Menu
What Nebula collects, why, where it is kept, and how to have it removed.
This notice explains how Studio Nebula (Pty) Ltd ("Nebula", "we") handles personal information under the Protection of Personal Information Act 4 of 2013 (POPIA). Nebula is the responsible party for the information described here. It is a one-person studio, so the person who designs your work is also the person accountable for your information.
Nebula uses Cloudflare Web Analytics to see which pages are read and which are not. It does not run until you choose Allow on the banner, and you can change your choice at any time from the Privacy settings link at the foot of every page. If you allow it, it records:
Cloudflare Web Analytics sets no cookie and stores nothing in your browser to recognise you on a later visit. It does not record your name, email address or anything you type, and Nebula sees the results only as totals. Your choice on the banner is the one thing this site keeps in your browser's local storage, so it need not ask again; the moving background keeps two small values in session storage so it carries smoothly from page to page. Neither holds personal information, and clearing your browser's site data removes both.
Nebula does not use Google Analytics, advertising pixels or any tracking that follows you to other websites.
Nebula does not offer patient-data services, and patient information never becomes Nebula's. Occasionally an existing healthcare client may ask us to work with information about their patients as part of a project, for example to design a report built from their own form responses. When that happens:
Questions about that information, including requests to see or correct it, go to the healthcare client, who decides. We will pass on any request that reaches us.
We use your information only to:
We do not sell your information, and we do not send you marketing email unless you ask for it. You can withdraw that at any time.
Supplying information is voluntary. Without a name and an email address we cannot reply to you, and without billing details we cannot contract with you.
Nebula uses a small number of service providers ("operators") to run the business. They process information on our instructions and are bound to keep it secure:
Some of these providers store information on servers outside South Africa, including the United States. We use them only where the provider is bound by data-protection rules that give your information protection comparable to POPIA, as section 72 requires.
We will disclose information to a regulator, court or law-enforcement body only where the law requires it.
| Information | Kept for |
|---|---|
| Enquiries that do not become work | 12 months, then deleted |
| Client contracts, invoices and payment records | 5 years after the financial year, as tax law requires |
| Project files you supplied | For the life of the Brand Care arrangement, or 12 months after handover |
Access to client information is limited to the one person who does the work. Accounts are protected by two-step sign-in, files are held in access-controlled storage rather than on removable media, and nothing is shared by public link. If we learn that your information has been accessed without authority, we will tell you and the Information Regulator as soon as reasonably possible, as section 22 requires.
Under POPIA you may:
Email the Information Officer to use any of these. We will reply within 30 days.
We would rather hear from you first, but you may complain to the Regulator directly.
When this notice changes, the date at the top changes with it.