Privacy Policy

1. Who is responsible for your information?

SpecStack Technologies is a trading name of Ninety8 Projects (Pty) Ltd, registration number 2025/784588/07 (“SpecStack”, “we”, “us” or “our”). Ninety8 Projects (Pty) Ltd is the responsible party for personal information processed through this website and our business activities. Our registered office is 20 Jan Steyl Avenue, Roodewal, Bloemfontein, Free State, 9301.

2. What this notice covers

This notice applies when you browse this website, submit an enquiry, request a quote, provide an equipment list or attachment, apply for a role, place an order, ask for support, exercise a privacy or access-to-information right, or otherwise do business with SpecStack.

3. Information we collect

Depending on how you interact with us, we may process:

• Contact and organisation details: your name, business email, phone number, organisation, organisation type and preferred response channel.
• Enquiry details: the request type, requirement area, quantities or user numbers, location, timing, budget information, messages and any document or image you attach.
• Commercial records: quotes, orders, delivery and billing information, supplier correspondence, warranty records, support history and payment records. We do not ask you to submit payment-card details through the website form.
• Career information: information contained in a CV, portfolio or careers enquiry when you choose to provide it.
• Privacy choices: whether you allowed optional website analytics and when that preference expires.
• Website and security data: information needed to serve and protect the website, such as request timestamps, IP address, browser or device information, URLs requested, diagnostics and security logs.
• Optional analytics data: only after you allow analytics, aggregated page or route viewed, event time, referrer, browser, operating system, device type, approximate country, region or city and selected non-personal actions such as opening an article or completing an enquiry. We remove query strings and fragments before an analytics page event is sent and do not send form contents or contact details to analytics.

4. How the secure request form works

When you select “Send secure request”, the information and any attachment are sent over HTTPS to a server function hosted by Vercel. The function validates the submission and passes it to Resend, our email-delivery provider, which delivers it to the appropriate private SpecStack inbox. The destination address is not exposed in the page or browser.

The website does not intentionally create a separate customer database from this form. The submission does, however, exist in the systems needed to deliver and answer it: Resend processes the email address, message content, delivery metadata and attachment; the receiving mailbox holds the delivered message; and SpecStack may move relevant information into its normal quote, order, support or compliance records.

Please do not submit passwords, complete payment-card details, identity documents, health information or other unnecessary special personal information. If an attachment contains personal information about someone else, make sure you are entitled to share it.

5. Why we process information

• To respond to an enquiry and take steps requested before entering into a contract.
• To prepare quotes, source products or services, fulfil orders, arrange delivery and provide support.
• To manage supplier, customer, warranty, accounting, tax and dispute records.
• To process career, partnership, privacy and PAIA requests.
• To prevent abuse, protect the website and communications, and investigate security incidents.
• To understand website use and conversion paths through Vercel Web Analytics when you have allowed it.
• To send direct marketing only where permitted by law, with a clear way to opt out.

We rely on the justification appropriate to the activity, including your consent, steps taken at your request before a contract, performance of a contract, a legal duty, or a legitimate interest that does not unjustifiably override your rights.

6. Providers and other recipients

We disclose information only where it is reasonably needed. Recipients may include:

• Vercel: website hosting, server functions, delivery, security logs and—only after consent—Web Analytics.
• Resend: delivery of website enquiries and attachments to SpecStack’s private inboxes.
• Sanity: hosting and delivery of the public website content and images managed in our content studio. The contact form is not sent to Sanity.
• Our personnel and authorised service providers who need the information to respond.
• Suppliers, distributors, couriers, installers, software vendors, finance or payment providers where needed to quote, supply, licence, deliver or support what you requested.
• Professional advisers, insurers, regulators, courts or law-enforcement bodies where lawfully required.

We do not sell personal information. Providers acting as operators or processors are expected to process information for the agreed service and apply appropriate security safeguards.

7. Processing outside South Africa

Vercel, Resend, Sanity and some of their approved subprocessors may process or store information outside South Africa, including in the United States and other territories where their infrastructure operates. Where POPIA applies to a cross-border transfer, we use the applicable section 72 ground and reasonable contractual, organisational and technical safeguards. We also limit the information shared to what is needed for the service.

8. How long we keep information

We keep information only while it serves the stated purpose, a contract, a dispute, security needs or a legal record-keeping duty. Our working retention periods are:

• Privacy preference: up to 12 months, after which the site asks again.
• Vercel Analytics: Vercel’s temporary visitor identifier is discarded after 24 hours. Aggregated analytics remain according to our Vercel plan and workspace settings.
• Resend delivery copy: Resend states that email data is retained for 30 days on its standard service. The delivered copy in SpecStack’s mailbox follows the enquiry or business-record period below.
• Enquiries that do not become a transaction: normally up to 24 months after the last meaningful interaction, unless a longer period is reasonably required for a complaint, dispute or legal duty.
• Career enquiries: normally up to 12 months after the role or last interaction, unless you agree to a longer talent-pool period or law requires otherwise.
• Quotes, orders, invoices, delivery, warranty and support records: for the relationship and thereafter as required for tax, accounting, warranty, contractual and dispute purposes.
• Attachments: for the same period as the enquiry or record to which they relate, unless removed earlier because they are unnecessary.
• Technical and security logs: according to the provider’s operational schedule and for no longer than reasonably needed for delivery, diagnostics, fraud prevention and security.

When information is no longer required, we delete, destroy or de-identify it where reasonably practicable.

9. Security

We use safeguards appropriate to the information and the risk, including encrypted transport, private environment configuration, restricted account access, submission validation, anti-spam controls and reputable hosting and email providers. No online system can guarantee absolute security. If a qualifying security compromise occurs, we will investigate and notify the Information Regulator and affected people as POPIA requires.

10. Your rights

Subject to POPIA and other applicable law, you may ask whether we hold your personal information, request access or correction, object to certain processing, ask for deletion where permitted, withdraw consent, opt out of direct marketing, or complain to the Information Regulator. Withdrawing consent does not invalidate processing that was lawful before withdrawal.

11. Children and special personal information

This is a B2B website and is not directed to children. We do not intentionally request special personal information through the general enquiry form. If such information is genuinely necessary for a lawful request, contact us first so that we can agree on an appropriate channel.

12. Contact and complaints

Junior Machwisa Maduane Maraatsile, Sole Director, is the Information Officer. Send a POPIA request or complaint through the private request form, or call 065 887 4301. We may need to verify your identity before releasing or changing information.

You may also complain to South Africa’s Information Regulator. Access-to-record requests are explained on our Access to Information page.

13. Provider information and changes

For further detail, see Vercel’s Privacy Notice and Web Analytics privacy documentation, Resend’s Data Processing Addendum and subprocessor list, and Sanity’s Privacy Policy.

We may update this notice when our services, providers or legal duties change. The date at the top identifies the current version.