Privacy Policy

In The Creative Box (Pty) Ltd is a South African private company focused on economic development, policy formulation, ecosystem architecture, and tech-enabled social impact initiatives across Africa and beyond. We trade as CreativeBox World.

For privacy and personal-information purposes, In The Creative Box (Pty) Ltd is the responsible party (as defined under South Africa’s Protection of Personal Information Act, 2013 — “POPIA”) for personal information collected via this website.

This policy applies to:

• Visitors to www.creativebox.world and related pages we publish
• People who submit the contact or enquiry form
• People who email or call us using the published CreativeBox contact details
• Technical data generated when our website is accessed

It does not replace contract terms for client engagements. Where a signed agreement, proposal, or statement of work contains privacy or confidentiality clauses, those terms apply to that engagement in addition to this policy.

Information you provide directly

When you send an enquiry or otherwise contact us, we may collect:

• Full name
• Email address
• Organisation / company name
• Subject line and message content
• Phone number, if you provide one
• Any other details you choose to include (for example role or project context)

Information collected automatically

When you browse the site, our hosting and security systems may process:

• IP address and approximate location derived from IP
• Browser type, device type, and operating system
• Pages viewed, referring URL, and timestamps
• Diagnostic logs used to maintain uptime, performance, and security

We do not intentionally collect special personal information (such as health, biometric, or religious data) through this website. Please do not include sensitive personal information in enquiry forms unless we have expressly requested it for a lawful purpose.

We use personal information to:

• Respond to enquiries and schedule follow-up conversations
• Understand the nature of potential advisory or ecosystem work
• Operate, secure, and improve the website
• Detect, investigate, and prevent abuse, fraud, or security incidents
• Comply with legal, regulatory, and audit obligations
• Maintain internal records of business development communications

We do not sell personal information. We do not use website enquiry data for unsolicited bulk marketing without a lawful basis and, where required, your consent or an opportunity to opt out.

Depending on the context, we process personal information on one or more of the following bases under POPIA and related law:

• Consent — where you voluntarily submit an enquiry or request communication
• Legitimate interests — operating a secure public website, responding to business enquiries, and improving our services, balanced against your rights
• Contract / pre-contractual steps — where processing is needed to discuss or enter into a client engagement
• Legal obligation — where we must retain or disclose information to comply with law

The site may use essential cookies or local storage required for security, load balancing, or basic site function. If we enable analytics (for example aggregate traffic measurement), we will use it to understand how the site is used at a high level — not to build unrelated advertising profiles.

You can control cookies through your browser settings. Blocking some cookies may affect site functionality. Where non-essential analytics require consent under applicable law, we will implement an appropriate consent mechanism before activating those tools.

We may share personal information with:

• Service providers / operators who host the website, provide email or form delivery, security monitoring, or IT support — only as needed to perform those services
• Professional advisers such as legal or audit counsel, under confidentiality obligations
• Authorities when required by law, court order, or to protect rights, safety, and security

Current website hosting is provided via Firebase Hosting (Google). Operators who process personal information on our behalf are expected to apply appropriate security and confidentiality safeguards.

Because we use global cloud infrastructure and collaborate across African markets, personal information may be stored or accessed in countries outside South Africa. Where we transfer personal information across borders, we take reasonable steps to ensure an adequate level of protection consistent with POPIA, including contractual safeguards with operators where appropriate.

We keep personal information only for as long as reasonably necessary for the purposes described above, including:

• Enquiry and correspondence records for ongoing business-development follow-up and continuity
• Security and server logs for a shorter operational period unless needed for an investigation
• Longer retention where required by law, dispute resolution, or legitimate business records

When information is no longer needed, we will delete or de-identify it where practicable.

We apply reasonable technical and organisational measures to protect personal information against loss, misuse, unauthorised access, disclosure, alteration, and destruction. These measures include encrypted transport (HTTPS), access controls on administrative systems, and reputable hosting providers.

No method of transmission or storage is completely secure. If we become aware of a security compromise affecting your personal information, we will notify you and the Information Regulator as required by POPIA.

Subject to POPIA and applicable law, you may request to:

• Confirm whether we hold personal information about you
• Access that information
• Request correction or deletion of inaccurate, incomplete, or excessive information
• Object to processing in certain circumstances
• Withdraw consent where processing is consent-based
• Lodge a complaint with the Information Regulator (South Africa)

To exercise these rights, email info@creativebox.world or call 011 575 4929 / 082 382 4580. Provide enough detail for us to verify your identity and locate the relevant records.

For POPIA-specific detail, see our POPIA Compliance page.

This website and our professional services are directed at organisations and adults. We do not knowingly collect personal information from children under 18 through this site. If you believe a child has provided personal information to us, contact us and we will take appropriate steps to delete it.

We may update this Privacy Policy from time to time. The “Last updated” date at the top of the page will change when we do. Material changes will be reflected on this page; continued use of the site after an update constitutes notice of the revised policy where permitted by law.

Privacy questions, access requests, and complaints:

Information Regulator (South Africa): inforegulator.org.za