Privacy Policy

This privacy policy explains how Fuelish (Pty) Ltd, trading as We Own Leads, collects, uses, stores, and protects your personal information when you visit weownleads.com or engage with our services. It is written to align with the Protection of Personal Information Act 4 of 2013 (POPIA) and the Electronic Communications and Transactions Act 25 of 2002 (ECTA).

1. Responsible Party

The responsible party for the processing of your personal information is:

Fuelish (Pty) Ltd trading as We Own Leads
CIPC registration: 2025/812492/07
Johannesburg, South Africa. Serving SMEs nationwide
Email: hello@weownleads.com
WhatsApp: +27 72 015 5651

2. Information Officer

Our designated Information Officer for the purposes of POPIA is Ty Panaino. To contact the Information Officer regarding any matter related to your personal information, including access requests, correction requests, deletion requests, or complaints, email hello@weownleads.com with "POPIA" in the subject line.

3. What Personal Information We Collect

We collect the following categories of personal information about you:

• Contact information you provide directly: name, email address, phone number, business name, and any message content when you submit a contact form, request a free audit, subscribe to our newsletter, or book a call.
• Booking and lead data: when you complete our contact funnel, we capture province, business category, current lead source, and any business context you share with us.
• Usage and device data collected automatically: pages visited, time on site, referral source, approximate location at city or province level, device type, browser, and operating system. This data is collected via Google Analytics 4 (only after you grant analytics consent) and via Mautic visitor tracking running on our own infrastructure.
• IP address: your IP address is captured by our hosting layer (Vercel) and our cookie-consent layer for security, fraud prevention, and approximate geolocation. IP addresses are anonymised before storage in Google Analytics.
• Marketing engagement data: if you subscribe to a newsletter or receive transactional emails from us, we record opens, clicks, and unsubscribes to measure engagement and respect your preferences.

We do not collect special personal information as defined in POPIA s. 26 (such as race, health, religious beliefs, biometric data, or financial account details). We do not knowingly collect personal information from anyone under the age of 18.

4. Lawful Basis for Processing

We process your personal information on the lawful bases set out in POPIA s. 11:

• Consent: for marketing communications, analytics cookies, advertising cookies, and any optional newsletter subscription. Consent can be withdrawn at any time.
• Performance of a contract: when you become a client, we process information necessary to deliver the services agreed in your service agreement.
• Legitimate interests: for direct response to inquiries you initiate, service improvement, fraud prevention, and security monitoring, balanced against your reasonable privacy expectations.
• Compliance with a legal obligation: including the retention of transactional and tax records for the periods required by South African law.

5. How We Use Your Personal Information

We use your personal information to:

• Respond to inquiries you initiate via our contact, audit, or booking forms.
• Deliver the services you have engaged us to provide.
• Send service-related communications, status updates, and reporting tied to your engagement.
• Send marketing communications you have explicitly opted in to receive, with an unsubscribe link in every message.
• Improve our website and services through analysis of aggregate usage patterns.
• Maintain the security and integrity of our systems and detect fraudulent or abusive activity.
• Comply with our legal, tax, and regulatory obligations.

6. Cookies, Pixels, and Tracking Technologies

Our website uses four categories of cookies and tracking technologies, governed by Google Consent Mode v2 and our cookie consent banner. Until you grant consent through the banner, advertising and analytics cookies are denied by default and do not fire.

• Essential cookies: required for site functionality, including the cookie consent banner itself. These are set without consent and cannot be disabled while still allowing the site to function.
• Analytics cookies (Google Analytics 4): measure how visitors use the site to help us improve it. Only set after you grant analytics consent through the banner.
• Advertising cookies (Meta Pixel): measure the effectiveness of our advertising on Facebook and Instagram and support relevant ad delivery. Only set after you grant advertising consent through the banner.
• Mautic visitor tracking: our self-hosted marketing automation platform on mautic.weownleads.com tracks page visits to support newsletter and lifecycle communications. Active for confirmed newsletter subscribers and after explicit consent in any other case.

You can withdraw or update your cookie consent at any time by clearing your browser cookies for weownleads.com and reloading the site, which presents the consent banner again.

7. Recipients and Data Processors

We share your personal information only with the data processors required to operate our services. Each processor is bound by their own data processing terms with us:

• Google LLC: Google Analytics 4 for website analytics and Firebase / Firestore for booking and lead data storage. Google operates from data centres in the United States and other regions.
• Meta Platforms Ireland Ltd: Meta Pixel for advertising measurement on Facebook and Instagram. Operates from Ireland with onward processing in the United States.
• Vercel Inc.: website hosting. Operates primarily from the United States, with edge delivery from a global network.
• Resend (Re Send Inc.): transactional and marketing email delivery. Operates from the United States.
• Mautic, self-hosted on our own infrastructure in South Africa: newsletter and lifecycle email automation. Personal information processed via Mautic stays on infrastructure we operate, in-region.

We do not sell, rent, or trade your personal information to any third party for their own marketing purposes.

8. Cross-Border Data Transfers

Several of our data processors are located outside South Africa, primarily in the United States and Ireland. POPIA s. 72 permits cross-border transfer of personal information where the receiving jurisdiction provides an adequate level of protection, where the data subject has consented, or where the transfer is necessary for the performance of a contract with the data subject. We rely on Standard Contractual Clauses, the data processing terms of our processors, and your consent (where applicable) as the lawful mechanisms for these transfers.

9. Data Retention

We retain your personal information only for as long as necessary for the purposes for which it was collected:

• Inquiry and audit form submissions: up to 24 months from the date of your last contact with us. We then delete the record unless an active service relationship is in place at that time.
• Newsletter subscribers: for as long as you remain subscribed. We retain unsubscribe records as a record of withdrawn consent, as required by law.
• Active client records: for the duration of the engagement and a further 5 years thereafter. This retention period aligns with our obligations under the Tax Administration Act 28 of 2011 and the Companies Act 71 of 2008.
• Analytics data: Google Analytics 4 retention is set to a 14-month window. After that, individual user data is automatically deleted by Google.

You can request earlier deletion by exercising your rights under section 11 below, subject to any overriding legal retention obligations on our side.

10. Security

We protect your personal information using industry-standard technical and organisational measures. These include HTTPS encryption in transit, encryption at rest within our processor stack, access controls, secure authentication, HSTS, and security headers. No system is perfectly secure. In the event of a security compromise that affects your personal information, we will notify you and the Information Regulator as required by POPIA s. 22.

11. Your Rights Under POPIA

You have the following rights regarding your personal information under POPIA s. 23 to s. 25:

• Right of access: to be informed whether we hold personal information about you, and to receive a copy. We respond to verified access requests within 30 days.
• Right of correction: to request correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained. We action correction requests as soon as is reasonably possible.
• Right to deletion: to request deletion of personal information we no longer have a lawful basis to retain. Where we are legally required to retain certain records (such as tax records), we will explain this when responding to your request.
• Right to object: to object, on reasonable grounds, to the processing of your personal information, including for direct marketing purposes. Once you object to direct marketing, we cease that processing immediately.
• Right to withdraw consent: where processing is based on your consent, you may withdraw it at any time. Withdrawal does not retroactively invalidate processing that was lawful before withdrawal.
• Right to data portability: to receive your personal information in a structured, machine-readable format where technically feasible. This applies to data you have provided to us directly.
• Right not to be subject to automated decision-making: you may object to a decision based solely on automated processing that has a legal or similarly significant effect on you. Where you would like manual review of any decision affecting you, contact our Information Officer using the details in section 2.

To exercise any of these rights, email our Information Officer at hello@weownleads.com with "POPIA" in the subject line. We will respond within 30 days of a verified request.

12. How to Lodge a Complaint

If you believe we have processed your personal information in breach of POPIA, you may lodge a complaint with the Information Regulator (South Africa):

The Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
General enquiries: enquiries@inforegulator.org.za
POPIA complaints: POPIAComplaints@inforegulator.org.za
Website: inforegulator.org.za

13. Children's Privacy

Our services are intended for use by businesses and adult professionals. We do not knowingly collect personal information from anyone under the age of 18. If you believe a minor has submitted personal information to us, contact our Information Officer and we will delete the record.

14. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices, our processor stack, or applicable law. The "Last updated" date at the top of this policy reflects the most recent revision. Material changes that affect how we use your personal information will be communicated to subscribed users via email before they take effect.

15. Contact

For any questions about this privacy policy or our data practices, contact us at:

Fuelish (Pty) Ltd trading as We Own Leads
CIPC registration: 2025/812492/07
Information Officer: Ty Panaino
Johannesburg, South Africa. Serving SMEs nationwide
Email: hello@weownleads.com
WhatsApp: +27 72 015 5651