1. Business and Contact Information

1.1 This Privacy Policy is issued by Johandria Heyman, trading as CodeHive Innovations (“CodeHive”, “we”, “us”, or “our”).

1.2 CodeHive Innovations operates as a sole proprietorship and is not a separately registered legal entity.

1.3 Our primary place of operation is South Africa.

1.4 For legal notices and privacy inquiries, our physical business address and contact email are the same as those set out in our Terms of Service.

1.5 Johandria Heyman is the Information Officer for CodeHive Innovations under POPIA. Privacy-related requests can be directed to the contact details in clause 1.4.

1.6 This Privacy Policy covers www.codehiveinnovations.com and any associated tools or apps, the same properties covered by our Terms of Service.

2. Jurisdiction & Applicable Law

2.1 Our clients may be located anywhere in the world; CodeHive does not currently restrict its Products or Services by country.

2.2 CodeHive has no established presence, employees, or physical operations in the European Union, United Kingdom, California, or any jurisdiction other than South Africa.

2.3 Depending on where you are located, one or more of the following laws may apply to how your personal information is processed:

• South Africa: the Protection of Personal Information Act (POPIA)
• European Union: the General Data Protection Regulation (GDPR)
• United Kingdom: the UK GDPR
• United States: the CCPA/CPRA and other applicable state privacy laws
• Australia: the Privacy Act 1988 and the Australian Privacy Principles

2.4 If you have concerns about how we handle your personal information that we haven’t resolved to your satisfaction, you may lodge a complaint with South Africa’s Information Regulator (details at www.inforegulator.org.za) or, where applicable, your own country’s data protection authority.

2.5 This Privacy Policy, and any dispute regarding how we handle personal information, is governed by South African law, including POPIA.

3. What Personal Data Is Collected

3.1 Free Tools

When you use our free tools, we collect your name and email address.

3.2 Paid Products & Services

For our paid diagnostic tool and consulting services, we may also collect your phone number and physical or billing address, where relevant to delivering the service.

3.3 Payment Information

We do not collect or store full payment card details. Payments for our tools are processed by Lemon Squeezy; payments for our Services are made via Payoneer. In both cases, your card and billing information is handled directly by the relevant payment provider.

3.4 Information You Submit

We collect information you submit through forms, such as your name and email, and through our diagnostic tool, which may include information about your business, such as details of your existing Terms of Service, Privacy Policy, or business practices, submitted for the purpose of generating your diagnostic report.

3.5 Automatically Collected Information

We use privacy-friendly, cookieless analytics to understand website traffic and usage patterns. This does not use tracking cookies or share your data with third-party advertising networks. Our website and tools also run on third-party hosting infrastructure, which may automatically log technical information such as your IP address and browser or device information as part of normal hosting and security operations.

3.6 Special Category Data

We do not intentionally collect special-category or sensitive personal information, such as health, biometric, or financial risk data about individuals, through our Products or Services.

3.7 Your End Users’ Data

Our Products and Services are not designed to require you to submit personal information about your own customers or end users. If you choose to include such information, for example within diagnostic input, we process it solely on your behalf and only to deliver the relevant Service to you.

4. How Data Is Collected

4.1 Directly From You

We collect information you provide directly through forms, sign-ups, our diagnostic tool, and customer support interactions by email or chat.

4.2 Automatically

We collect limited technical information automatically through our privacy-friendly analytics tool and our hosting infrastructure, as described in clause 3.5.

4.3 Via Third-Party Infrastructure

Data collected through our Products and Services passes through Cloudflare (hosting/CDN), Kit (marketing email delivery), Resend (transactional email delivery), and Render (application hosting) as part of normal operation. Payment data is handled directly by Lemon Squeezy (for our tools) and Payoneer (for our Services), as described in clause 3.3.

4.4 No Third-Party Sourcing

We do not use social login, data enrichment tools, or other third-party sources to collect personal information about you.

5. Purpose & Legal Basis for Processing

5.1 Service Delivery

We use your name, email, phone number, billing address, and any business information submitted through our diagnostic tool to deliver the Products and Services you request. This processing is necessary to perform our contract with you.

5.2 Billing

We use your billing information to process payment and to meet our accounting and tax record-keeping obligations. This processing is necessary to perform our contract with you and to comply with legal obligations.

5.3 Marketing

Where you’ve given us your consent, we use your email address to send you marketing communications about our Products and Services. You can withdraw this consent at any time by unsubscribing.

5.4 No Secondary Use

We do not use your personal information for any purpose beyond service delivery, billing, and, where consented to, marketing.

6. Third-Party Processors & Sub-Processors

6.1 We use trusted third-party service providers to help us deliver our Products and Services. Each processes personal information only on our instructions and for the purpose of providing their service to us.

6.2 Our current service providers are: Cloudflare (hosting, content delivery, and security), Kit (marketing email delivery), Resend (transactional email delivery), Lemon Squeezy (payment processing for our tools), Payoneer (payment processing for our Services), and Render (application hosting).

6.3 We are in the process of confirming that appropriate data processing terms are in place with each of our service providers, consistent with POPIA and, where applicable, GDPR requirements.

6.4 Our service providers may engage their own sub-processors to help deliver their services. Each provider maintains its own list of sub-processors and security safeguards, available through their respective privacy or trust center pages.

6.5 We do not sell your personal information, and we do not share it with any third party for that third party’s own marketing purposes.

7. International Data Transfers

7.1 Because we operate from South Africa and use service providers based in other countries, your personal information may be transferred to, and processed in, countries other than the one you’re located in, including South Africa, the European Union, the United Kingdom, and the United States.

7.2 Where personal information is transferred from the European Union or United Kingdom to a country without an adequacy decision, which currently includes South Africa and, in most cases, the United States, we rely on appropriate safeguards such as Standard Contractual Clauses. These are typically built into our service providers’ own data processing agreements.

7.3 We take reasonable steps to ensure that any service provider processing personal information on our behalf maintains an appropriate standard of data protection, regardless of location.

8. Data Retention

8.1 We retain your personal information for as long as necessary to deliver the Products and Services, and for 30 days after your engagement or account ends, during which you may request an export of your data, consistent with clause 10.4 of our Terms of Service.

8.2 After this 30-day period, we delete your personal information, except where we’re required to retain it for longer, as set out below.

8.3 Financial and billing records, such as invoices and proof of payment, are retained for 5 years from the date of the relevant transaction, in accordance with South African tax record-keeping requirements, regardless of when your engagement ends.

8.4 We do not anonymize or aggregate data in place of deletion. Where retention isn’t legally required, your data is deleted.

9. Data Security Measures

9.1 Encryption

Data transmitted to and from our Products and Services is encrypted in transit using HTTPS/TLS. Data stored with our hosting and payment providers is encrypted at rest in accordance with each provider’s standard security practices.

9.2 Access Controls

CodeHive Innovations is a sole proprietorship; access to personal information is limited to the business owner. Accounts with our service providers are protected by password and, where available, multi-factor authentication.

9.3 Certifications

We rely on service providers who maintain their own industry security certifications and standards, such as SOC 2 or PCI-DSS, rather than holding these certifications ourselves.

9.4 Incident Response

We maintain a breach response process, described in clause 15 of this Privacy Policy.

10. User Rights & How They’re Exercised

10.1 Depending on where you’re located, you may have some or all of the following rights regarding your personal information: access it, correct it (based on what you tell us), request its deletion, receive a copy in a portable format, object to our processing or opt out of marketing, withdraw consent where processing relies on consent, opt out of the sale or sharing of your data (though as set out in clause 6.5, we don’t sell or share it in the first place), and lodge a complaint with the relevant regulator.

10.2 Response Timeline

We aim to respond to any rights request within 30 days of receiving it. Where a request is particularly complex, we may extend this period and will notify you if we do.

10.3 How to Exercise Your Rights

To exercise any of these rights, email us at joy@codehiveinnovations.com. We do not currently have a separate request form.

10.4 Regulators

The regulator you may complain to depends on where you’re located, for example, the Information Regulator in South Africa, your national supervisory authority in the EU, the Information Commissioner’s Office in the UK, or the Office of the Australian Information Commissioner in Australia.

11. Cookies & Tracking Technology

11.1 We do not currently use marketing or advertising cookies, and our analytics tool does not use cookies or track you individually.

11.2 Our hosting and security provider, Cloudflare, may set strictly necessary cookies required for the security and functioning of our website, for example, to detect and prevent malicious traffic. These cookies don’t require consent, as they’re essential to the service.

11.3 Because we don’t use non-essential tracking cookies, we don’t currently operate a cookie consent banner. If this changes, for example if we introduce advertising or marketing cookies, we’ll update this Privacy Policy and add a proper consent mechanism at that time.

12. Marketing Communications & Consent

12.1 When you use our diagnostic tool, we automatically send you the report you requested by email via Resend. This is necessary to deliver the service and does not require separate marketing consent.

12.2 If you’d also like to receive occasional emails about our other tools and services, you can opt in separately via a checkbox at the point of submission. This is not required to receive your report.

12.3 We send marketing emails through Kit, which includes a working unsubscribe link in every email. You can unsubscribe at any time.

12.4 Kit records the date and method of your consent to marketing communications, which we can provide to you on request.

13. Automated Decision-Making & AI Use

13.1 Our diagnostic tool uses templated logic, not artificial intelligence, to generate your risk report.

13.2 The report is provided for informational purposes to help you understand and address gaps in your own Terms of Service or Privacy Policy. It does not make any automated decision that affects you personally, such as denying you access to something or evaluating your eligibility, and has no legal or similarly significant effect on you as an individual.

13.3 Because of this, automated decision-making protections such as GDPR Article 22 do not apply to our diagnostic tool’s output.

14. Children’s Data

14.1 Our Products and Services are intended for business use by individuals 18 years of age or older, as set out in our Terms of Service. They are not directed at, marketed to, or intended for use by children.

14.2 We do not knowingly collect personal information from anyone under 18. Given the business-to-business nature of our Products and Services, we rely on the age confirmation given when you agree to our Terms of Service, rather than separate identity or age verification.

14.3 If we become aware that we’ve inadvertently collected personal information from someone under 18, we will delete it promptly.

15. Data Breach Response

15.1 We maintain a breach response process to identify, contain, and address any incident that may compromise personal information.

15.2 Johandria Heyman, as Information Officer, is responsible for managing our response to any data breach.

15.3 Where a breach poses a risk to your rights or interests, we will notify the relevant regulator(s) within 72 hours of becoming aware of it, where feasible, providing further information as our investigation progresses.

15.4 Where a breach poses a high risk to your rights or freedoms, or where notification is otherwise required by applicable law, including POPIA, we will notify affected individuals without undue delay, using the email address provided at sign-up.

16. Policy Governance

16.1 We review this Privacy Policy periodically, at least every 6 months, and whenever our practices or applicable law materially change.

16.2 If we make a material change to this Privacy Policy, we will notify you via a notice on our website.

16.3 This Privacy Policy is dated with its effective date at the top of the document. We keep a dated record of each prior version on file.

16.4 For any questions about this Privacy Policy, contact us at joy@codehiveinnovations.com.

16.5 Regulator contact details are set out in clauses 2.4 and 10.4 above.

Back to Home