Privacy policy

Last updated: 30 October 2026

This policy explains what personal information LGH Innovations handles when you message a business that uses our WhatsApp service, visit this website, or contact us. It follows the Protection of Personal Information Act 4 of 2013 (POPIA) and the terms that apply to the WhatsApp Business Platform.

1. Who we are

LGH Innovations
Farm 1 Stylkop Farms, GV21K R528, Georges Valley, Tzaneen
Information Officer: Sean Sheppard
Email: sean@lghinnovations.co.za

We act in two roles. When you visit this website, contact us directly, use our staff login, or send us a deletion request, we are the responsible party and decide why your information is used. When you message a business that uses our service, that business decides why your messages are used and we process them for it on its instructions as its operator. We are the responsible party for the messages on the numbers we operate for ourselves. Where we are the operator, the business remains responsible for its own notice to you, and this policy describes what we do on its behalf.

2. What we collect and where it comes from

People who message a business through us. You give us this information by sending a message on WhatsApp, and Meta passes it to us:

• your WhatsApp phone number and the profile name you have set on WhatsApp;
• the messages you send, with the time sent. For images, voice notes and other files we keep only a note of the type of message, not the file;
• delivery status of the replies we send you;
• a record of the replies the business sent you and which staff member sent them;
• a record that you asked to hear from the business on WhatsApp (when and by which staff member), if we first contacted you.

People who ask us to delete their information. The WhatsApp number you give us and any note you add.

Staff. A name and a login PIN (stored only as a salted, one-way hash), and a record of which staff member sent which message.

Everyone who visits this website. Our hosting provider's server logs record your IP address, the page requested, the time and your browser type. Staff logins use one session cookie that is needed for the login to work. We do not use advertising or analytics cookies or trackers, and visitors who do not log in are not given a cookie.

We do not ask for your ID number, payment details, health information or location, and the service is not designed to collect them. If you put such information in a message it is stored with the message like any other text, so please do not send it.

Giving us your information is voluntary. If you prefer not to, you can simply not message us, but we then cannot reply to you.

3. Why we use it, and our lawful basis

• To receive your messages and let authorised staff reply to you. This is necessary to respond to what you asked for, and you chose to contact us (POPIA section 11(1)(a), (b) and (f)).
• To keep the service secure, prevent abuse, and keep a record of what was said, which is a legitimate interest of the business and of us (section 11(1)(f)).
• To handle your requests about your information (section 11(1)(c) and (f)).
• To meet our legal obligations, including answering the Information Regulator and WhatsApp's requirements.

We use your information only for these purposes. We do not use it to build marketing profiles. We do not sell your information. We do not share what one customer says with other customers.

4. Who receives your information

• The business you messaged and its authorised staff.
• Meta Platforms (WhatsApp Business Platform), which delivers messages between you and the business. Meta processes your information under its own terms and the WhatsApp privacy policy.
• Railway, our hosting provider, which runs the service and its database in the Netherlands (European Union).
• Google, which hosts our email, if you email us.
• Anyone we are required by law to give it to.

These providers act as operators. They may use your information only to provide their service to us. If we add another provider we will update this policy first.

Messages sent through the WhatsApp Business Platform are processed by Meta and are visible to the business and its service providers. Do not assume they are as private as a chat between two people.

5. Sending information outside South Africa

Your information is processed outside South Africa. Railway hosts it in the Netherlands. Meta processes WhatsApp messages in the United States and other countries where it operates. We transfer it only where the recipient is bound by law, a binding agreement or binding corporate rules that give protection substantially similar to POPIA (section 72(1)(a)), or where you have consented by choosing to contact us over WhatsApp.

6. Messaging, marketing and opting out

We and the businesses using our service message only people who have contacted them or asked to hear from them. After 24 hours since you last wrote, we can only send pre-approved WhatsApp template messages. We do not send direct marketing without your consent (POPIA section 69), and any marketing message will say who it is from and how to stop it. At any time you can reply STOP, tell us in any other way, or block the number on WhatsApp, and we will stop messaging you.

7. How long we keep it

• Messages and the contact details linked to them: 12 months, then deleted automatically. A contact with no messages left is deleted too.
• Deletion requests: we store the number you give us and any note you add until the request is handled. We then remove the note and delete the record within 90 days.
• Staff details: while the person is authorised to use the service.
• Server logs: for the period our hosting provider keeps them.

We keep information longer only if the law requires it. Deleting a chat on your own phone does not delete our copy, so use the deletion request below. Meta keeps its own copy under its own policies, which we do not control.

8. How we protect it

• The service uses HTTPS only.
• Incoming WhatsApp messages are accepted only when they carry Meta's valid signature.
• Access needs a personal staff login with a PIN stored as a salted hash. Repeated wrong guesses are blocked, and the staff pages are protected against cross-site requests.
• The database is not open to the internet.
• We collect as little as we can, and we delete it when it is no longer needed.

No system is perfectly secure. If we have reasonable grounds to believe that your information has been accessed by an unauthorised person, we will tell the Information Regulator and, where we can identify you, you, as soon as reasonably possible (POPIA section 22), and we will tell Meta where its terms require it.

9. Your rights

You may, under POPIA:

• ask us whether we hold information about you, free of charge, and ask for a copy of it and who has had access to it (section 23). We may need proof of who you are, and a fee may apply to a copy, in which case we will give you a written estimate first;
• ask us to correct or delete information that is inaccurate, out of date, incomplete, misleading, excessive or unlawfully obtained, or that we are no longer allowed to keep (section 24);
• object to our processing on reasonable grounds, and object to direct marketing at any time (section 11(3));
• withdraw a consent you gave us, without affecting what we did before you withdrew;
• be told if your information is accessed without authority (section 22);
• complain to the Information Regulator, and take civil action.

To use any of these rights, use the deletion request page or email sean@lghinnovations.co.za. You may email us for access, correction or deletion of the information we hold about you. We will contact you to confirm it is you (by WhatsApp or email) before we delete anything. We reply as soon as reasonably practicable and tell you what we did, or why we could not.

10. Complaints

Please tell us first so that we can put things right. You also have the right to complain to the Information Regulator of South Africa:

Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Telephone: 010 023 5200
POPIA complaints: POPIAComplaints@inforegulator.org.za
Website: inforegulator.org.za (the current complaint form and process are published there)

11. Children

The service is not meant for anyone under 18. If you are under 18, please do not message us without a parent or guardian. If we learn that we hold a child's information without the consent of a parent or guardian, we will delete it.

12. Changes to this policy

We will publish any change on this page and update the date at the top. If a change affects how your information is used, we will tell you before it takes effect where we can.