HeySunbird Privacy Policy

1. Introduction
This Privacy Policy explains how HeySunbird collects, uses, stores, shares, and protects personal information.
 
It applies to personal information collected through our website, email communications, forms, calls, proposals, service delivery, client onboarding, consulting work, marketing activity, and related business operations.
 
We process personal information in line with applicable data protection laws, including South Africa’s Protection of Personal Information Act, 4 of 2013, where applicable.

2. Our Role
Depending on the context, we can act as:

Responsible Party: when we decide why and how personal information is processed, for example website enquiries, marketing contacts, client records, billing records, and supplier records.

Operator: when we process personal information on behalf of a client under their instructions, for example learner, staff, stakeholder, or project data provided by a client for a consulting or implementation project.
 
Clients remain responsible for the personal information they collect and provide to us.

3. Personal Information We Collect
We can collect:

• name and surname;

• email address;

• phone number;

• job title and organisation;

• billing and payment information;

• enquiry details;

• meeting notes;

• proposal and project information;

• communication records;

• website usage data;

• IP address, browser, and device information;

• information shared through forms, email, documents, calls, or project systems;

• professional profile information, where relevant to a project or partnership.

Where necessary for a project, we can process learner, staff, contractor, institutional, or stakeholder information provided by a client. Clients must ensure they have lawful grounds to share this information with us.

4. Sensitive and Children’s Information
We do not intentionally collect sensitive personal information or children’s personal information through our website. If a project requires processing sensitive information or children’s information, this must be agreed in writing and handled under appropriate safeguards. Clients are responsible for obtaining required consents, notices, authorisations, and approvals before sharing such information with us.

5. How We Collect Information
We collect personal information when you:

• visit our website;

• complete a form;

• book a call;

• contact us by email, phone, social media, or messaging platform;

• request a proposal;

• accept services;

• attend a meeting or workshop;

• provide access to project documents or platforms;

• subscribe to updates;

• interact with our content;

• work with us as a client, supplier, contractor, or partner.

We can also collect limited information from public sources, such as LinkedIn, company websites, or public professional directories, where relevant to legitimate business activity.

6. Why We Use Personal Information
We use personal information to:

• respond to enquiries;

• provide proposals and quotes;

• deliver services;

• manage client relationships;

• schedule meetings;

• provide support;

• process invoices and payments;

• manage contracts;

• coordinate projects;

• improve our website and services;

• maintain business records;

• send relevant updates or marketing communications;

• comply with legal obligations;

• protect our rights, systems, and business interests.

7. Legal Grounds for Processing
We process personal information where one or more of the following grounds applies:

• you have consented;

• processing is necessary to perform a contract;

• processing is necessary to take steps before entering into a contract;

• processing is required by law;

• processing protects legitimate business interests;

• processing is necessary to protect rights or pursue legal claims;

• processing is necessary for a client project and is performed under client instruction.

8. Marketing Communications
We can send marketing communications where permitted by law. You can opt out of marketing emails at any time by using the unsubscribe link or contacting us. We do not sell personal information to advertisers.

9. Cookies and Website Analytics
Our website can use cookies and similar technologies to:

• enable basic website functionality;

• improve website performance;

• understand visitor behaviour;

• measure engagement;

• remember preferences;

• support security.

You can manage cookies through your browser settings. If we use analytics, advertising pixels, or third-party tracking tools, we will identify them in our cookie notice where required.

10. Sharing Personal Information
We can share personal information with:

• service providers;

• contractors or freelancers supporting agreed work;

• accountants, lawyers, or professional advisers;

• payment processors;

• cloud storage providers;

• project management tools;

• email, calendar, CRM, or communication platforms;

• hosting and website providers;

• regulators, courts, law enforcement, or public authorities where required;

• buyers or successors if our business is sold or restructured.

We only share information where there is a lawful reason and, where appropriate, confidentiality or processing obligations apply.

11. International Transfers
Some service providers can process information outside South Africa. Where personal information is transferred internationally, we take reasonable steps to ensure appropriate safeguards are in place, such as contractual protections, adequate data protection commitments, or other lawful transfer mechanisms.

12. Security
We use reasonable technical and organisational measures to protect personal information against loss, unauthorised access, misuse, disclosure, alteration, or destruction. These measures can include access controls, password protection, secure cloud services, confidentiality obligations, limited access, and reasonable administrative controls. No system is completely secure. You accept that electronic communication and cloud-based processing carry inherent risk.

13. Data Retention
We keep personal information only for as long as reasonably necessary for:

• service delivery;

• client relationship management;

• legal, tax, accounting, and reporting obligations;

• dispute resolution;

• contract enforcement;

• legitimate business records;

• project continuity.

When information is no longer needed, we will delete, anonymise, or securely archive it where reasonably practical.

14. Your Rights
Depending on applicable law, you can have the right to:

• ask what personal information we hold about you;

• request access to your personal information;

• ask us to correct inaccurate information;

• request deletion where legally permitted;

• object to certain processing;

• withdraw consent where processing is based on consent;

• complain to the Information Regulator.

We can request proof of identity before responding to a request.

15. Client-Controlled Data
Where we process personal information on behalf of a client, the client controls that information.
Requests relating to client-controlled learner, staff, customer, or stakeholder data should usually be directed to the relevant client. We will assist clients with reasonable data subject requests where required and where agreed.

16. Data Breaches
If we identify a personal information security incident that affects your personal information, we will assess the incident and take reasonable steps required by law. Where required, we will notify affected parties and/or the relevant regulator.

17. Links to Other Websites
Our website can contain links to third-party websites. We are not responsible for their privacy practices, security, content, or terms. You should review their privacy policies before using those sites.

18. Changes to This Policy
We can update this Privacy Policy from time to time. The latest version will be posted on our website with the updated date.

19. Contact
For privacy questions or requests, contact:
Information Officer: Melissa Bestel
Email: hello@heysunbird.com
You can also contact South Africa’s Information Regulator through its official channels.