MATUNOS (PTY) LTD

Privacy Notice

Effective and last updated: 5 November 2026

This notice explains how MATUNOS (PTY) LTD ("MATUNOS", "we", "us") handles personal information about the people we deal with: anyone who emails us, our clients and prospective clients, our suppliers, and visitors to matunos.com. It tells you what we hold, why, who else sees it, how long we keep it, and what you can do about it.

1. Who we are

The responsible party under South Africa's Protection of Personal Information Act, 2013 (POPIA) — the controller in the language of the EU and UK GDPR — is:

Our Information Officer is registered with the Information Regulator and can be reached at the same address.

2. What this notice covers

This notice covers email sent to any matunos.com address, the contact form and the job application form on this website, our dealings with clients, prospective clients and suppliers, and visits to matunos.com.

It does not cover:

• Our apps. Each has its own policy. The Focus Vault Android app, and email sent to its support address, are covered by the Focus Vault privacy policy.
• Personal information we handle on a client's behalf while doing work for them. The client decides what happens to that information, and our contract with them governs it. See section 5.
• Other websites we link to, such as LinkedIn, which have their own policies.

3. What we hold, and why

We do not ask for special personal information (such as health, religion or biometric data) or for information about children, and we ask you not to send it. Providing information to us is voluntary. If you do not, we may not be able to answer you or work with you.

4. The contact form and job applications

The form on our contact page does not send anything to our website or store anything. When you press the button, it opens a draft email in your own email app, addressed to [email protected] and filled in with what you typed. Nothing is sent until you send that email yourself. From then on it is handled like any other email to us (section 3).

Job applications

The application form on our careers page is different: it does send what you enter to us. When you apply:

• What we keep: your name, email address, the role, your note to us and your CV, plus your phone number, LinkedIn link and (for the developer roles) GitHub link if you give them, and your academic transcript for the junior roles and vacation work. We do not ask for an ID number, and we do not store your IP address with your application.
• Why: to consider you for the role you applied for and, while we keep your application, for other roles that suit you. We process it with your consent, which you give by ticking the box on the form and can withdraw at any time.
• Where it is kept: in a private Cloudflare storage bucket (Cloudflare R2), which has no public address. Only our director can open it, after signing in. Files are accepted only as PDFs.
• Who sees it: MATUNOS only. We never send your CV or details to a client without your written consent for that client. If we are notified of a new application by email, the email carries only the role and a reference number, not your name or CV.
• How long: 12 months from the day you apply, after which it is deleted automatically. Ask us at [email protected], quoting the reference the form gave you, and we will delete it sooner.
• Spam protection: the form uses Cloudflare Turnstile to tell people from bots (section 9).

You can also apply by email instead. That email is then handled like any other email to us, and kept for the same 12 months.

5. Information we handle for clients

In consulting, systems and software work we are sometimes given access to a client's own systems or data, which can include personal information about the client's staff or customers. In that case the client is the responsible party and we act as its operator (the GDPR's processor). We use that information only to do the work the client asked for, under the client's instructions and a written agreement, as POPIA section 21 requires. Questions about that information should go to the client first. We will help them answer you.

6. Who else sees it

We do not sell, rent or trade personal information. We share it only with:

• Service providers who process it for us, under contracts that require them to protect it:
  • Zoho Corporation hosts our email (Zoho privacy policy).
  • Xero keeps our accounting records: invoices, bills and the contact details on them (Xero privacy notice).
  • Cloudflare hosts this website, stores job applications sent through it, and runs the Turnstile check on the careers page (Cloudflare privacy policy).
  Our working files, such as proposals, contracts and project documents, are kept on our own storage server in our office, not with a cloud provider.
• Our professional advisers, such as our accountants, auditors and attorneys, where they need it to advise us. They are bound by professional confidentiality.
• Authorities, such as the South African Revenue Service, where the law requires it.
• A client's or supplier's own team, where that is part of the work, for example copying the right people on a project email.

7. Marketing

We do not send unsolicited marketing emails and we do not add anyone to a mailing list. We may write to an existing client about work similar to what we already do for them. You can tell us to stop at any time, and we will.

8. How long we keep it

9. The website

matunos.com sets no cookies, shows no advertising, and does not track you across websites. We cannot see who visits it. The site's typefaces are served from matunos.com itself, not from a font provider.

The site is hosted by Cloudflare, which processes technical information needed to deliver any web page, such as your IP address and browser type, for delivery and security. Through Cloudflare, the site also:

• Counts visits with Cloudflare Web Analytics. It sets no cookies and does not track you across websites. It records figures such as which page was viewed, the site that linked to it, your browser and device type, your country and how quickly the page loaded. We see only totals, never individual visitors.
• Checks for automated bots. Cloudflare's bot protection may run a short script in your browser to tell people apart from automated scrapers.
• Hides email addresses from spam harvesters. A small script from this site reveals them in your browser.
• On the careers page only, checks that an application comes from a person. The page loads Cloudflare Turnstile from challenges.cloudflare.com, which looks at technical signals such as your IP address and browser to tell people from bots. Cloudflare says it does not use these signals to identify, profile or target anyone, and it also uses them to improve its bot detection (Turnstile privacy addendum). No other page loads it.

10. Security

We keep personal information in business accounts protected by strong passwords and, wherever the provider supports it, two-factor authentication. The same applies to our office storage server. We give access only to people who need it, and use providers that encrypt data in transit. No system is perfectly secure. If a breach puts your personal information at risk, we will tell you and the Information Regulator as POPIA section 22 requires.

11. Your rights

Under POPIA you have the right to know whether we hold personal information about you, and to ask for access to it, for it to be corrected, or for it to be deleted. You can object to how we use it, and complain to the Information Regulator. If you are in the EU or UK, the GDPR also gives you rights to restrict processing, to data portability, and to withdraw consent, and to complain to your local data protection authority.

To use any of these rights, write to [email protected]. It is free, and we will answer within 30 days. We may need to confirm who you are first. Formal requests for records can also be made under the Promotion of Access to Information Act, 2000 (PAIA).

We make no automated decisions about people that have legal or similarly significant effects.

12. Legal bases and international transfers

• Enquiries: our legitimate interest in answering messages sent to us (POPIA section 11(1)(f); GDPR Article 6(1)(f)), or steps you asked us to take before a contract (Article 6(1)(b)).
• Clients and suppliers: performing our contract with you or your organisation (POPIA section 11(1)(b); GDPR Article 6(1)(b)), and our legitimate interest in running the business.
• Job applications: your consent (POPIA section 11(1)(a); GDPR Article 6(1)(a)), and steps you asked us to take before a possible employment contract (Article 6(1)(b)).
• Records we must keep: complying with the law (POPIA section 11(1)(c); GDPR Article 6(1)(c)).
• Transfers: our email, accounting and website providers (including the storage that holds job applications) may store or process information outside South Africa, the EU or the UK. Where that happens we rely on the providers' contractual data-protection commitments, as POPIA section 72 and GDPR Chapter V permit.

13. Changes to this notice

If we change how we handle personal information, we will update this notice and the date at the top before the change takes effect. Past versions are available on request.

14. Contact and complaints

For any question about privacy or this notice, or to exercise your rights:

If you are not satisfied with our response, you have the right to complain to the Information Regulator: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 · [email protected] · inforegulator.org.za. If you are in the EU or UK, you may complain to your local data protection authority.