Title: Privacy | DigitalFreedom Source: https://digitalfreedom.co.za/privacy/ Last updated: 2026-10-14 --- Privacy # Privacy Last updated: 14 October 2026 This notice covers the website [digitalfreedom.co.za](https://digitalfreedom.co.za/) and, in [section 14](https://digitalfreedom.co.za/privacy/#outreach), how we handle your data when we write to or call your company without prior contact. Our apps have separate privacy notices. This English version is the authoritative one; the German version at [/de/datenschutz/](https://digitalfreedom.co.za/de/datenschutz/) is a translation provided for information only. ## 1\. Controller Controller pursuant to Art. 4 (7) GDPR: DigitalFreedom Global LLC (trading as "DigitalFreedom") 30 N Gould St, Ste N Sheridan, WY 82801, United States Data protection inquiries: [data-protection@digitalfreedom.co.za](mailto:data-protection@digitalfreedom.co.za) General inquiries: [hello@digitalfreedom.co.za](mailto:hello@digitalfreedom.co.za) ## 2\. Data Protection Officer We have not appointed a Data Protection Officer because we do not meet the threshold criteria under Art. 37 GDPR / § 38 BDSG. For inquiries, contact the controller directly. ## 3\. Hosting (GitHub Pages) The site is served as static content from **GitHub Pages** (GitHub Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA). On every request, GitHub processes technically necessary data: - IP address of the requesting device - Date and time of the request - Requested resource (path and filename) - Volume of data transferred - HTTP status code - Referrer URL (if transmitted) - Browser user-agent This processing serves the secure and stable delivery of the site. Legal basis: Art. 6 (1)(f) GDPR (legitimate interest). We do not keep server logs ourselves; data collected by GitHub is handled per its policies. Transfer to the United States relies on the EU Standard Contractual Clauses pursuant to Art. 46 (2)(c) GDPR, supplemented where applicable by GitHub's self-certification under the EU-US Data Privacy Framework. More: [GitHub Privacy Statement](https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement). ## 4\. Cookies and Consent Banner A consent banner is shown on your first visit. It gives you explicit control over the two categories of non-essential processing on this site: **analytics** (Google Analytics 4) and **embedded YouTube videos**. Without your consent, no analytics cookies are set, no YouTube player is loaded, and Google Analytics is not loaded at all: before your consent, your browser makes no connection to Google servers for analytics purposes, and no data is transmitted to Google (see section 8 for detail and legal basis). Your consent decision is stored in a single *localStorage* entry (df\_consent) on your device only and is never transmitted to us or third parties. You can change or withdraw your consent at any time via the "Cookie settings" link in the footer. Legal basis: Art. 6 (1)(a) GDPR and § 25 (1) TDDDG (consent) for analytics and YouTube; Art. 6 (1)(f) GDPR for storing the consent decision itself. ## 5\. localStorage Two technically necessary entries are stored in your browser's *localStorage*: your language preference and your cookie-consent decision (df\_consent). Both values stay on your device and are never transmitted to us or third parties. Legal basis: Art. 6 (1)(f) GDPR. ## 6\. Fonts (Self-Hosted) We use only locally hosted fonts (Fraunces, Inter, JetBrains Mono). Font files are served from the same origin as the site. **No connection is made to Google Fonts or any other third-party font provider.** ## 7\. YouTube Videos (Consent-Gated) Some sub-pages (e.g. the page of J. Rosenstock) embed videos hosted on YouTube. We exclusively use the privacy-enhanced domain *youtube-nocookie.com*. The player loads only after you grant consent, either site-wide via the cookie banner ("Accept all" or enabling "YouTube videos" in Settings) or per video via the "Load video" button shown in place of an unloaded player. Before consent, no connection to Google is established. Once you load the player, data is processed by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and / or Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) per their privacy notice. Legal basis: Art. 6 (1)(a) GDPR (consent). You can withdraw consent at any time via the "Cookie settings" link in the footer. More: [Google Privacy Policy](https://policies.google.com/privacy). ## 8\. Google Analytics 4 With your consent we use **Google Analytics 4** (Property G-EGH0MHBZ0B), provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and / or Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Analytics is used solely to understand which pages on this site are read. Advertising features (Google Signals, remarketing, ad personalisation) are **not** enabled. Processed data includes: anonymised IP address (truncated by Google before storage), pages visited, referrer, approximate region (country/city level), device type, browser, screen resolution, language, and a randomly generated client identifier. The Google tag is loaded **only after you click "Accept all"** (or enable "Analytics" in Settings and save). Before that, and if you click "Only necessary", the Google tag is not loaded: no request is sent to googletagmanager.com or google-analytics.com, no cookies are set and no data reaches Google. If you have consented on an earlier visit, the tag is loaded when a page is opened, based on the choice stored on your device. If you withdraw your consent, nothing is sent to Google any more; reloading the page ends the loading of the tag completely. Legal basis: Art. 6 (1)(a) GDPR and § 25 (1) TDDDG (consent). Retention: Google retains user-level data for **14 months** (the default for new GA4 properties) before automatic deletion. Aggregated reports remain available beyond that period. Transfer to the United States relies on Google LLC's certification under the EU-US Data Privacy Framework (Art. 45 GDPR adequacy decision) and, as a fallback, the EU Standard Contractual Clauses pursuant to Art. 46 (2)(c) GDPR. You can withdraw your consent at any time with effect for the future via the "Cookie settings" link in the footer. More: [Google Privacy Policy](https://policies.google.com/privacy), [Google Ads Data Processing Terms](https://business.safety.google/adscontrollerterms/). We use **no** other web analytics tools, no advertising-network tracking, and no conversion pixels. ## 9\. Recipients We pass personal data only to: - GitHub Inc. (hosting of static content and the associated technical request logs) - Google LLC / Google Ireland Limited (Google Analytics 4, with your consent; and YouTube, only when you actively load a video with your consent) - Migadu (email, when you write to us; see section 10) No transmission to other third parties occurs, unless required by law. ## 10\. Contact by Email If you email us, we process your message and your contact details to answer the enquiry. Legal basis: Art. 6 (1)(b) GDPR where the enquiry concerns a contract, otherwise Art. 6 (1)(f) GDPR (legitimate interest in answering it). Our email is hosted by Migadu, a provider in Switzerland, on servers in France, that is, in the EU. Switzerland is covered by an adequacy decision of the European Commission under Art. 45 GDPR. Every service provider, with location and contractual basis, is listed in the [overview “Where our data lives”](https://digitalfreedom.co.za/#data). ## 11\. Retention We do not store personal data on our own servers. Hosting access logs are retained per GitHub Pages' retention policy. We keep emails until the enquiry has been dealt with, and beyond that only within statutory retention periods. ## 12\. Your Rights You have the right to: - Access to your data (Art. 15 GDPR) - Rectification of inaccurate data (Art. 16 GDPR) - Erasure (Art. 17 GDPR) - Restriction of processing (Art. 18 GDPR) - Data portability (Art. 20 GDPR) - Objection to processing based on legitimate interests (Art. 21 GDPR) - Withdrawal of consent with effect for the future (Art. 7 (3) GDPR) To exercise these rights, contact [data-protection@digitalfreedom.co.za](mailto:data-protection@digitalfreedom.co.za). ## 13\. Right to Lodge a Complaint You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is the one of your habitual residence, your place of work, or the place of the alleged infringement. In the United Kingdom this is the Information Commissioner's Office (ICO). The controller has no establishment in the Union; the one-stop-shop mechanism for a lead supervisory authority under Art. 56 GDPR therefore does not apply. ## 14\. When We Write to or Call Your Company This section is for people we contact in their business role by email, or by phone through their company's switchboard, without having been in touch before, for example as founder, managing director or head of security of a company. It contains the information required by Art. 13 and 14 GDPR and Art. 13 and 14 UK GDPR, and we apply it in the same way to everyone we contact like this, wherever they are based. What applies only to calls is set out in [14.13](https://digitalfreedom.co.za/privacy/#outreach-phone). ### 14.1 Who is responsible DigitalFreedom Global LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, United States. For any question about your data, write to [data-protection@digitalfreedom.co.za](mailto:data-protection@digitalfreedom.co.za). A reply to our email works just as well. ### 14.2 Why we use your data - to write to your company about our services for companies that run or plan an app (building, taking over, rescuing and running apps), once and with at most one follow-up - to deal with your reply and any conversation that follows from it - to record where and when we found your details, so that we can tell you and show it to a supervisory authority - to make sure we never write to you again once you have objected ### 14.3 Legal basis Art. 6 (1)(f) GDPR and Art. 6 (1)(f) UK GDPR (legitimate interests). Our interest is to win business clients; direct marketing is recognised as a legitimate interest (Recital 47 GDPR). We have weighed this against your interests and consider that ours prevail, because we only use business contact details that are publicly available, write to you only in your professional role about a topic connected to your company's business, send no more than two messages, use no tracking and stop as soon as you object. ### 14.4 What data we use - your name and your role in the company - your business email address - the name and website of your company - where and when we found this information - a short note on the public information about your company that our message refers to - our email correspondence with you We use no private addresses, do not add data from other sources and do not build profiles. Our emails contain no tracking pixels and no personalised links. ### 14.5 Where the data comes from From public sources: company registers such as Companies House, your company's website, its listings in the Apple App Store and on Google Play, and public announcements such as press releases or job postings. Our first email names the exact source. ### 14.6 Who receives the data Only service providers who process the data on our behalf: - Migadu, our email provider, based in Switzerland, with servers in France - Civo, on whose servers in the United Kingdom and Europe we keep our records Location and contractual basis of each provider are listed in the [overview “Where our data lives”](https://digitalfreedom.co.za/#data). We do not sell your data or pass it to anyone else, unless the law requires us to. ### 14.7 Countries outside the EEA and the UK The data is stored in the EU and the United Kingdom. Between the two, adequacy decisions apply in both directions; for Switzerland, where Migadu is based, an adequacy decision of the European Commission applies as well. DigitalFreedom Global LLC is established in the United States and accesses the data as the controller. Beyond that, we do not transfer your data to recipients in other countries. ### 14.8 How long we keep it - We note your name and address only shortly before we write. If no message goes out, we delete them no later than one month after we noted them. - If you do not reply, we delete your data six months after our last message. - If you object or decline, we delete your data straight away and keep only the suppression entry described in 14.9. - If you reply with interest, your data becomes part of our business correspondence and is kept for as long as that conversation or a resulting contract requires, and beyond that only within statutory retention periods. ### 14.9 Your right to object You can object at any time and without giving reasons to the use of your data for direct marketing (Art. 21 (2) GDPR and Art. 21 (2) UK GDPR). Simply reply “stop” to our email or write to [data-protection@digitalfreedom.co.za](mailto:data-protection@digitalfreedom.co.za). Any reply that declines counts as an objection. After that we no longer use your data for this purpose and delete it. We keep only a suppression entry with your email address, or a hashed form of it, and the date, so that we do not write to you again. We keep this entry for as long as we contact companies in this way, and for no other purpose. ### 14.10 Your other rights You can ask us for access to your data (Art. 15), have it corrected (Art. 16) or deleted (Art. 17), and have its processing restricted (Art. 18), each under the GDPR and the UK GDPR. Write to [data-protection@digitalfreedom.co.za](mailto:data-protection@digitalfreedom.co.za) or use the [request form](https://data-protection.digitalfreedom.co.za/). We reply within one month. ### 14.11 Right to complain You can complain to a data protection supervisory authority (Art. 77 GDPR and UK GDPR), in particular the one where you live or work or where you believe the infringement took place. For the countries we write to, these are the Information Commissioner's Office (United Kingdom), the Data Protection Commission (Ireland), the CNIL (France), Integritetsskyddsmyndigheten (Sweden), the Office of the Data Protection Ombudsman (Finland), the CNPD (Portugal) and Datatilsynet (Norway). For calls in Germany, it is the data protection authority of the federal state where you work. In Switzerland, you can contact the Federal Data Protection and Information Commissioner (FDPIC). ### 14.12 No automated decisions We do not make decisions based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR. Each company is selected and each message is written individually. ### 14.13 When we call your company We call companies in Germany and Switzerland, only on the switchboard number given in the company's imprint and only for a specific reason that is publicly documented, such as a tender, a job posting, a press release or an app's store listing. We show our number, do not record calls and use no automated calls and no recorded or synthetic voices. Everything in 14.1 to 14.12 applies to calls as well, with these additions: - Purpose: to introduce the services described in 14.2 to your company by phone and, if you wish, to arrange a conversation or send you information by email; to record when and for what reason we called and with what outcome; to make sure we do not call again after you have said no. - Legal basis: Art. 6 (1)(f) GDPR and Art. 6 (1)(f) UK GDPR (legitimate interests), as in 14.3. Our balancing also takes into account that we only call the switchboard, only with a documented reason, no more than twice for the same reason, with at most one voicemail message, and that we end the call at once if you decline. After a call we send an email only if you have expressly agreed to it on the phone. - What the call log contains: date and time of the call; the name and country of your company and its switchboard number; the reason for the call and its source; the role of the person we spoke to; the outcome, for example not reached, voicemail left, not interested, meeting arranged or email requested; if you agreed to an email, your words and the time; a callback time if one was agreed; a short note on the conversation. We do not enter names in the call log. If you give us your name and email address for an email, they are kept only in our mailbox. - Where the data comes from: the switchboard number from your company's imprint, in Switzerland also from the public telephone directory so that we can respect an opt-out marker there; the reason for the call from the public source we name on the phone; your role and the outcome from the call itself. - Where the data is kept: we keep the call log and the suppression list in our own Nextcloud on Civo's servers (see 14.6). There are no other recipients. - How long we keep it: if the call does not lead to a further conversation, we delete the entry six months after the last call. If you decline or object, we delete the details of the call on the same day. If a conversation or an assignment follows, the last point in 14.8 applies. Objecting on the phone: saying “not interested” or “please don't call again” is enough, and you do not have to give a reason. We end the call, delete the details of it on the same day and put your company on our suppression list straight away. After that we will not call you again or write to you. The suppression list holds only the date, your company's name, country and website, its switchboard number and the reason, and no names of individuals. We keep it for as long as we contact companies in this way, and for no other purpose. You can also object at any time by writing to [data-protection@digitalfreedom.co.za](mailto:data-protection@digitalfreedom.co.za); otherwise 14.9 applies. ## 15\. Changes to This Notice We update this notice when changes to the services we use or to the legal framework make that necessary. The version published here at the time of your visit applies.