What we collect, why, who we share it with, and what you can tell us to do about it. Written to satisfy section 18 of the Protection of Personal Information Act.
Brightsphere Technologies (Pty) Ltd, trading as CrestaHQ, is the responsible party for the personal information described here.
When you complete an enquiry form or book a call, we collect your name, business name, email address, telephone number and whatever you choose to tell us about your business. Supplying this is voluntary. The consequence of not supplying it is simply that we cannot contact you or prepare a quote — nothing else follows from declining.
When you use the visibility audit on our website, we collect the business name you enter. We may combine that with information that is already publicly available about your business, such as your Google Business Profile, your published reviews and your website. Where we collect information about your business from a public source rather than from you, that source is the public listing itself.
When you visit the site we record standard technical information — your IP address, browser type, the pages you request and the time of the request — for security and to understand which pages are useful.
To respond to your enquiry, prepare and send you a quote, provide the services you buy from us, invoice you, and meet our own legal and accounting obligations. We rely on the fact that this processing is necessary to conclude or perform a contract with you, and on our legitimate interest in running the business. We do not need your consent for these purposes, and we do not ask for consent we do not need.
We only send marketing by email, SMS or WhatsApp where you have agreed to receive it, or where you are already a customer, the message concerns our own similar services, and you were given a chance to decline when we took your details. This is what section 69 of POPIA permits.
Every marketing message we send identifies us clearly and carries a way to stop. Reply STOP to any WhatsApp or SMS message, use the unsubscribe link in any email, or write to us at the address above. When you opt out we stop immediately and record the objection so it applies across every channel and every future campaign, not only the one you replied to.
We use the following providers to deliver the service. Several store information outside South Africa, which we are required to tell you.
| Provider | What they do | Where information is stored |
|---|---|---|
| Our CRM and messaging platform | Stores contacts, conversations and campaign records | United States |
| WhatsApp Business Platform (Meta) | Delivers and receives WhatsApp messages | United States and Ireland |
| Email delivery provider | Sends and tracks email we send on your behalf | United States |
| Website hosting and CDN | Serves this website and records basic request logs | Global edge network |
| Google Business Profile and Google Ads | Manages your listing, reviews and advertising | United States |
Where information leaves South Africa we take reasonable steps to ensure the recipient is subject to a law, binding agreement or corporate rules providing protection substantially similar to POPIA. We do not sell your information, and we do not share it for anyone else's marketing.
If you become a client, we process personal information about your customers inside the platform we operate for you — their names, telephone numbers, and the conversations they have with your business. In that arrangement you are the responsible party and we are your operator. That information remains yours. We process it only on your instruction, keep it confidential, and apply appropriate security measures, as required by sections 20 and 21 of POPIA. If we become aware that it has been accessed without authorisation we notify you immediately so that you can meet your own obligations under section 22. The detail of this is set out in the agreement we sign with you.
Enquiries that do not become clients are kept for two years, so that we can pick up a conversation if you come back to us. Client records are kept for the duration of the agreement and then for five years, which is the period South African tax and companies legislation requires us to retain business records. Records of people who have opted out of marketing are kept indefinitely, because that is the only way to make sure we honour the objection.
You may ask us what personal information we hold about you and request a copy. You may ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, misleading or obtained unlawfully. You may object to processing on reasonable grounds, and you may object to direct marketing at any time. Write to the Information Officer at the address above and we will respond as soon as we reasonably can.
If you are not satisfied with how we have dealt with your information, you may complain to the Information Regulator of South Africa: JD House, 27 Stiemens Street, Braamfontein, Johannesburg 2001, or by email to complaints.IR@inforegulator.org.za.
This site sets only the cookies necessary for it to work. If we add analytics or advertising cookies we will ask you to agree first, and you will be able to decline as easily as you can accept.
If we change this notice we will publish the revised version here and update the effective date at the top. This notice was last updated on 14 August 2026.