Privacy Policy — Helpdesk

Effective: 14 October 2026

This notice covers what happens to your data when you send us a request through this helpdesk or write to one of our email addresses. GDPR is the baseline for everyone, wherever you live; where your local law protects you more, that law applies.

1. Who is responsible

Why is the provider a US LLC?

DigitalFreedom Global LLC (trading as DigitalFreedom)
30 N Gould St, Ste N
Sheridan, WY 82801
United States

Data protection: data-protection@digitalfreedom.co.za or the request form at https://data-protection.digitalfreedom.co.za
General enquiries: hello@digitalfreedom.co.za
Imprint: https://digitalfreedom.co.za/imprint/

We have not appointed a Data Protection Officer, because we do not meet the threshold for a mandatory appointment under Art. 37 GDPR. Every data protection question goes to the address above.

2. What we process

• Your name and email address.
• The subject and content of your message, any attachments, and any account context you choose to give us.
• If you report a security vulnerability: the details of the vulnerability and your contact details.
• When you use this portal: the web server records your IP address, the time, the page requested, the referring page and your browser's user agent.
• This portal sets one cookie, a session cookie that keeps the form secure while you fill it in. It expires after two hours.
• While you type, your browser keeps a draft of your name, email address and message in its local storage on your device, so nothing is lost if the page reloads. The draft stays on your device; it is removed when you send the form.

3. Why, and on what legal basis

We use this data to handle and answer your enquiry, including complaints, data protection requests and reports of security vulnerabilities.

• Where your enquiry concerns a contract with us: Art. 6(1)(b) GDPR.
• For all other enquiries: Art. 6(1)(f) GDPR, our legitimate interest in answering them.
• Records of data protection requests: Art. 6(1)(c) GDPR, to show that we handled your request properly (Art. 5(2) GDPR).
• Vulnerability reports: Art. 6(1)(f) GDPR, our legitimate interest in the security of our products, and Art. 6(1)(c) GDPR where the law requires us to act on a report.
• Server logs: Art. 6(1)(f) GDPR, our legitimate interest in security and fault finding.
• The session cookie is strictly necessary to send the form (§ 25(2) no. 2 TDDDG and Art. 5(3) of Directive 2002/58/EC).

4. Who receives the data

Only service providers who process it on our behalf:

• Civo Limited, London, United Kingdom: hosts this helpdesk, its database and its backups in data centres in Frankfurt am Main (Germany) and London (United Kingdom). Basis: a signed data processing agreement (Art. 28(3) GDPR).
• Migadu-Mail GmbH, Switzerland: hosts the email of the domain digitalfreedom.co.za on servers in France. Migadu does not offer a separate signed data processing agreement; its Terms of Service and its Privacy Policy, which Migadu states also serves as its data processing agreement, form the basis.
• Storj, United States: keeps an additional copy of our backups, including the helpdesk database and attachments, outside Civo. No data processing agreement with Storj is in place at the date of this notice.

We do not sell your personal data. We disclose it to others only where the law requires us to.

5. Where the data is, and transfers

• Civo Frankfurt and Migadu's servers in France: inside the EU, no transfer outside the EEA.
• Civo London: covered by the European Commission's adequacy decision for the United Kingdom (Art. 45 GDPR).
• Migadu is established in Switzerland, which is covered by the European Commission's adequacy decision for Switzerland.
• Storj: the backup copy is uploaded through Storj's hosted gateway, which encrypts it on Storj's side, so Storj can access the data in readable form there; where that gateway runs has not been verified. The encrypted pieces are stored on storage nodes in the EU, because our bucket is placed in Storj's EU region. Storj is a US company, so its access is a transfer to a third country. No Standard Contractual Clauses with Storj are in place at the date of this notice, and we do not rely on an adequacy decision for it. We have prepared a request to Storj for a data processing agreement, Standard Contractual Clauses and the UK Addendum.

DigitalFreedom Global LLC is established in the United States and accesses the data as the controller. We apply the GDPR to that processing as our global baseline.

6. How long we keep it

• Open tickets: until resolved.
• Closed tickets: 3 years from closure.
• Records of data protection requests: 6 years.
• Contact details from vulnerability reports: as long as the coordinated disclosure and our records require.
• Web server logs of this portal: up to 15 days.
• The session cookie: 2 hours. The local draft: until you send the form or clear your browser's storage.
• Database backups: 30 days, rolling. The copy at Storj follows our primary backup: what is deleted there is deleted at Storj the following night.

When the period ends, the data is deleted or anonymised.

7. Your rights

Wherever you live, you have at least these rights under the GDPR: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21), withdrawal of consent at any time (Art. 7(3)), and a complaint to a supervisory authority.

Write to data-protection@digitalfreedom.co.za or use https://data-protection.digitalfreedom.co.za. You can also reach us by any other channel; we act on your request however it arrives. We answer within one month (Art. 12(3) GDPR), or within the shorter period your jurisdiction sets (section 8).

8. What your jurisdiction adds

• EU and EEA: we are not established in the Union, so there is no lead supervisory authority. You can complain to the supervisory authority where you live, where you work, or where the alleged infringement took place (Art. 77 GDPR). In Norway, Iceland and Liechtenstein that is Datatilsynet, Persónuvernd or the Datenschutzstelle.
• United Kingdom: UK GDPR and Data Protection Act 2018. Supervisory authority: the Information Commissioner's Office (ICO).
• Switzerland: revised Federal Act on Data Protection. We answer information requests within 30 days. Authority: the Federal Data Protection and Information Commissioner (FDPIC).
• United States: under the comprehensive state privacy laws we answer within 45 days, extendable once by 45 days with notice. If we deny a request you can appeal to us (except in Utah, whose law provides no appeal). California residents may use an authorized agent, will not be discriminated against for exercising their rights, and can complain to the California Privacy Protection Agency or the California Attorney General. We do not sell or share personal information.
• Canada: PIPEDA; we generally answer within 30 days. Complaints: Office of the Privacy Commissioner of Canada. Quebec (Law 25): the person responsible for the protection of personal information is Marcel R. G. Berger, data-protection@digitalfreedom.co.za, 30 N Gould St, Ste N, Sheridan, WY 82801, United States; confidentiality incidents presenting a risk of serious injury are notified to the Commission d'accès à l'information and to you without delay.
• Australia: access requests answered within 30 days; complaints to the Office of the Australian Information Commissioner (OAIC). New Zealand: access requests answered within 20 working days; complaints to the Office of the Privacy Commissioner.
• Brazil (LGPD): Encarregado: Marcel R. G. Berger, data-protection@digitalfreedom.co.za, 30 N Gould St, Ste N, Sheridan, WY 82801, United States. We answer within 15 days. Complaints: Autoridade Nacional de Proteção de Dados (ANPD).
• India (DPDP Act): Grievance Officer: Marcel R. G. Berger, data-protection@digitalfreedom.co.za. Acknowledgement within 24 hours, resolution within 15 days, extended to 30 days for complex grievances with an explanation.
• Korea (PIPA): access, correction, deletion and suspension requests are acted on within 10 days, or you are told the reason and schedule.
• Türkiye (KVKK): we answer within 30 days. You may complain to the Kişisel Verileri Koruma Kurumu after applying to us first.
• South Africa: POPIA does not apply on the present facts, because we are neither domiciled in South Africa nor process there. We still answer every enquiry through the same channels and on the same clock. Information Regulator: https://inforegulator.org.za.
• All other countries: the GDPR baseline is your floor, and any more protective mandatory local law prevails.

9. Children

Our services are not directed to children under 16, or under the age of consent that applies in your jurisdiction. If we learn that we hold data of a child, we delete it promptly.

10. No automated decisions

We make no decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

11. Security and breaches

Connections are encrypted (TLS), the session cookie is sent only over encrypted connections and cannot be read by scripts, and access to tickets is restricted to the people who answer them. If a personal data breach is likely to result in a high risk to your rights and freedoms, we notify you without undue delay (Art. 34 GDPR).

12. Changes

We may update this notice. The date at the top shows the latest revision. Material changes are communicated through this helpdesk or by email.