Home / Privacy policy
Privacy policy
Effective 31 August 2026. Prepared in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and the UK and EU General Data Protection Regulation.
1. Scope
This policy applies to personal information collected through this website. It sets out what is collected, the purpose and lawful basis for processing it, who it is disclosed to, how long it is retained, and the rights available to data subjects.
This website sets no cookies. It uses no analytics, advertising or marketing technology, no session recording, no cross-site tracking, no social media integrations, no embedded media and no third-party fonts.
2. Responsible party
Responsible party (POPIA) and controller (UK/EU GDPR): Bloodless Diamonds Africa, Lichtenburg, North West Province, South Africa.
Information Officer: Dr Navin Naidoo, contactable at info@bloodlessdiamonds.com. Correspondence should be marked for the attention of the Information Officer.
No representative has been appointed in the European Union or the United Kingdom. Enquiries from data subjects in either jurisdiction should be directed to the address above.
3. Information collected and lawful basis
| Category | Collected | Purpose | Lawful basis |
|---|---|---|---|
| Enquiry form data: name and email address (required); country, investment range and message (optional) | On submission of the enquiry form | To respond to the enquiry | Consent, obtained by affirmative opt-in (POPIA s11(1)(a); GDPR Art 6(1)(a)) |
| Server request logs: IP address, timestamp, requested URL, referrer, user agent and response status | On each request to the site | Availability, fault diagnosis and prevention of abuse | Legitimate interests (POPIA s11(1)(f); GDPR Art 6(1)(f)) |
| Bot-challenge signals: browser and device characteristics assessed by Cloudflare Turnstile | On the enquiry page only | Distinguishing human from automated submissions | Legitimate interests (POPIA s11(1)(f); GDPR Art 6(1)(f)) |
Special personal information is not collected. Information relating to children is not knowingly collected. No automated decision-making or profiling is carried out, and no information submitted through this site is used to train machine learning systems.
No cookies are set by this site. Cloudflare Turnstile may use browser storage on the enquiry page for the sole purpose of administering the challenge; it is not used for identification or cross-site tracking.
4. Disclosure to third parties
| Recipient | Information disclosed | Purpose |
|---|---|---|
| Cloudflare, Inc. (United States) — operator | Request metadata, and enquiry form content in transit and on transmission by email | Hosting, DNS, denial-of-service protection and email delivery |
| Cloudflare Turnstile | Browser signals, on the enquiry page only | Prevention of automated abuse |
| Mailbox provider for info@bloodlessdiamonds.com | Enquiry content on delivery | Receipt of and response to enquiries |
Personal information is not disclosed to any other party. It is not sold, rented, or made available for third-party marketing or advertising. Disclosure will be made where required by law or by order of a competent court, and the data subject will be notified unless notification is prohibited.
All typefaces and assets are served from this domain. No page on this site causes a request to Google, to a font service, to an analytics provider, or to any content delivery network other than that of the hosting provider.
5. Cross-border transfer
The hosting provider operates a global network. Personal information may accordingly be processed outside South Africa and outside the European Economic Area, including in the United States. Such transfers are made under the provider's standard contractual clauses for the purposes of the GDPR, and under written agreement requiring an adequate level of protection for the purposes of section 72 of POPIA.
6. Retention
| Category | Retention period |
|---|---|
| Enquiry correspondence | 24 months from receipt, after which it is deleted, save where a longer period is required by company or tax legislation following the commencement of an investment relationship |
| Server request logs | The retention period applied by the hosting provider |
| Bot-challenge signals | Not retained |
A data subject may request deletion of their enquiry at any time. Such requests are actioned within 30 days unless retention is required by law.
7. Rights of data subjects
Data subjects have the right to:
- confirm whether personal information is held, and obtain a copy of it;
- have inaccurate or incomplete information corrected or completed;
- request deletion of personal information, or restriction of its processing;
- object to processing carried out on the basis of legitimate interests;
- withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
- receive information provided by them in a portable format, where that right applies;
- lodge a complaint with a supervisory authority.
Requests should be addressed to info@bloodlessdiamonds.com and will be responded to within 30 days. Verification of identity may be required. No fee is charged except where a request is manifestly unfounded or excessive.
Complaints under POPIA may be lodged with the Information Regulator of South Africa, JD House, 27 Stiemens Street, Braamfontein, Johannesburg, through the channels published by the Regulator. Data subjects in the European Economic Area or the United Kingdom may lodge a complaint with their national supervisory authority; in the United Kingdom this is the Information Commissioner's Office.
8. Security
The site is served exclusively over HTTPS with HTTP Strict Transport Security. A Content Security Policy prevents the loading of third-party scripts, stylesheets, fonts and connections. The enquiry endpoint accepts same-origin submissions only, verifies the bot challenge server-side, and transmits submissions directly to a mailbox without database storage. Access to that mailbox is restricted to the directors.
No system is entirely secure. In the event of a compromise likely to result in risk to data subjects, the Information Regulator and affected data subjects will be notified as required by section 22 of POPIA, as soon as reasonably practicable after the extent of the compromise has been established.
9. Documents
Documents made available on the documents page are static files. Accessing or downloading a document constitutes an ordinary web request and is recorded in the server logs described in section 3. Downloads are not attributed to individual visitors and documents are not personalised or watermarked.
10. Uploads
This site accepts no file uploads. Should this change, files will be held in a private store, will not be publicly listed, and will be deleted on request within a stated period. This policy will be updated before any such facility is made available.
11. Aggregate traffic data
Aggregate request counts, approximate geographic distribution and the proportion of automated traffic are reviewed from the hosting provider's server-side records. No script is executed in the visitor's browser to produce these figures, no cookie is set, no data is shared with a third party, and no individual is identifiable from them.
12. Amendment
This policy may be amended. The effective date at the head of this page records when it was last changed, and material amendments will be described here. Where an amendment affects the processing of information already provided, affected data subjects will be notified before it takes effect.
13. Contact
Enquiries concerning this policy or personal information held: info@bloodlessdiamonds.com.