Legal

Privacy Policy

This policy explains what personal information Erongo Software collects, why it is collected, and what your rights are under Namibian law and aligned with data privacy principles under Namibia's Draft Data Protection Bill. We try to collect as little as possible and to keep what we collect in Namibia.

Effective: 27 September 2026 Operator: Marthinus Spangenberg (Erongo Software) Contact: [email protected]

1. Who we are

Erongo Software is Marthinus Spangenberg, a software developer based in Walvis Bay, Namibia, registered with the Walvis Bay City Council for the delivery of professional services (registration no. 2025/0718). We are the "operator" for the personal information we process for our own services.

You can reach us at [email protected].

2. What this policy covers

This policy covers:

  • our marketing website, erongo.net (including the "Scope a project" wizard);
  • our online services and products: the Portal (sign-in), OMS (property management) and QR Codes (QRCode Management System), currently in beta.

If you use our software to store data about your customers or tenants (for example, tenant records in OMS or vCards in QR Codes), you are the operator of that data; we process it on your instruction as your operator on behalf of you, within the scope of the service. See section 7.

3. What we collect and why

3.1 The marketing website (erongo.net)

The website does not run forms, and we do not use cookies, advertising pixels, analytics, or any third-party trackers. The only things that happen when you visit:

  • Server access logs. Our web server records the technical basics of each request: IP address, time, requested page, and user agent string, for security, abuse prevention and basic traffic understanding. These are kept for a limited period and are not used for profiling or marketing.
  • A theme preference on your own device. If you switch light/dark mode, the choice is stored in your browser's local storage. It never leaves your device and does not identify you.
  • What you send us. If you email us, book a call, or message us on WhatsApp, we process the information you include (typically your name, contact details and the substance of your enquiry) to respond to you and, where relevant, to quote and deliver the work you asked about.

3.2 The Portal and our services

When you create an account on any of our services we store the minimum needed to provide and secure the account:

  • Account data: your name, email address, and a salted hash of your password (we never store or see the password itself);
  • Organisation data: your organisation's name and the membership roles you assign to other people within it;
  • Session data: short-lived sign-in tokens (JWTs) that let you stay signed in;
  • Usage and audit records: an internal log of significant actions (for example, who changed what in your organisation) for security and accountability. This log may reference your account and, in QR Codes, the resources you manage.

3.3 QR Codes (QMS): the details that matter

  • Resource data. For contact-type QR codes we store the vCard you upload or create: typically a person's name, phone numbers, email addresses and organisation. For link-type codes we store the destination URL. This is the core content of your organisation's workspace.
  • Scan analytics. Every public scan is recorded with a timestamp and a coarse device hint (for example "mobile browser"). The raw IP address and user agent of each scan are stored in your organisation's private analytics (/events) and are never exposed to the public. Scan records are kept for 90 days, then hard-deleted.
  • Attachments. Files you upload (for example a logo for an image QR code) are stored with a content hash; public reads of attachments are cached by the browser as configured by the service.
  • Webhooks. If you configure a webhook, a copy of scan events is delivered to your endpoint. We do not send event data anywhere else.

4. When you run your customers' data on our services

If you use OMS, QR Codes or another service to store personal information about your own customers, tenants or contacts, you remain the operator of that data. We process it on your instruction, to host it, display it, and operate the service, under the terms of the service. We will not use your customers' data for our own purposes, and we will help you respond to your customers' data-subject requests where the service allows it. If you need a formal data-processing agreement, email [email protected] and we will put one in place.

5. Legal basis

We process personal information fairly, lawfully, and transparently, primarily to perform our contract with you, comply with legal obligations, or pursue legitimate operational interests. In practice that means: to provide the service you asked for (contract), to secure the service and prevent abuse (legitimate interest and legal obligation), where the law requires it (legal obligation), and, for things like a mailing list, only with your consent, which you can withdraw at any time.

6. Who we share it with

We do not sell personal information, and we do not share it with marketers. The only third parties involved in our services are:

  • Cloudflare: content delivery and DDoS/WAF protection in front of our public sites. Cloudflare (a US company) sees and processes traffic data such as IP addresses and user agents under its own privacy policy. This cross-border transfer is necessary to ensure the security, stability, and availability of the service.
  • Google: only if you use our "Book a Call" link, which opens Google's calendar booking. Any details you enter there are processed by Google under Google's policies.
  • WhatsApp (Meta): our public channel. We do not broadcast or run campaigns. If you send us a direct message, it is processed by WhatsApp under its own policy, and by us to respond to you.
  • Your own endpoints: if you configure webhooks, scan events go to the URLs you specified, and nowhere else.

Where we are legally compelled to disclose personal information (for example, by a court order), we will do so and, where lawful, tell you first.

7. Where your data lives

Our services run on our own servers in Namibia. Personal information is not stored in foreign data centres; the only cross-border element is the traffic processing by Cloudflare described above. Backups are taken on our own infrastructure.

8. How long we keep it

  • Account and organisation data: while your account is active.
  • Deleted resources (QR Codes): deletions are soft for 30 days, then the data is hard-deleted and the corresponding audit entries are scrubbed.
  • Scan records (QR Codes): 90 days, then hard-deleted.
  • Audit logs: for the life of the organisation, with deleted resources scrubbed as above.
  • Website access logs: for a limited period sufficient for security and abuse review.
  • Correspondence: as long as needed to deliver the work and to meet our tax and record-keeping obligations, then deleted or anonymised.

You can also ask us to delete your personal information sooner, as described in section 9.

9. Your rights

As a data subject you have the right to:

  • Access the personal information we hold about you (we will respond as soon as reasonably possible, and in any event within 30 days);
  • Correction of inaccurate or incomplete information;
  • Deletion where the law allows it, for example when the purpose has been served or you withdraw consent;
  • to object to processing based on legitimate interest;
  • to lodge a concern with us or the relevant regulatory authorities as data protection regulatory frameworks are enacted in Namibia.

To exercise any of these rights, email [email protected] and tell us what you need. We may ask to verify your identity before disclosing information.

10. Mailing list

We do not currently run a mailing list. If we start one, we will only add you after you have asked to be added, every message will identify us and carry a working unsubscribe mechanism (as required under Namibia's Electronic Transactions Act 4 of 2019 for commercial messages), and we will never sell or share your email address. Unsubscribing takes effect immediately and does not affect anything else.

11. Security

We protect personal information with reasonable and operable technical and organisational measures, including: TLS encryption in transit; salted password hashing (we never store plaintext passwords); network isolation and hardened, containerised servers; role-based access control inside every service; verified backups; and audit logging of significant actions. No system is perfectly secure, so if you believe your information has been compromised, tell us and we will investigate.

12. Children

Our services are aimed at businesses and professionals. We do not knowingly process the personal information of anyone under 18. If you believe we hold a child's data unlawfully, contact us and we will delete it.

13. Changes to this policy

We may update this policy as the services change. Material changes will be posted on this page with a new "effective" date, and service users are notified by email before they take effect. Continued use after a change means you accept the updated policy.

14. Contact

Erongo Software - Marthinus Spangenberg
Walvis Bay, Namibia
Email: [email protected]