Legal

Privacy Policy

Last updated: 24 March 2026

Who We Are

Xethos is a technology consulting and fractional CTO practice based in Cape Town, South Africa. Our website is xethos.co.

Information Officer: Arrie Burger, privacy@xethos.co.

Data We Collect

We collect data in three categories:

Contact form

  • Name
  • Email address
  • Company (optional)
  • Message
  • How you heard about us (optional)

Analytics

Google Analytics 4 collects anonymised usage data including pages visited, time on site, device type, browser, and approximate location (country/city level). It uses cookies (_ga, _ga_*) to distinguish users and maintain session state.

Technical

Your IP address is temporarily processed for rate limiting on the contact form. It is not stored permanently.

How We Use Your Data

  • Contact form submissions: to respond to your enquiry.
  • Analytics data: to understand how visitors use our site and improve it.
  • Rate limiting: to prevent abuse of the contact form.

We do not use your data for marketing, profiling, or automated decision-making.

Third Parties

We share data with the following service providers only:

  • Google Analytics - analytics processing, USA. A data processing agreement is in place.
  • Resend - email delivery for contact form submissions, USA.
  • Cloudflare - bot protection via Turnstile and CDN services.

We do not sell, trade, or rent your personal information to anyone.

Cookies

  • _ga - Distinguishes users. Set by Google Analytics. Expires after 2 years.
  • _ga_* - Maintains session state. Set by Google Analytics. Expires after 2 years.

No cookies are set until you accept cookies via our consent banner. You can manage cookies through your browser settings or by clicking "Cookie Settings" in our footer.

If you reject cookies, Google Analytics will not load and no tracking cookies will be set.

Data Retention

  • Contact form submissions: retained in our email for as long as necessary to respond to your enquiry, then deleted.
  • Analytics data: retained by Google Analytics according to our configured retention period (14 months).
  • Rate limiting data: processed in memory only, not stored.

Your Rights Under POPIA

If you are a South African visitor or data subject, you have the following rights:

  • Right to access your personal information
  • Right to correct inaccurate information
  • Right to request deletion of your information
  • Right to object to processing
  • Right to lodge a complaint with the Information Regulator

Your Rights Under GDPR

If you are an EU or UK visitor, you have all the rights listed above, plus:

  • Right to data portability
  • Right to restrict processing
  • Right to withdraw consent at any time (for cookie consent, use the Cookie Settings in our footer)
  • Right to lodge a complaint with your local data protection authority

How to Exercise Your Rights

Contact us at privacy@xethos.co. We will respond within 30 days. To verify your identity, we may ask you to confirm details associated with your enquiry.

Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated "Last updated" date. We encourage you to review this page periodically.

Contact

If you have questions about this policy, please get in touch: Arrie Burger, privacy@xethos.co.