Privacy Policy
Effective Date: 13 October 2026
Last Updated: 13 October 2026
This Privacy Policy describes how Theo Bothma Architects & Design (Pty) Ltd ("TBAD", "we", "us", or "our") collects, uses, stores, and discloses personal information obtained through tbad.co.za and all associated digital properties. It applies to all website visitors, enquirers, job applicants, and any other natural persons whose personal data TBAD processes. TBAD is the responsible party (POPIA) and data controller (GDPR) in respect of all personal information described herein.
Identity and Contact Details of the Responsible Party
Theo Bothma Architects & Design (Pty) Ltd
Registration No.: 2018/035109/07
Registered in: Johannesburg, South Africa
London Office: London, United Kingdom
Privacy Contact: privacy@tbad.co.za
For users in the United Kingdom or European Economic Area, TBAD acts as the data controller for all personal data processed through this website.
Personal Information We Collect
We collect the following categories of personal information:
- Identity and contact data: Full name, email address, telephone number.
- Project and enquiry data: Project location, scope, budget range, and any information voluntarily provided through enquiry or contact forms.
- Career application data: CV/résumé content, employment history, qualifications, cover letters, and any documents voluntarily submitted via our careers form.
- Technical and usage data: IP address, browser type and version, operating system, device type, pages visited, time and duration of visits, referral URLs — collected automatically via analytics tools.
- Cookie and tracking data: As detailed in Section 8 below.
- Communication records: All correspondence submitted through website forms and any subsequent email or written communications.
TBAD does not intentionally collect special categories of personal information (as defined under GDPR Article 9 and POPIA Section 26) such as racial or ethnic origin, health data, religious beliefs, or biometric data through this website.
We do not knowingly collect personal information from individuals under the age of 18. If you believe we have inadvertently collected data relating to a minor, please contact us immediately at privacy@tbad.co.za.
Purposes and Legal Basis for Processing
We process personal information only where a lawful basis exists. The table below sets out each processing purpose and the corresponding legal basis under GDPR (EU/UK) and POPIA (South Africa).
| Purpose | Legal Basis (GDPR) | Condition (POPIA) |
|---|---|---|
| Responding to project and consultation enquiries | Legitimate interests (Art. 6(1)(f)) / Pre-contractual steps (Art. 6(1)(b)) | Necessary to carry out actions requested by the data subject (s.11(1)(c)) |
| Processing career applications | Pre-contractual steps (Art. 6(1)(b)) | Necessary for conclusion of a contract (s.11(1)(b)) |
| Website analytics and performance monitoring | Legitimate interests (Art. 6(1)(f)) / Consent (Art. 6(1)(a)) where cookies are used | Consent (s.11(1)(a)) or legitimate interest (s.11(1)(f)) |
| Legal and regulatory compliance | Legal obligation (Art. 6(1)(c)) | Compliance with a legal obligation (s.11(1)(c)) |
| Maintaining business and communication records | Legitimate interests (Art. 6(1)(f)) | Legitimate interest of the responsible party (s.11(1)(f)) |
| Fraud prevention and security | Legitimate interests (Art. 6(1)(f)) | Legitimate interest of the responsible party (s.11(1)(f)) |
Where we rely on legitimate interests as the legal basis, we have assessed that our interests are not overridden by your rights and freedoms as a data subject. You may request a copy of this balancing assessment by contacting privacy@tbad.co.za.
We do not engage in automated decision-making or profiling within the meaning of GDPR Article 22.
Data Sharing and Third-Party Processors
TBAD does not sell, rent, trade, or otherwise commercially transfer your personal information to third parties. We may share your data in the following limited circumstances:
- Processors acting on our behalf: Cloud hosting providers, CRM platforms, email delivery services, and website analytics tools. All such processors are engaged under data processing agreements that impose legally binding obligations to process data only on TBAD's instructions and to implement appropriate security measures.
- Professional advisers: Legal counsel, auditors, and insurers, where necessary, subject to confidentiality obligations.
- Regulatory and law enforcement bodies: Where disclosure is required by applicable law, court order, or regulatory requirement, including the Information Regulator (South Africa) and the ICO (United Kingdom).
- Business transfers: In the event of a merger, acquisition, or sale of all or part of TBAD's business, personal data may be transferred to the acquiring entity, subject to equivalent protections.
International Transfer of Personal Data
TBAD operates internationally, with offices in South Africa and the United Kingdom, and serves clients across Africa and Europe. As a result, your personal information may be transferred to, stored, or processed in countries outside your country of residence or the country in which it was originally collected.
Where personal data is transferred from the European Economic Area (EEA) or United Kingdom to a country not deemed to provide an adequate level of data protection, TBAD ensures that such transfers are subject to appropriate safeguards, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission or UK Secretary of State, as applicable;
- Binding corporate rules, where applicable;
- Other adequacy mechanisms as recognised under GDPR Chapter V or applicable UK data protection law.
Transfers of personal information from South Africa to other countries are conducted in compliance with POPIA Section 72, which requires that the recipient country provides an adequate level of protection substantially similar to POPIA, or that the data subject consents, or that a data transfer agreement incorporating POPIA-equivalent safeguards is in place.
You may request details of the specific safeguards applicable to any international transfer of your personal data by contacting privacy@tbad.co.za.
Data Retention
We retain personal information only for as long as is necessary to fulfil the purposes for which it was collected, or as required or permitted by applicable law. Our standard retention periods are as follows:
| Data Category | Retention Period | Basis |
|---|---|---|
| Project enquiry and consultation data | 5 years from last interaction | Legitimate interests / potential contractual relationship |
| Career application data (unsuccessful) | 12 months from notification of outcome | Legitimate interests / consent |
| Career application data (successful) | Duration of employment + applicable statutory period | Contractual / legal obligation |
| Website analytics and usage data | 26 months (aggregated) | Legitimate interests / analytics platform standard |
| Cookie consent records | 3 years | Legal obligation (demonstrable consent) |
| Legal and contractual records | 7 years | Legal obligation (statutory limitation periods) |
Upon expiry of the applicable retention period, personal information will be securely deleted or anonymised. You may request earlier deletion by exercising your right to erasure (see Section 9), subject to any overriding legal obligations.
Security of Personal Information
TBAD implements appropriate technical and organisational security measures designed to protect personal information against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include, but are not limited to:
- Encryption of data in transit using TLS/SSL protocols;
- Access controls and role-based permissions for internal systems;
- Regular security assessments and vulnerability reviews;
- Staff training on data protection obligations.
No method of data transmission over the internet or electronic storage is entirely secure. Whilst we take all reasonable steps to protect your personal information, we cannot guarantee absolute security. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, affected data subjects, within the timeframes prescribed by applicable law.
Cookie Policy
This website uses cookies and similar tracking technologies to operate effectively, analyse usage, and improve user experience. This Cookie Policy forms part of this Privacy Policy.
What Are Cookies
Cookies are small text files placed on your device by a website when you visit it. They may be set by TBAD (first-party cookies) or by third-party services operating on our behalf (third-party cookies). Cookies may be session cookies (deleted when you close your browser) or persistent cookies (stored for a defined period).
Categories of Cookies We Use
| Category | Purpose | Legal Basis | Examples |
|---|---|---|---|
| Strictly Necessary | Essential for website operation. Cannot be disabled. Enable core functions such as page navigation, form submission, and security. | Legitimate interests — no consent required | Session cookies, CSRF tokens, load balancing |
| Analytics & Performance | Collect aggregated, anonymised data on how visitors interact with the website. No personally identifiable information is collected. | Consent | Google Analytics, page view tracking |
| Functionality | Remember preferences and settings to provide an enhanced, personalised experience. | Consent | Language preferences, UI settings |
| Marketing & Advertising | We do not currently use marketing or advertising cookies on this website. | N/A | N/A |
Managing Your Cookie Preferences
When you first visit our website, you will be presented with a cookie consent banner. You may accept all cookies, reject non-essential cookies, or customise your preferences by category. You may update your preferences at any time.
In addition, you may control cookies through your browser settings. Most browsers allow you to view, delete, and block cookies. Note that disabling certain cookies may affect the functionality of this website. The following links provide guidance for common browsers:
For more information about cookies and how to manage them, visit www.allaboutcookies.org.
Your Rights as a Data Subject
Depending on your jurisdiction, you may have the following rights in respect of your personal information. To exercise any right, please submit a written request to privacy@tbad.co.za. We will respond within one calendar month of receipt (extendable by a further two months for complex requests, with notification).
| Right | Description | Applicable Under |
|---|---|---|
| Right of Access | Obtain confirmation as to whether we process your personal data and receive a copy of it, together with supplementary information about the processing. | GDPR Art. 15 / POPIA s.23 |
| Right to Rectification | Request correction of inaccurate or incomplete personal data held about you. | GDPR Art. 16 / POPIA s.24 |
| Right to Erasure ("Right to be Forgotten") | Request deletion of your personal data where it is no longer necessary for the purpose collected, you withdraw consent, or you object and there are no overriding legitimate grounds. | GDPR Art. 17 / POPIA s.24 |
| Right to Restriction of Processing | Request that we restrict the processing of your personal data in certain circumstances, for example whilst accuracy is contested. | GDPR Art. 18 |
| Right to Data Portability | Receive your personal data in a structured, commonly used, machine-readable format, and transmit it to another controller. | GDPR Art. 20 |
| Right to Object | Object to processing based on legitimate interests or for direct marketing purposes. | GDPR Art. 21 / POPIA s.11(3) |
| Right to Withdraw Consent | Where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of prior processing. | GDPR Art. 7(3) / POPIA s.11(1)(a) |
| Right to Lodge a Complaint | Lodge a complaint with the relevant supervisory authority (Information Regulator, South Africa; ICO, United Kingdom; applicable EEA DPA). | GDPR Art. 77 / POPIA s.74 |
We will not charge a fee for exercising your rights unless the request is manifestly unfounded or excessive. We may need to verify your identity before processing a request.
Supervisory Authorities
- South Africa — Information Regulator: www.justice.gov.za/inforeg
- United Kingdom — ICO: ico.org.uk
- European Union: Contact the data protection authority in your EU member state of residence.
POPIA — South Africa Specific Provisions
TBAD processes personal information in compliance with the Protection of Personal Information Act 4 of 2013 (POPIA) and the regulations promulgated thereunder.
TBAD's processing activities are underpinned by the eight conditions for lawful processing prescribed by POPIA:
- Accountability: TBAD takes responsibility for ensuring compliance with POPIA.
- Processing limitation: Personal information is collected only for specific, explicitly defined, and lawful purposes.
- Purpose specification: Data subjects are informed of the purpose at collection.
- Further processing limitation: Personal information is not processed in a manner incompatible with the original purpose.
- Information quality: We take reasonable steps to ensure data is accurate, complete, and up to date.
- Openness: TBAD maintains a publicly accessible privacy policy and notifies data subjects at the point of collection.
- Security safeguards: Appropriate technical and organisational measures are in place (see Section 7).
- Data subject participation: Data subjects may access, correct, or request deletion of their personal information.
TBAD has designated a responsible person to oversee POPIA compliance. Queries may be directed to privacy@tbad.co.za.
GDPR — European / United Kingdom Specific Provisions
For data subjects located in the European Economic Area or the United Kingdom, TBAD processes personal data in accordance with the General Data Protection Regulation (EU) 2016/679 and, for UK residents, the UK GDPR as incorporated into domestic law by the Data Protection Act 2018.
TBAD relies on the following lawful bases under GDPR Article 6, as detailed in Section 3 above. Where TBAD intends to process personal data for a new purpose incompatible with the original purpose, we will provide prior notification and, where required, obtain consent.
TBAD does not have a formal EU representative at this time. Enquiries from EEA residents should be directed to privacy@tbad.co.za.
Children's Data
This website is not directed at individuals under the age of 18 and TBAD does not knowingly collect personal information from minors. If we become aware that personal information of a minor has been collected without appropriate parental or guardian consent, we will take immediate steps to delete such information. Please contact privacy@tbad.co.za if you have concerns in this regard.
Changes to This Privacy Policy
TBAD reserves the right to update or amend this Privacy Policy at any time. The revised policy will be posted on this page with an updated effective date. Where changes are material, we will take reasonable steps to notify affected data subjects. Continued use of the website following the posting of changes constitutes acceptance of the revised policy.
We encourage you to review this Privacy Policy periodically to remain informed of how we protect your personal information.
Contact and Complaints
For any privacy-related queries, data subject requests, or complaints, please contact:
TBAD is a digital-first studio. We do not send or receive correspondence by post, and all privacy requests should be made by email. Should postal correspondence be received, please allow more than 30 days for it to be processed.
If you are dissatisfied with our response, you have the right to lodge a complaint with the relevant supervisory authority for your jurisdiction (see Section 9).
For general enquiries, please use our Contact page. For legal and terms-related matters, please refer to our Terms of Use.