Privacy Policy

The Bloc Studio (Pty) Ltd | Registration No: 2025/631931/07 | Last updated: 30 June 2026

1. Who We Are

This Privacy Policy explains how The Bloc Studio (Pty) Ltd (“TBS”, “we”, “us”, or “our”) collects, uses, discloses, and protects personal information in connection with our website, our web design and digital agency services, and our interactions with clients, prospective clients, freelancers, subcontractors, and website visitors.

TBS is registered in South Africa under company registration number 2025/631931/07, with its registered office at 54 Cross Street, President Ridge, Randburg, 2194, South Africa.

This Policy applies regardless of where you are accessing our website or services from, including South Africa, the United Kingdom, the European Union, and the United States. Where the laws of your jurisdiction grant you additional or different rights, the relevant sections below set those out specifically.

2. Information Officer

TBS has appointed an Information Officer in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and the Promotion of Access to Information Act 2 of 2000 (PAIA). The Information Officer is registered with the Information Regulator of South Africa.

• Name: Diandra Kim Holden, Director
• Email: diandra@thebloc.studio
• Telephone: +27 61 527 3835
• General enquiries: hey@thebloc.studio

No Deputy Information Officer is currently designated. All requests relating to personal information or access to records should be directed to the Information Officer above.

3. What Personal Information We Collect

The personal information we process depends on your relationship with TBS:

• Clients and prospective clients: name, contact details, business address, company registration details, billing and payment information.
• Freelancers and subcontractors: name, contact details, banking details, and contractual terms.
• Website visitors: name, email address, and any message submitted via our website contact form, together with technical usage and browsing behaviour data collected through Google Analytics, Google Tag Manager, Google Search Console, and Microsoft Clarity.

4. Why We Process Your Personal Information

We process personal information for the following purposes:

• Responding to enquiries from clients and prospective clients
• Performing and managing web design and digital agency service contracts
• Managing relationships with freelancers and subcontractors
• Maintaining accounting and statutory records
• Complying with our legal and regulatory obligations

Our legal basis for processing depends on the context, and includes: performance of a contract with you, your consent, our legitimate business interests, and compliance with a legal obligation.

5. Who We Share Your Information With

TBS does not sell personal information to any third party. We share personal information only with the service providers necessary to operate our business, each of whom is contractually bound to use your information solely to provide their service to us:

• Openbooks Accounting (Daniel Abrams), uMdloti — annual financial statements and accounting records
• Google LLC (Google Drive) — cloud storage of company, client, and project records
• Verpex — website and IT infrastructure hosting
• Google LLC (Google Analytics, Google Tag Manager, Google Search Console) — website analytics and search performance data
• Microsoft Corporation (Microsoft Clarity) — website session and user behaviour data

We may also disclose personal information to law enforcement, regulatory authorities, or in connection with legal proceedings where required by law, or to protect our legal rights.

6. International Data Transfers

Our website is hosted by Verpex on servers situated in the European Union. Website analytics and search performance data may be processed by Google LLC and Microsoft Corporation on servers situated outside South Africa, including in the United States. Company, client, and project records stored on Google Drive may similarly be processed by Google LLC outside South Africa.

Where personal information is transferred outside South Africa, the United Kingdom, or the European Economic Area, we take reasonable steps to ensure it receives an equivalent level of protection, including reliance on the data processing terms and safeguards offered by our service providers.

7. Data Security

TBS has implemented two-factor authentication (2FA) across its business systems and accounts, together with malware and antivirus protection on its devices and infrastructure, to safeguard the confidentiality, integrity, and availability of personal information in our care.

8. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes described in this Policy, including to comply with our legal, accounting, or reporting obligations, resolve disputes, and enforce our agreements. Where information is no longer required, it is securely deleted or anonymised.

9. Cookies and Website Analytics

Our website uses cookies and similar technologies to operate certain features, understand how visitors use our site, and improve our services. This includes Google Analytics, Google Tag Manager, Google Search Console, and Microsoft Clarity.

Where required by applicable law — including for visitors from the United Kingdom and European Union — non-essential cookies are only set with your consent, which you can manage through our cookie consent banner at any time. You may also disable cookies through your browser settings, though this may affect certain website functionality.

10. Children’s Information

TBS does not knowingly collect personal information from children under the age of 18. If you believe a child has provided us with personal information, please contact us and we will take reasonable steps to remove it.

11. Your Rights Under POPIA (South Africa)

If you are located in South Africa, you have the following rights under POPIA:

• The right to access the personal information we hold about you
• The right to request correction, updating, or deletion of your personal information
• The right to object to the processing of your personal information
• The right to withdraw consent, where processing is based on consent
• The right to lodge a complaint with the Information Regulator of South Africa

Requests for access to records held by TBS, including personal information, may be made in accordance with our PAIA Manual, available on our website and on request from the Information Officer.

12. Your Rights Under UK and EU GDPR

If you are located in the United Kingdom or the European Union, you have rights under the UK General Data Protection Regulation and the EU General Data Protection Regulation, including:

• The right of access to your personal data
• The right to rectification of inaccurate or incomplete data
• The right to erasure (“right to be forgotten”), subject to applicable legal exceptions
• The right to restrict or object to processing
• The right to data portability
• The right to withdraw consent at any time, where processing is based on consent
• The right to lodge a complaint with your local supervisory authority, such as the Information Commissioner’s Office (ICO) in the United Kingdom

TBS acts as the data controller in respect of personal information collected directly through our website and client relationships. Where you wish to exercise any of the above rights, please contact us using the details in Section 2.

13. Your Rights Under CCPA/CPRA (California, United States)

If you are a California resident, you have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), including:

• The right to know what personal information we have collected, used, and disclosed about you
• The right to request deletion of your personal information, subject to certain exceptions
• The right to correct inaccurate personal information
• The right to opt out of the sale or sharing of personal information
• The right to non-discrimination for exercising your privacy rights

TBS does not sell personal information to third parties for monetary or other valuable consideration. To exercise any of these rights, please contact us using the details in Section 2. We will respond to verifiable requests within the timeframes required by applicable law.

14. Exercising Your Rights and Making a Request

To exercise any right described in this Policy, or to request access to a record under PAIA, please contact our Information Officer using the details in Section 2. We may need to verify your identity before responding to your request. Formal PAIA access requests must be submitted on the prescribed Form 02 in accordance with our PAIA Manual.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The “Last updated” date at the top of this Policy indicates when it was last revised.

16. Contact Us

If you have any questions about this Privacy Policy, please contact us:

• Email: hey@thebloc.studio
• Information Officer: diandra@thebloc.studio
• Telephone: +27 61 527 3835
• Address: 54 Cross Street, President Ridge, Randburg, 2194, South Africa