Privacy policy

1. Who is responsible

The data controller for this website is Sunbird Living ("we", "us"), publisher of the website at https://pekajeo.site/.

• Postal address: PO Box 4417, Cape Town, 8000, South Africa
• Email: privacy@pekajeo.site
• Telephone: +27 21 555 0148

Because we are a small publisher and do not carry out large-scale or systematic monitoring, we are not required to appoint a Data Protection Officer. Privacy matters are handled directly by the editorial desk at the address above.

2. What data we collect

We collect as little as the site can function on. There is no account system, no newsletter, no user profile and no advertising network.

2.1 Data you give us

When you use the contact form on the home page, or write to us by email or post, we receive:

• your name;
• your email address;
• the topic you selected;
• the content of your message;
• the fact that you ticked the consent box, and when.

Please do not send us information about your health, medical history, test results or medication. We cannot advise on it, and we do not want to hold it. If such information reaches us anyway, we delete it as soon as the message has been answered.

2.2 Data collected automatically

Our hosting provider records standard server logs for every request: the IP address, the date and time, the page requested, the HTTP status code, the amount of data transferred, the referring page and the browser's user-agent string. These logs exist to keep the site available and to investigate abuse or technical faults.

2.3 Data we do not collect

We do not collect payment details, identity numbers, location beyond what an IP address implies, biometric data, or any special category data as defined in Article 9 GDPR. We do not build profiles of readers and we carry out no automated decision-making that produces legal or similarly significant effects.

3. Why we use it, and the legal basis

• Answering your message. Legal basis: consent (Article 6(1)(a) GDPR), given by ticking the box on the form. You may withdraw consent at any time; withdrawal does not affect processing already carried out.
• Keeping the site available and secure. This covers server logs and abuse investigation. Legal basis: legitimate interests (Article 6(1)(f) GDPR) in running a functioning, non-abused website. We have weighed this against your interests and consider the impact minimal, as logs are short-lived and never used to identify individual readers.
• Understanding which articles are read. Only if you accept analytics cookies. Legal basis: consent (Article 6(1)(a) GDPR).
• Meeting legal obligations. Where a law requires us to retain or disclose something. Legal basis: legal obligation (Article 6(1)(c) GDPR).

4. Cookies and local storage

When you first arrive, a banner asks whether you accept non-essential cookies. Nothing beyond the strictly necessary is set before you answer.

4.1 Strictly necessary

Your answer to the banner is stored in your browser's localStorage under the key sunbird_cookie_consent, together with the date of the choice. This entry stays on your device until you clear it, is never transmitted to us, and exists only so that the banner does not ask again on every page. No consent is required for it, because without it the consent mechanism itself would not work.

4.2 Analytics — only with consent

If you press Accept, we may set a privacy-respecting analytics cookie that records which pages are opened and roughly where in the world the request came from, at country level. It does not follow you to other sites, is not shared with advertisers, and has a lifetime of no more than twelve months. If you press Reject, this cookie is never set and the site works exactly as it otherwise would.

4.3 Advertising

We set no advertising or cross-site tracking cookies of any kind, and we host no third-party scripts, fonts, or embedded media on this site.

4.4 Changing your mind

You can clear your stored choice at any time using the button below, or by clearing site data in your browser settings. The banner will then appear again on your next page load.

Clear my cookie choice

5. Who else sees your data

We do not sell personal data, and we do not share it for anyone else's marketing. Data is disclosed only to:

• Our hosting provider, acting as a processor under a written agreement that meets Article 28 GDPR, for the purpose of serving the website;
• Our email provider, acting as a processor, for the purpose of receiving and answering messages;
• Public authorities, where disclosure is required by a law that applies to us.

6. International transfers

Our servers and email systems may be located outside South Africa and outside the European Economic Area. Where personal data is transferred to a country without an adequacy decision, the transfer is covered by the European Commission's Standard Contractual Clauses, together with technical measures including encryption in transit and at rest. You may request a copy of the safeguards in place by writing to privacy@pekajeo.site.

7. How long we keep it

• Contact form and email correspondence: up to 12 months after the exchange ends, then deleted. Where a message becomes part of a published correction, the correction note itself does not identify the sender.
• Server logs: 30 days, then deleted or anonymised, unless a specific security incident requires a longer hold.
• Analytics data: aggregated after 14 months; individual records are not retained beyond that point.
• Consent records: kept for as long as needed to demonstrate that consent was given, and no longer than 3 years.

8. Your rights

Under the GDPR you have the following rights, and comparable rights exist under South African law:

• Access (Art. 15) — a copy of the personal data we hold about you and the reasons we hold it.
• Rectification (Art. 16) — correction of data that is wrong or incomplete.
• Erasure (Art. 17) — deletion, where we no longer need the data or where you withdraw consent.
• Restriction (Art. 18) — a pause on processing while a dispute about accuracy or legitimacy is resolved.
• Portability (Art. 20) — the data you gave us, in a structured, machine-readable format.
• Objection (Art. 21) — an objection to processing based on legitimate interests, including at any time and for any reason where the processing is for direct marketing.
• Withdrawal of consent (Art. 7(3)) — at any time, without affecting the lawfulness of processing before withdrawal.

To exercise any of these, write to privacy@pekajeo.site. We answer within one month, as required by Article 12(3) GDPR. If a request is complex we may extend that by a further two months and will tell you why within the first month. There is no charge, unless a request is manifestly unfounded or excessive, in which case we will explain the position before doing anything.

We may ask for enough information to be confident that the request comes from you. We will not ask for more than is needed for that purpose.

9. Security

The site is served over HTTPS. Access to the mailbox and to the hosting account is limited to the members of the editorial desk who need it, and protected by unique passwords and two-factor authentication. We keep no databases of reader data. Should a personal data breach occur that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours and, where the risk is high, inform affected individuals directly.

10. Children

This site is written for adults and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has sent us personal data, write to privacy@pekajeo.site and we will delete it.

11. Changes to this policy

When this policy changes, the version number and date at the top of the page are updated. Material changes — a new purpose, a new recipient, a longer retention period — are announced on the home page for at least 30 days. Continued use of the site after a change takes effect means the current version applies to you.

12. Complaints

If you think we have handled your personal data badly, please tell us first — most problems are quicker to fix directly. You also have the right to complain to a supervisory authority:

• In South Africa: the Information Regulator (South Africa).
• In the EU or EEA: the data protection authority of the country where you live, work, or where the alleged infringement took place.