Privacy Policy

1. Who we are and what this policy covers

Wagner & Co respects your privacy and only collects the personal information it needs to run a graphic design studio. This policy explains what we collect, why, who we share it with, and the choices and rights you have.

Responsible party / data controller: Edwin Benjamin Wagner, trading as Wagner & Co, a sole proprietorship based at 24 24th Street, Menlo Park, Pretoria, 0081, South Africa. “Wagner & Co”, “we”, “us” and “our” mean this business.

Information Officer / privacy contact: Edwin Benjamin (Eben) Wagner, info.wagnergraphicdesign@gmail.com.

Scope: This policy applies to wagnergraphicdesign.com (the “Website”), to enquiries made by email or through the Website, and to the personal information of clients and prospective clients. It does not apply to third-party websites or services we link to.

Laws this policy is written to meet: the Protection of Personal Information Act 4 of 2013 (POPIA) of South Africa; the EU General Data Protection Regulation (GDPR) and the UK GDPR, where they apply to you; and US state privacy laws such as the California Consumer Privacy Act as amended (CCPA/CPRA), to the extent they apply to a business of our size. Where these laws give you more protection than this policy, the law prevails.

By using the Website or contacting us, you acknowledge that you have read this policy. Where the law requires your consent for a specific use, we will ask for it separately.

2. Information we collect

We collect only what you give us, what is needed to deliver a project, and limited technical data created when you visit the Website.

We do not ask for, and ask you not to send us, special personal information such as health data, religious or political beliefs, biometric data, or government ID numbers. We never store full payment card details; payments are handled by the bank or payment provider you use.

If you give us personal information about someone else (for example a colleague named in a brief), you confirm you are entitled to share it with us for the purposes in this policy.

3. How and why we use your information

We use personal information only for the purposes below, each with a lawful basis under POPIA and the GDPR.

We do not sell or rent personal information, and we do not “share” it for cross-context behavioural advertising as defined in the CCPA/CPRA. We do not make decisions about you based solely on automated processing or profiling that have legal or similarly significant effects.

If we want to use your information for a new purpose that is not compatible with the ones above, we will tell you first and, where required, ask for your consent.

4. Cookies, hosting logs and analytics

The Website does not set its own tracking or advertising cookies.

Hosting logs. The Website is hosted on GitHub Pages, operated by GitHub, Inc. in the United States. GitHub logs the IP address of visitors for security purposes, under its own privacy statement. We do not receive or control these logs.

Embedded content and fonts. Pages load web fonts from Google Fonts. When this happens, your browser connects to Google, who may receive your IP address and set its own cookies under its own policy.

Analytics. We do not use website analytics.

You can block or delete cookies through your browser settings. Blocking third-party cookies will not stop the Website from working. See our Cookie Policy for more detail.

5. Who we share information with

We share personal information only with the parties below, and only as much as each needs.

• Service providers (operators / processors) that help us run the business, such as our email provider (Google, through Gmail), cloud storage and file-transfer services, our website host (GitHub), our contact-form provider (Formspree), invoicing or accounting software, and banks or payment providers. They may only use your information to provide their service to us.
• Professional advisers such as an accountant or lawyer, under a duty of confidentiality.
• Printers, developers or other suppliers involved in your project, only when you have agreed to their involvement.
• Authorities and others where required by law, such as the South African Revenue Service, a court order, or to protect our legal rights.
• A successor business, if Wagner & Co is sold, merged or restructured, subject to this policy.

International transfers. We work with clients worldwide and several of our service providers are based outside South Africa, mainly in the United States and the European Union. When your information is transferred across borders, we rely on safeguards the law recognises, such as the provider’s standard contractual clauses or equivalent binding terms, an adequacy decision, or the transfer being necessary to perform our contract with you (POPIA section 72; GDPR Chapter V).

6. Client work, portfolio and client-supplied data

We only publish client work in our portfolio or on social media with the client’s permission, given in our written agreement or separately.

• Before publishing, we remove or blur personal information of individuals (such as names, photos, phone numbers or email addresses on mock-ups) unless the person has agreed to appear.
• You can ask us at any time to remove a piece of your work from our portfolio, and we will do so within a reasonable time. Copies already shared by third parties may be outside our control.
• Where you give us files containing other people’s personal information (for example staff photos or customer lists for a design), you remain responsible for having a lawful basis to share it. We will use it only to deliver your project, keep it confidential, and return or delete it when the project ends, unless we must keep it by law.
• Where the law treats us as your processor or operator for such data, the confidentiality and security terms in our client agreement apply.

7. Retention, security and children

We keep personal information only as long as we need it, then delete it or make it anonymous.

Security. We take reasonable technical and organisational measures to protect personal information against loss, misuse and unauthorised access. These include strong unique passwords, two-factor authentication on our accounts, encrypted devices, up-to-date security software, and access limited to the business owner. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Breaches. If a security compromise affects your personal information, we will notify the relevant regulator and you as soon as reasonably possible, as required by POPIA, the GDPR or other applicable law.

Children. The Website and our services are intended for businesses and adults. We do not knowingly collect personal information from anyone under 18. If you believe a child has sent us information, contact us and we will delete it.

8. Your rights

Wherever you are, you can ask us what personal information we hold about you and ask us to correct or delete it.

Depending on the law that applies to you, you may also have the right to:

• access a copy of your personal information;
• correct inaccurate or incomplete information;
• have your information deleted;
• object to or restrict certain processing, including direct marketing;
• receive your information in a portable format;
• withdraw consent at any time, without affecting processing that already took place;
• know the categories of information we collect and disclose, and opt out of any sale or sharing (California residents; we do not sell or share);
• not be discriminated against for exercising your rights.

How to exercise them. Email info.wagnergraphicdesign@gmail.com with your request. We may need to verify your identity before acting. We will reply within 30 days (one month under the GDPR), and tell you if we need longer for complex requests as the law allows. Requests are free, unless they are clearly unfounded or excessive. We may refuse or limit a request where the law permits, for example where we must keep records for tax purposes, and will tell you why.

Complaints. Please contact us first so we can try to resolve your concern. You also have the right to complain to a data protection authority:

• South Africa: the Information Regulator
• European Union: your local supervisory authority
• United Kingdom: the Information Commissioner’s Office
• Elsewhere: the privacy regulator in your country

9. Other terms and contact details

Third-party links. The Website may link to other websites and platforms. We are not responsible for their content or privacy practices, and we encourage you to read their policies.

Information you make public. Anything you post publicly, such as a comment or tag on social media, can be seen by others and is outside our control.

Relationship to other terms. This policy should be read with our Website Terms of Use and any client agreement. If they conflict on how we handle personal information, this policy applies, except where a signed client agreement gives more specific terms.

Changes to this policy. We may update this policy when our practices or the law change. The “Last updated” date at the top shows the latest version. If we make a significant change, we will highlight it on the Website or tell clients directly.

Language. If this policy is translated, the English version prevails.

Contact us.