How I handle your information.

Who is responsible

This website is run by Erzo Web Development (Pty) Ltd (“Erzo”), founded in Johannesburg in 2010. Under South Africa’s Protection of Personal Information Act (POPIA), Erzo is the “responsible party” for the information you share through this website. For visitors in the United Kingdom and the European Union, Erzo is the “controller” under the UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation (EU GDPR).

The Information Officer is Henry Shepherdson. You can reach him at henry@erzo.co.za about anything on this page.

What the contact form collects

Only what you type into it:

• Your name (up to 100 characters), so I know who I’m talking to.
• Your email address, so I can reply. It is set as the reply-to address on the email the form sends me.
• What it’s about: one of “Ideas session”, “Fractional CTO”, “Website”, “Automation”, “Security+”, “Accessibility+” or “Something else”.
• Your message (up to 5,000 characters).

Where your message goes

Messages you send through the contact form arrive at assistant@erzo.co.za, my assistant inbox, which I read myself, and a copy comes to my own mailboxes. Emails you send directly to henry@erzo.co.za go straight to my own inbox. Either way, your message is handled as this notice describes.

The form doesn’t ask for a phone number, company, address or anything else. Please don’t include sensitive details such as health or financial information in your message.

There is also a hidden field that people never see. It catches automated spam, and anything typed into it is thrown away.

Collected automatically

• Bot check (Cloudflare Turnstile). To stop spam, the contact form and the questionnaire’s email form run Cloudflare Turnstile. It looks at technical signals from your browser and device, such as your IP address and browser characteristics, to tell people from bots. Most visitors never see a puzzle. It isn’t used for advertising or to track you across sites. See Cloudflare’s Turnstile privacy addendum.
• Rate limiting. To stop the forms being abused, the server counts submissions, and visits to the email list’s confirmation page, per IP address for 10 minutes. It stores a one-way hash of the IP address, never the address itself, and the count expires on its own.
• Hosting logs. Like any website, the servers that deliver these pages (Cloudflare) process your IP address and basic request information to deliver and secure the site.
• Visitor statistics (Cloudflare Web Analytics). See below.
• Google Analytics, only if you accept it. See below.

Questionnaire and email list

The Automation Readiness questionnaire works in your browser. Your task names and answers are kept in your browser’s session storage, so you don’t lose them if you reload the page, and they’re cleared when you close the tab. Your task names and answers don’t leave your browser unless you ask for your results by email.

If you ask for your results by email

When you tick “Email me my results” and send the form, it sends:

• your email address, so the results can be sent to you;
• your first name, if you give it (optional, up to 40 characters), so the email can say hello;
• your task names and answers, so the email can show your scores.

I use these only to build and send that one email. Erzo doesn’t store your answers in a database. The email is sent to you through Resend, from updates.erzo.co.za, and a copy of it stays in Resend’s sending logs for about 30 days. To stop the form being used to send unwanted email, the server also counts how many results emails go to each address, up to 3 a day. It stores a one-way hash of the address, never the address itself, and the count expires within 24 hours.

If you also join the email list

Joining is a separate, optional box (“Add me to Erzo’s email list”), and it starts unticked. If you tick it, I’ll send you occasional practical notes on automation and tech from Erzo. Your contact is saved in Resend (Resend Contacts) with:

• your email address, and your first name if you gave it;
• where you signed up (the Automation Readiness questionnaire);
• when you agreed, and which version of the sign-up wording you agreed to, so I can show how you joined.

You’re only added once you confirm. Ticking the box doesn’t add you to the list. Instead, your results email includes a “Confirm my sign-up” link, so nobody can sign you up with your address. The link opens a page on erzo.co.za where you press Confirm. Only then is your contact saved in Resend, and “when you agreed” is the time you pressed Confirm. If you don’t confirm, nothing is saved and the link stops working after 7 days.

The link carries your email address, your first name if you gave it, the version of the sign-up wording and when the link was made, sealed with a secret key so it can’t be read or changed by anyone else. It isn’t stored anywhere except in the email itself, Resend’s copy of it (about 30 days), Cloudflare’s short-lived request logs, and your browser history. On its own, the link can’t be read to reveal your address.

Your task names and answers aren’t saved with your contact. If you’re already on the list, confirming again only updates when you agreed and which wording you agreed to; it doesn’t change your saved name. If you unsubscribed before, confirming a new link puts you back on the list, because that’s you asking again.

When you confirm, my assistant inbox (assistant@erzo.co.za) gets a short note so I know you’ve joined: your email address, your first name if you gave it, when you confirmed and where you signed up. It never includes your task names or answers.

Lawful basis: your consent, given by ticking each box and, for the list, pressing Confirm (POPIA sections 11 and 69; UK GDPR and EU GDPR Article 6(1)(a)).

How long: you stay on the list until you unsubscribe. When you unsubscribe, Resend keeps your contact (your email address, first name, where you signed up and when you agreed) marked as unsubscribed, so you don’t get list emails and aren’t added again by mistake. Tell me if you’d like that deleted too.

Unsubscribing or withdrawing consent: use the link at the foot of any list email, reply to any email from me with “unsubscribe”, or email henry@erzo.co.za. The link works straight away. If you reply or email me, I’ll take you off the list myself as soon as I see it. Withdrawing consent doesn’t affect anything sent before.

If you’ve accepted Google Analytics, it records that the questionnaire was started and completed, with the top score, its band and the number of tasks. It never records your task names, answers, email address or name.

Analytics and cookies

I use Cloudflare Web Analytics to see which pages are useful and how people find the site, so I can improve it. It doesn’t use cookies or store anything on your device, and it doesn’t follow you across other websites, so it runs without asking.

It records summary information about each page view: the page, the site that linked to it, your browser and device type, your country, and how quickly the page loaded. I only see totals, not individual visitors.

I also use Google Analytics 4, with Google acting as my service provider (processor), to see which pages are useful and whether people get in touch. It is off until you choose “Accept” on the analytics card at the bottom of the screen. If you decline, or don’t choose, Google Analytics isn’t loaded at all and sets no cookies.

If you accept, Google Analytics uses cookies to collect anonymous usage statistics:

• the pages you view, how you got here (for example a search engine or a link), and when;
• interactions such as scrolling, clicks on links to other sites, and the fact that a contact form was sent (never what you typed into it);
• that a form was started: the page it’s on and the name of the first field you used, never what you type;
• your device type, browser, operating system, screen size and language;
• your approximate location (country and city), worked out from your IP address. Google Analytics 4 doesn’t store IP addresses;
• a random identifier stored in cookies, so repeat visits can be counted.

It sets these first-party cookies on erzo.co.za:

Google signals and ad personalisation are switched off, and the advertising consent signals (Google Consent Mode) are always set to “denied”. This data isn’t used for advertising, and I don’t combine it with what you send through the contact form. Google keeps the analytics data for no longer than the retention period set for the site, which is 14 months at most.

Your choice is saved in your browser’s local storage (erzo-analytics-consent), so the card doesn’t ask again. That entry stays on your device and isn’t sent to anyone.

Changing your mind: choose Cookie settings at the bottom of any page and select “Decline”. Google Analytics stops recording straight away, in every open tab, and its _ga cookies are deleted. You can also clear cookies in your browser, or use Google’s opt-out browser add-on.

No advertising cookies are used on this site, and no analytics cookies are set unless you accept Google Analytics.

Google Search Console gives me summary reports about how the site appears in Google Search (for example search terms, clicks and impressions). It adds no code or cookies to this site, and it doesn’t give me information about individual visitors.

Why, and on what basis

I use what you send through the form only to read and reply to your enquiry, and to keep a record of our conversation if we go on to work together. The lawful basis is your consent when you choose to send the message, and taking steps you’ve asked for before a possible contract (POPIA section 11). For UK and EU visitors, the lawful bases are taking steps at your request before a possible contract, and my legitimate interest in answering enquiries (UK GDPR and EU GDPR Article 6(1)(b) and (f)). Cloudflare’s visitor statistics rely on my legitimate interest in keeping the site useful and secure; they use no cookies and don’t identify you. Google Analytics runs only with your consent, which you can withdraw at any time. I only use your information for marketing if you join the email list (see Questionnaire and email list), and I don’t sell or share it, other than with the service providers below who help run the site.

Where it’s processed

Cross-border transfers. Cloudflare, Resend and Google process information outside South Africa, and your message arrives in a mailbox in South Africa, with a copy in my Google Workspace mailbox. Under POPIA section 72, I only use providers that are bound by data-protection terms, laws or binding rules that give protection substantially similar to POPIA, or where you have consented to the transfer. If you’re in the UK or the EU, your information is transferred outside the UK or the EU: Resend keeps the emails and the email list in the EU (Ireland), but Cloudflare and Google process information in the United States and elsewhere, and replies come from South Africa. I rely on the safeguards in each provider’s data-processing terms for that, such as the standard contractual clauses approved for these transfers.

How long I keep it

• Your message and email address: in my mailboxes for up to 24 months after our last contact, unless we start working together, when it becomes part of the client record.
• Questionnaire answers in your browser: until you close the tab.
• Email list: until you unsubscribe (see above). If you don’t confirm, you’re never added.
• Confirmation links: they stop working after 7 days.
• Sign-up notes to my assistant inbox: like other email, in my mailboxes for up to 24 months after our last contact.
• Resend’s sending logs, including results emails: about 30 days.
• Rate-limit counters: 10 minutes per IP address, and up to 24 hours per email address for results emails.
• Google Analytics: up to 14 months; its cookies expire after 2 years, or straight away when you withdraw consent.
• Turnstile, visitor statistics and hosting logs: as set out in Cloudflare’s policies.

Your rights

You can ask me at any time:

• whether I hold information about you, and for a copy of it;
• to correct it, or to delete it;
• to stop using it, or object to how it’s used;
• if you’re in the UK or the EU, to restrict how it’s used, or to have it sent to you or another organisation in a portable format.

Email henry@erzo.co.za and I’ll respond within 30 days. I may ask you to confirm it’s you first, so I don’t give your information to someone else.

If you’re unhappy with how I’ve handled your information, you can complain to South Africa’s Information Regulator: inforegulator.org.za, POPIAComplaints@inforegulator.org.za, 010 023 5200. If you’re in the UK, you can complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint. If you’re in the EU, you can complain to the data protection authority in your country: list of EU data protection authorities.

Security

The site is served only over HTTPS. Form submissions are checked on the server, the email-service keys and the key that seals confirmation links are stored as encrypted Cloudflare secrets (never in the website’s code), and access to the mailbox is limited to Erzo.

Changes

I’ll update this page if anything changes. Last updated: 30 October 2026.

See also the accessibility statement.