.

7. Security

The site is served over HTTPS. Form input is validated and stored via parameterised queries; credentials for the database live outside the web root; IP addresses are hashed with a salt before storage; and bot traffic is filtered before anything is stored at all. No system is perfectly secure, but we treat your data the way we ask clients to treat theirs: carefully, and with evidence.

8. Children

This site is aimed at businesses. We do not knowingly collect personal information from children; if you believe a child has submitted information, contact us and we will delete it.

9. Changes to this policy

If we change this policy we will change the date below and, for material changes, say so plainly on this page. Last updated: 9 July 2026.