Privacy Notice

Last updated: 13 May 2026

This Privacy Notice explains how Tree Felling Cape Town processes your personal information under the Protection of Personal Information Act 4 of 2013 ("POPIA"). It mirrors the disclosures required by section 18 of POPIA.

1. Responsible Party

Tree Felling Cape Town, operated by Craig Sandeman.
58 Frederick Street, Capricorn, Muizenberg, Cape Town, 7945.
Email: [email protected].

2. Information Officer

Information Officer: Craig Sandeman, registered with the Information Regulator of South Africa.
Email: [email protected]

3. What we collect

Name, phone number, email address and suburb when you request a tree felling quote.
Free-text description of the tree work you submit, and any photos of the tree or site you choose to send us.
If you call our line: caller ID, call recording, and AI-generated transcript of any voicemail.
Server logs (IP address hash, user agent, pages visited) for security and analytics.

Source: the data subject directly (you).

4. Purpose & lawful basis

Quote response & service delivery — performance of contract / steps to enter a contract at your request (POPIA s.11(1)(b)).
Pay-per-lead distribution — we share your quote details with a vetted local tree felling contractor from our network, who pays per lead unlocked. This is done with your consent (the consent checkbox on our quote form) and is necessary to respond to your enquiry.
Direct marketing — only with separate, explicit opt-in. We don't send marketing SMS or emails unless you tick a clearly marked marketing checkbox AFTER your first interaction with us.

5. Operators & sub-processors

We share data only with the following operators, each bound by a written agreement under s.21 of POPIA:

Cloudflare, Inc. — DNS, CDN, email routing.
Hostinger International Ltd — web hosting, MySQL database, email forwarding.
Twilio, Inc. — call tracking, voicemail recording.
fal.ai — voicemail audio transcription (Whisper model).
Anthropic, PBC — voicemail field extraction (Claude model). The audio recording itself is not retained by Anthropic; only the text transcript.
Resend, Inc. — transactional email delivery.
Google LLC (Gmail) — owner's inbox for lead notifications.
LeadsManager (Vercel + Supabase) — internal CRM that aggregates leads across Craig's lead-gen sites.
Vetted tree felling contractors — your full quote details are released to one contractor when they unlock the lead at our per-lead price. All contractors agree in writing to POPIA-compliant handling.

6. Cross-border transfer (s.72)

Some operators above (Cloudflare, Twilio, fal.ai, Anthropic, Resend, Google, Vercel) host data outside South Africa, primarily in the United States and European Union. Each operates under published Data Processing Agreements that incorporate the Standard Contractual Clauses. If you'd rather your details were not transferred outside South Africa, call us instead at 021 000 0000 (the caller-ID and call recording still pass through Twilio's South African PoP).

7. Retention

Quote enquiries: 3 years from last contact.
Voicemail recordings: 90 days, then audio is deleted (transcripts retained 3 years).
Tax invoices: 5 years (SARS).
Server access logs: 90 days.
Marketing consent records: for as long as you remain opted in, plus 12 months.

8. Your rights

You have the right to:

Access your personal information (s.23).
Request correction or deletion (s.24).
Object to processing, including direct marketing (s.11(3), s.69(3)).
Withdraw consent at any time.
Data portability where technically feasible.
Lodge a complaint with the Information Regulator.

9. Direct marketing opt-out

Reply STOP to any SMS, click unsubscribe in any email, Email [email protected]. Opt-outs are effective within 5 business days.

10. Cookies and tracking

This site uses functional cookies only (session, anti-spam) plus minimal first-party click tracking (phone button taps) to measure ad effectiveness. No third-party analytics (GA4 / Meta Pixel / Hotjar) are currently loaded. If we add any tracking third party, a granular consent banner will appear above any analytics scripts firing.

11. Security & breach notification

The site is served over HTTPS, the database is encrypted at rest, sessions use HttpOnly cookies, and access is audit-logged. If a security breach is reasonably believed to compromise your information, we will notify you and the Information Regulator under s.22.

12. Complaints to the Information Regulator

Information Regulator (South Africa)
Email: [email protected]
Tel: +27 10 023 5200
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

13. PAIA Manual

Our PAIA Manual is available on request from [email protected] and at our premises. A R50 admin fee may apply for copies.

14. Changes to this notice

Material changes will be flagged in a banner on the site for 30 days before they take effect. The "Last updated" date at the top will always reflect the most recent revision.