Privacy Policy.

What we collect, why, who handles it, and how to exercise your rights.

Effective date: 3 October 2026. Last updated: 26 October 2026.

In short. We collect the details you type into our contact form (your name, email address, business name and message) so we can reply to you and arrange a call. We run Google Analytics only if you accept it in the cookie banner. We do not use advertising trackers and we do not sell your information. The form is processed for us by Formspree, a service based in the United States. You can ask us for access to, correction of, or deletion of your information at any time at mvaneck@next-lvl.tech.

1. Who is responsible for your information

The responsible party (POPIA) and controller (GDPR) is NEXTLEVELWEBSOLUTIONS (Pty) Ltd, a private company incorporated in South Africa, enterprise number K2026678507 with the Companies and Intellectual Property Commission (CIPC), trading as Next Level Web Solutions ("we", "us").

Registered address: 6 Veldkornet, Annlin
Email: mvaneck@next-lvl.tech
Phone: +27 65 260 0847
Information Officer: Michael van Eck, mvaneck@next-lvl.tech

This policy applies to the website at next-lvl.tech. It is written to meet the Protection of Personal Information Act 4 of 2013 (POPIA) and, for visitors in the European Economic Area and the United Kingdom, the General Data Protection Regulation (GDPR). We have not appointed a Data Protection Officer because the GDPR does not require one for an organisation of our kind. The Information Officer handles privacy questions.

2. What we collect and why

When you use the contact form

The form asks for your name, your email address, your business name (optional) and a message describing what you need (optional). The form also records that you ticked the consent box and which version of this policy was shown to you. The tick-box record exists so that we can prove that consent was given.

When you request a free website check

The free website check form asks for your name, business name, email address, town or suburb and, if you have one, your website address. We use these to look up how your business appears on Google and to email you the report. The form has a second, optional tick box: only if you tick it may we also contact you by email, phone or WhatsApp about our services. The form records both ticks and the policy version shown to you.

If we contacted your business first

We may contact a business once, using the business name and phone number or email address it publishes in public listings such as OpenStreetMap or its own Google listing, to ask whether it would like a free website check. We keep the business name, the contact detail we used, the date and your answer, so that we never contact you again for marketing unless you said yes. If you say no or do not reply, we do not contact you again and delete the details within 30 days, keeping only what we need to record that you declined.

When you email, phone or WhatsApp us

We keep the messages you send and the details you give us in the course of the conversation, such as your name, contact details and project requirements. If you message us on WhatsApp, we also receive your WhatsApp name, phone number and profile photo as WhatsApp shows them to us.

Technical data

Like any website, our web host's servers (and the network service in front of them, see section 5) receive your IP address, the time of your visit, the pages requested and your browser type when your browser loads a page. Servers normally keep this in short-lived logs used for security and for keeping the site running. We do not use it to profile you and we do not analyse it for marketing. When you open a page, our web host also works out from your IP address which country you are in, so that visitors in the United Kingdom see the UK version of the site. That country check happens at the moment of the visit and is not stored or linked to you. You can switch versions with the Region links in the footer.

Cookies and browser storage

If you click Accept in the cookie banner, we use Google Analytics 4 (Google LLC, United States) to measure how visitors use the site: pages viewed, time on page, approximate location, device and browser. It sets the cookies _ga and _ga_87NY0PPZSJ and sends this data to Google. Our lawful basis is your consent, which you can withdraw at any time with Cookie settings in the footer. If you decline or ignore the banner, no analytics cookies are set and Google's code runs in a restricted mode: your browser still contacts Google, which can receive basic technical details such as your IP address and browser type, but not analytics identifiers. Your choice is remembered in your browser's local storage under the name nlws-consent. If you use the Region links in the footer, one first-party cookie called nlws-region remembers which version of the site you picked for one year; it is strictly necessary for that choice and holds no personal information. The site loads no other third-party scripts, fonts or previews. Client websites shown on the Work page are plain links that open in a new tab, and from then on that website's own policies apply. See the Cookie Policy.

Data-use note on the form

A short note under the submit button on the contact form tells you that we use your details only to reply to your enquiry, that Formspree receives them and passes them to us by email, and links to this policy.

3. Purposes and lawful grounds

Purpose	Information	POPIA ground (s11)	GDPR ground (Art 6)
Reply to your enquiry and arrange a call	Name, email, business name, message	Your consent (s11(1)(a)) and steps you ask us to take before a contract (s11(1)(b))	Consent (6(1)(a)) and pre-contract steps (6(1)(b))
Prepare and send a free website check	Name, business name, email, town or suburb, website address	Your consent (s11(1)(a))	Consent (6(1)(a))
Tell you about our services, only if you ticked the optional box	Name, business name, email, and any phone or WhatsApp number you give us	Your consent (s11(1)(a) and s69(1)(a))	Consent (6(1)(a))
Ask a business once whether it wants a free check	Business name and the public phone number or email address we used, date, answer	Section 69(3): one request for consent; legitimate interests (s11(1)(f))	Legitimate interests (6(1)(f))
Keep proof that you consented	Consent tick, policy version, time of submission	Our legitimate interest in proving compliance (s11(1)(f))	Legitimate interests (6(1)(f))
Deliver and bill for services if you become a client	Contact and project details, invoices and payment records	Performance of a contract (s11(1)(b)); legal obligations such as tax records (s11(1)(c))	Contract (6(1)(b)); legal obligation (6(1)(c))
Keep the website secure and running	Server logs held by our host	Legitimate interests (s11(1)(f))	Legitimate interests (6(1)(f))

We use your information only for the purposes above. We use it for direct marketing only as described in section 11. We do not use it for advertising, profiling or automated decision making, and we do not sell it.

4. Is providing information voluntary?

Yes. No law requires you to use our contact form. Your name and email address are needed in the form because without them we cannot reply. If you do not provide them, we will not be able to respond to your enquiry. The business name and message fields are optional.

5. Who we share it with

Formspree (formspree.io), a form processing service, receives what you submit in the contact form and passes it to us by email. Formspree acts as our operator and may also log technical details such as your IP address. See Formspree's own privacy policy for how it handles data.
Google LLC (Google Analytics 4), only if you accept analytics cookies in the cookie banner. Google receives your page views, approximate location, device and browser details and acts as our operator. If you have not accepted, it receives only basic technical details such as your IP address and browser type. Analytics data is kept for no longer than 14 months.
WhatsApp (WhatsApp LLC and WhatsApp Ireland Limited, part of Meta), only if you choose to message us there. WhatsApp carries the conversation under its own terms and privacy policy; the WhatsApp links on this site are plain links and load nothing from WhatsApp until you click them.
Vercel Inc. (United States), our web hosting provider, serves this website and holds the server logs described above.
Cloudflare, Inc. (United States), which sits between your browser and our host as a content delivery and security service. It handles each page request in transit, including your IP address, and filters abusive traffic.
Our email provider hosts the mailbox that receives your enquiry and our replies.
Professional advisers, authorities and courts where we are legally required to disclose information, or need advice to protect our rights.

We do not sell or rent your information to anyone. Fonts and work screenshots on this site are served from our own server, so no font or image provider receives your IP address.

6. Transfers outside South Africa

Formspree is based in the United States, so your form submission is transferred to and processed in the United States. Vercel and Cloudflare are also based in the United States, and every page request is handled by them wherever you are, so request data such as your IP address is processed there and in other countries where they operate. Google is also based in the United States, so basic technical details (and, if you accept analytics cookies, your analytics data) are transferred to and processed there (and in other countries where Google operates). Our email provider may also store data outside South Africa, and if you message us on WhatsApp the conversation is handled by WhatsApp, which processes data in the United States and other countries. We transfer personal information across the border only where section 72 of POPIA allows it, namely where the recipient is bound by contract or law to give substantially similar protection, where the transfer is necessary for steps you asked us to take, or where you consent, by submitting the form or by accepting analytics cookies. For visitors in the EEA and UK, we rely on the standard contractual clauses or equivalent safeguards offered in our providers' data processing terms, and on your consent. You can ask us for details of the safeguards at mvaneck@next-lvl.tech.

7. How long we keep it

Enquiries that do not lead to a project: deleted within 12 months of our last contact with you.
Client project, contract and billing records: kept for the length of the engagement and for at least five years afterwards, as South African tax and company law require.
Consent records: kept for as long as we keep the enquiry they relate to.
Server logs: kept by our host for a short rolling period set by the host.
Copies held by Formspree: kept for the period set by Formspree's service and our account settings, and deleted on request where we can do so.

When a retention period ends, we delete the information or make it anonymous so that it cannot be linked to you.

8. Your rights

You have the right to:

ask whether we hold information about you, and receive a copy and a description of who has had access to it (POPIA s23; GDPR Art 15);
ask us to correct information that is inaccurate, incomplete or out of date (POPIA s24; GDPR Art 16);
ask us to delete information that we are no longer entitled to keep (POPIA s24; GDPR Art 17);
object to processing that relies on our legitimate interests, and restrict processing in the cases the law allows (POPIA s11(3); GDPR Arts 18 and 21);
withdraw your consent at any time, without affecting processing that already took place;
receive the information you gave us in a portable format, where the GDPR applies (Art 20);
not be subject to a decision based solely on automated processing. We do not make such decisions.

To use any of these rights, email mvaneck@next-lvl.tech. We may ask you to prove your identity first so that we do not disclose information to the wrong person. We aim to respond within 30 days. Access requests are free, although POPIA allows a prescribed fee for copies in some cases, and we will tell you of any fee before we charge it.

To withdraw your consent to analytics cookies, click Cookie settings in the footer of any page and choose Decline. To withdraw any other consent, email mvaneck@next-lvl.tech. Withdrawing consent does not affect processing that already took place.

9. Complaints

Please contact us first so that we can try to resolve your concern. You also have the right to complain to the Information Regulator of South Africa: email complaints.IR@justice.gov.za, website inforegulator.org.za. If you are in the EEA or UK, you may complain to the data protection authority in the country where you live or work.

10. Security

We take reasonable technical and organisational measures to protect personal information against loss, damage and unauthorised access, including encrypted connections, restricted access to the mailbox that receives enquiries, and the use of providers that offer security commitments in their terms. If we have reasonable grounds to believe that your information has been accessed by an unauthorised person, we will notify you and the Information Regulator as soon as reasonably possible, as section 22 of POPIA requires.

11. Direct marketing

We send marketing by email, phone or WhatsApp only to people who gave us their separate opt-in, by ticking the optional box on the free website check form or by saying yes when we asked. As section 69 of POPIA allows, we may ask a business once whether it would like a free website check; if it says no or does not reply, we do not contact it again for marketing. Every marketing message contains a working way to opt out, and you can opt out at any time by replying "stop" or emailing mvaneck@next-lvl.tech.

12. Children

This website is for businesses and is not directed at anyone under 18. Please do not submit the contact form if you are under 18. If we learn that we hold information about a child without the consent of a parent or guardian, we will delete it.

13. Access to records under PAIA

The Promotion of Access to Information Act 2 of 2000 (PAIA) lets a person request access to records held by a private body. We understand that small private bodies are largely exempt from publishing a PAIA manual under section 51 of that Act. We have not published one. You can still make a request for access to a record by emailing our Information Officer at mvaneck@next-lvl.tech, and we will deal with it as PAIA requires. We will publish a manual if the law is found to require one for us.

14. Changes to this policy

We will update this page when our practices change and change the "Last updated" date above. If a change is significant, we will say so on this page.

15. Contact

Questions about this policy: Information Officer, Michael van Eck, mvaneck@next-lvl.tech, +27 65 260 0847. Registered address: 6 Veldkornet, Annlin.