What this site knows about you.
Almost nothing, and nothing that names you. No cookies. No account. The only personal information I hold is what you typed into one of the two forms and sent me, and the only thing I do with it is read it and write back. The pages report how fast they load, which is counted and not tied to you. Everything below is that same answer, in the detail POPIA asks for.
Last updated 10 September 2026
Who is responsible
This site is mine and I run it myself. Under the Protection of Personal Information Act 4 of 2013 that makes me the responsible party, and it also makes me my own Information Officer. There is nobody else to escalate to, which cuts both ways: you get me, and you get me quickly.
What I collect
Two forms on this site collect personal information. Nothing else on it does.
The contact form asks for your first name, last name and email address, and gives you room for a company name and a message. The first three are required because I cannot write back without them. The company field and the message are yours to leave empty.
The field at the foot of every page asks for your email address and nothing else.
When you send either one, the server also reads the IP address the request arrived from. It holds that address in memory for an hour so it can count how many messages have come from it, then drops it. It is never written to a file or a database and it never reaches me.
What I do not collect
This site sets no cookies. It writes nothing to your browser’s local or session storage. There is no Google Analytics on it, no advertising scripts, no retargeting pixels, no embedded video, no social widgets and no comments. The two typefaces are served from this domain rather than fetched from Google, so loading a page here does not tell Google that you did.
There is one measuring script, and it counts how fast the pages are rather than who is reading them. It is the next section, and I would rather name it here than have you find it yourself.
You do not have to take my word for any of that. Open your browser’s developer tools on any page of this site and look at the cookie jar and the network tab.
The one measurement I do take
Every page reports how quickly it painted. That is Vercel Speed Insights, and it is here because parts of this site are heavy: a rigid-body simulation in four of the heroes, thirteen films, and fifty-four photographs that are three thousand pixels across or wider. I would rather know what those cost a real phone on a real network than guess at it.
In your network tab it is a script with a scrambled name at this domain, because Vercel randomises that path when the site is built. There is only one such script on any page here, and that is it.
It sets no cookie and it does not carry your name, your address or anything you typed. Vercel publishes the list of what each measurement holds, and it is this: the route and the URL you were on, your connection speed, your browser, your device type and operating system, your country as a two-letter code, the timing figure itself, the element on the page it was measured against, the version of their package, and the time their server received it.
That is analytics, and until 10 September 2026 this page said there was none of it here. That was true when it was written and stopped being true when I added the line. Vercel states the measurements cannot be tied to an individual visitor or used to follow one from page to page, but that is their undertaking rather than mine to give, and what they do with what they receive is governed by Vercel’s own privacy policy, not by this one.
The other thing that is not mine
Both forms are protected by Cloudflare Turnstile, which is what stops them being used by bots. It does not load with the page. Nothing is fetched from Cloudflare until you put a cursor in one of the form fields, so if you read this site and never write to me, Cloudflare is never told you were here at all.
From the moment you do click into a field, Cloudflare sees your IP address and some technical signals from your browser, which is how it tells a person from a script. I chose it over the alternatives because it asks you to do nothing and shows you nothing. Cloudflare states that Turnstile is not used to track people across sites, but that is their undertaking rather than mine to give, and what they do with what they see is governed by Cloudflare’s own privacy policy, not by this one.
Why I collect it
One purpose. So that I can read what you sent and reply to it. That is the whole of it.
A message from the contact form is emailed to my inbox with your address set as the reply-to, so that pressing Reply writes back to you rather than to the address the site is obliged to send from. An address left in the footer field arrives the same way, marked as having come from there.
The footer field is not a mailing list. There is no list. Leaving your address there subscribes you to nothing, because there is nothing to subscribe to. It tells me you would like to hear from me, and then I do that by hand.
You do not have to give me any of it
Filling in a form here is voluntary. Nothing on this site sits behind one, and no part of it stops working if you never touch them. If you would rather not use a form at all, my email address and phone number are on this page and on the contact page.
The only consequence of leaving a required field empty is the obvious one. Without a name and an address I have nothing to reply to.
Who else handles it
Three companies process this information on my behalf. They are operators under section 21 of POPIA, they act on my instructions, and none of them may use what passes through them for its own purposes.
- Resend delivers the email. Your message passes through it on the way to my inbox.
- Cloudflare runs the Turnstile check described above.
- Vercel hosts the site. Its servers handle the request and keep short-lived operational logs of traffic, which is how any web host works, and it also receives the speed measurements described above.
Nobody else sees any of it. I do not sell personal information, I do not hand it to advertisers or data brokers, and I have never given any of it to anyone for their own use.
It leaves South Africa
All three of those companies are outside South Africa, so anything of yours that reaches them crosses the border. A message you send goes to two of them; a speed measurement goes to one, on every page. Section 72 of POPIA allows that where the recipient is bound by rules giving comparable protection, and each of the three publishes a data processing agreement and standard contractual clauses committing it to that standard. Sending a message is also your consent to the transfer, which section 72(1)(b) permits on its own.
If you would rather not, write to me directly at will@derman.co.za and skip this site altogether.
How long I keep it
A message you send me is an email in my inbox, and I keep it the way anyone keeps correspondence. If it turns into work, I keep it as long as the work and my tax records require. If it does not, I delete it once it is plainly finished with. Either way you can ask me to delete it sooner and I will.
The IP address used for rate limiting is gone inside an hour and is held nowhere else. Vercel’s request logs expire on Vercel’s own schedule, which is short and which I do not control.
How it is kept
The site is served over HTTPS, so what you type into a form is encrypted between your browser and the server. My accounts carry two-factor authentication. The site has no database, which means there is no store of personal information here to breach in the first place.
If personal information under my control is ever reached by someone who should not have it, section 22 of POPIA requires me to notify the Information Regulator and to notify you. I will.
Marketing
I do not send any. No newsletter, no campaigns, no automated sequences. If I write to you it is because you wrote to me first, or because we are already talking about work.
Children
This site is for people deciding whether to hire a designer, and I am not looking to collect anything from children. If you are under 18, please do not send me personal information through the forms. If you are a parent or guardian and think your child has, tell me and I will delete it.
Your rights
POPIA gives you rights over what I hold about you. You can:
- ask me to confirm whether I hold anything about you, and to tell you what it is, under section 23
- ask me to correct or delete anything wrong, misleading, out of date, or that I no longer have grounds to keep, under section 24
- object to my holding it at all, under section 11(3)
- withdraw consent you have given, at any time, under section 11(2)
- complain to the Information Regulator, under section 74
There is a prescribed form for the first two. You are welcome to use it and you are equally welcome to ignore it, email me in your own words and ask. I would rather answer you than make you fill anything in.
Ask at will@derman.co.za. I will reply within a reasonable time and I will not charge you for a request about your own information.
Complaining about me
If you think I have handled your personal information badly and my answer has not satisfied you, you can take it to the Information Regulator directly.
I would rather you told me first and gave me the chance to put it right, but that is a preference and not a condition.
Changes to this page
If I change how this site handles personal information, I change this page and move the date at the top of it. There is no archive of old versions to dig through, because there is only ever one live version of a page like this. If a change matters and I have your address because you wrote to me, I will tell you.