Privacy Policy

1. Who we are

D2SA (Pty) Ltd (registration number 2013/055313/07) ("D2SA", "we", "us", "our") is the Responsible Party in respect of personal information collected through this website. We operate Welgedaan Estate, a coastal lifestyle development in Saldanha Bay, South Africa.

Our registered address is Welgedaan Estate Office, 57 Bruydegom Street, Saldanha. You can reach us on (022) 714 0091 or +32 475 26 37 11. For privacy matters specifically, please contact thalita@d2sa.co.za (primary) or raf.verlinden@telenet.be (secondary).

D2SA has designated an Information Officer in accordance with sections 55–57 of the Protection of Personal Information Act 4 of 2013 ("POPIA"). The Information Officer is the head of D2SA by virtue of office under POPIA section 56(a), and may be reached at the contact details above.

2. What information we collect

When you submit any form on this website, we collect the information you provide directly:

• First name (and, on some forms, last name)
• Company name (on the investor / B2B form only)
• Email address
• Phone number (optional on some forms)
• Your area of interest (e.g. the type of home, phase, or investment strategy)
• The specific listing reference, where applicable (on the homes-for-sale form)
• Subject and message text (on the contact form)
• Family-size and visit-time preferences (on the B2C / families form)

We also automatically log technical information necessary to operate the site securely:

• Which page the form was submitted from (the "form source")
• Your IP address (stored in a binary form for IPv4/IPv6 efficiency)
• Your browser's user-agent string
• The timestamp of your submission

3. Why we collect it (lawful basis under POPIA)

We rely on three lawful bases for processing your personal information, each mapped to specific data:

• Performance of an inquiry or pre-contractual step (POPIA s.11(1)(b)) - to respond to your specific request, such as sending a price list, brochure, or arranging a viewing or consultation.
• Your consent (POPIA s.11(1)(a)) - to store the form data at all (acknowledged via the privacy checkbox on the form), and, where you have separately consented via the marketing checkbox, to send you marketing communications under POPIA s.69.
• Our legitimate interest (POPIA s.11(1)(f)) - for the technical metadata (IP address, user agent, submission timestamp) used for security, rate-limiting, and fraud prevention.

4. Who we share your information with

D2SA shares the information you submit, and the technical metadata generated by your visit, with the following parties, and no others, except where legally required:

• Kitchfors CC (trading as "The Rebellion") - D2SA's appointed marketing and web Operator, which performs marketing and web-development work on D2SA's behalf. Under POPIA s.20–21, an Operator processes personal information only on the documented instructions of the Responsible Party (D2SA) and is bound by confidentiality.
• GoDaddy - our hosting provider. Data is stored on GoDaddy's South African shared infrastructure.
• Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) - when you accept analytics or advertising cookies via our cookie banner, Google receives event data through Google Tag Manager, Google Analytics 4, and (if advertising is accepted) Google Ads conversion tracking. Google acts as an Operator under POPIA s.20–21 with respect to this data, governed by the Google Ads Data Processing Terms (which incorporate the EU Standard Contractual Clauses for onward transfer to Google's US infrastructure).
• Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland) - when you accept advertising cookies via our cookie banner, Meta receives event data through the Meta Pixel that measures the effectiveness of our Facebook and Instagram campaigns. Meta acts as an Operator under POPIA s.20–21 with respect to this data, governed by the Meta Business Tools Terms and the Meta Controller-to-Processor SCCs.

We do not sell or rent your personal information to any third party.

5. Where it's stored, and for how long

Your information is transmitted to us encrypted in transit using TLS, and stored in a MariaDB database hosted by GoDaddy in South Africa. Access to the database is restricted to D2SA staff and the appointed Operator on a need-to-know basis.

We retain unconverted lead data for 24 months from the date of last contact, after which it is deleted. Where a lead becomes a contracted customer, the data moves into customer-relationship records and is governed by the relevant sale agreement and applicable retention periods (typically dictated by the Estate Agency Affairs Act, FICA, and tax legislation).

6. Third-party services on this site

This website loads the following third-party resources, which may receive limited technical information (such as your IP address) as a necessary consequence of how the web works:

• Google Fonts (loads from fonts.googleapis.com and fonts.gstatic.com) - used to render the site's typography. Loaded on every page. Subject to Google's Privacy Policy.
• Google Maps embed (loads from www.google.com/maps) on certain pages (the home, lifestyle, location, and contact pages) - used to display the estate's location. Loaded on every page. Subject to the same Google Privacy Policy.
• Google Tag Manager and Google Analytics 4 (load from googletagmanager.com and google-analytics.com) - used to understand how visitors use our site so that we can improve it. Loaded only if you accept analytics cookies via the banner shown on your first visit.
• Google Ads conversion tracking (loads from googleadservices.com and googleads.g.doubleclick.net) - measures the effectiveness of our Google Ads campaigns by recording when a visit from one of our ads results in a form submission. Loaded only if you accept advertising cookies. Aggregated conversion counts only - no form field content is transmitted to Google by these tags.
• Meta Pixel (loads from connect.facebook.net and www.facebook.com) - measures the effectiveness of our Facebook and Instagram campaigns. Loaded only if you accept advertising cookies. Where the Pixel transmits any contact identifier to Meta for conversion matching, that identifier is hashed in your browser using SHA-256 before transmission.

You can change your cookie choices at any time using the "Cookie Preferences" link in the site footer. Selecting "Reject all" - or unchecking both Analytics and Advertising in the preferences modal - prevents every script in this section (except Google Fonts and Google Maps, which are essential for site functionality) from loading.

7. Your rights under POPIA

Chapter 3, Part B of POPIA grants you the following rights with respect to your personal information:

• Right of access (s.23) - to ask what personal information about you we hold.
• Right to correction or deletion (s.24) - to ask us to correct inaccurate data or delete data we no longer need.
• Right to object (s.25) - to object to the processing of your personal information on reasonable grounds.
• Right to withdraw consent (s.11(2)) - at any time, where processing is based on your consent (including marketing consent).
• Right to complain - to the South African Information Regulator if you believe we are not handling your information lawfully.

The Information Regulator's contact details are:

8. How to exercise your rights

To exercise any of the rights above, please email thalita@d2sa.co.za with the subject line "POPIA request - [your name]". We will acknowledge your request promptly and respond within 30 days.

There is no charge for exercising your rights, except where a request is manifestly unfounded or excessive - in which case we may charge a reasonable fee or refuse the request, and we will explain our reasons.

9. Cookies and similar storage

This website uses the following storage on your device, grouped into three categories that you can accept or reject independently via the cookie banner or the "Cookie Preferences" modal:

• Essential - always active. A single browser localStorage entry called welgedaan_cookie_consent records which categories you have accepted, so we do not re-prompt you on every visit. This is necessary for the cookie banner itself to function and is not used for tracking. POPIA s.11(1)(b) permits processing strictly necessary for the requested service.
• Analytics - only if you accept. Google Analytics 4, loaded via Google Tag Manager, sets first-party cookies named _ga and _ga_<container-id> with a default lifetime of two years. These cookies enable Google to distinguish unique visitors and measure how the site is used. We use only aggregated, anonymised reports and do not look at individual visitor data.
• Advertising - only if you accept. Google Ads sets _gcl_au and related _gcl_* cookies (conversion linker) to attribute form submissions to specific ad clicks. The Meta Pixel sets _fbp, and - if you arrived via a Facebook or Instagram ad - _fbc, for the same purpose. Default lifetimes are 90 days. These cookies are used exclusively for campaign-attribution measurement and are governed by Google Consent Mode v2, meaning Google receives no advertising signal at all unless this category is granted.

The form backend itself sets no cookies - rate-limiting is implemented in the database, not via session cookies.

You can change your cookie choices at any time via the "Cookie Preferences" link in the site footer. If you reject a category after previously accepting it, the cookies that category had set are deleted from your browser the next time you visit (specifically: rejecting Analytics deletes _ga* and _gid; rejecting Advertising deletes _gcl_*, _fbp, and _fbc).

10. Cross-border transfers (POPIA s.72)

The Google Fonts and Google Maps services described in section 6 load from Google's global content-delivery network, which may transfer IP addresses and request metadata outside South Africa, including to the United States. This transfer is a necessary consequence of providing the technical functions of the site and is permitted under POPIA s.72(1)(c) (necessary for the performance of the service requested by the data subject).

If you accept analytics cookies, Google Tag Manager and Google Analytics 4 transfer your IP address and event metadata to Google Ireland Limited, with onward transfer to Google's US infrastructure. This happens on your explicit consent (POPIA s.72(1)(a)) and is covered by Google's EU Standard Contractual Clauses for the onward transfer.

If you accept advertising cookies, Google Ads conversion data is additionally transferred to Google Ireland Limited (and onward to Google US), and Meta Pixel event data is transferred to Meta Platforms Ireland Limited (and onward to Meta US). Both transfers occur only on your explicit consent (POPIA s.72(1)(a)) and are governed by each provider's Controller-to-Processor Standard Contractual Clauses. Selecting "Reject all" - or unchecking "Advertising" in the cookie preferences modal - prevents these transfers entirely.

The personal information you submit through our forms (name, email address, phone number, message text) is not transferred outside South Africa - it is stored only in our MariaDB database on GoDaddy's South African shared infrastructure.

11. Children's information

This website is not directed at children under 18, and D2SA does not knowingly collect personal information from minors. If you believe a minor has submitted information through our forms, please email thalita@d2sa.co.za and we will delete it.

12. Changes to this policy

We may amend this Privacy Policy from time to time. Material changes will be notified by a banner on the home page for at least 30 days. Each version of the policy is identified by the "Last updated" and "Version" labels at the top of this page.

13. Contact us

For any privacy-related matter, please contact:

For the South African Information Regulator's contact details, see section 7 above.