Who is responsible
LUWA Holdings (Pty) Ltd, registration 2026/463979/07, is the responsible party for personal information processed through this website and our business correspondence. Our registered business address is 28 Klip Street, Beyers Park. Our responsible Information Officer is Luqman Ismail. For privacy enquiries or rights requests, email info@luwa-holdings.com.
Information you choose to share
You can contact us through the enquiry form, email or WhatsApp. The form requires your name, email address, enquiry type and message. Company and service selection are optional; choosing Other requires a short subject. We do not request attachments, passwords, medical information or other sensitive details.
Submitting an enquiry is voluntary. Without contact details and sufficient information about your request, we may be unable to respond. You can browse LUWA without sending an enquiry or accepting analytics.
How we use your information
We use your enquiry to respond, discuss requirements, prepare proposals, manage business relationships and keep lawful business records. Depending on the purpose, processing supports steps you request before a contract, performance of an agreement, legal obligations or legitimate business interests such as managing correspondence and preventing abuse. Voluntary submission does not remove our duties under the Protection of Personal Information Act (POPIA).
Optional analytics relies on your consent. Sending an enquiry does not subscribe you to marketing or grant analytics permission. We do not sell enquiry information or use the form to make automated decisions with legal effects.
Hosting, email and recipients
Domains.co.za hosts the website. Enquiries sent through the form are processed by the hosting service and delivered to LUWA's business email in Google Workspace. Authorised LUWA personnel use this information for the purposes above. Hosting and email providers process information needed to operate their services, including relevant security, delivery and connection metadata.
We may disclose information where required by law or reasonably necessary to establish, exercise or defend legal rights. External links to WhatsApp, Instagram, X and portfolio websites take you to independently operated services with their own privacy terms.
Cookies and browser storage
Cookies are values sent with browser requests. Local storage can persist across visits; session storage is associated with a browser tab. They serve different purposes on this website.
Local storage remembers your analytics choice, version and timestamp for up to 180 days. Expired, invalid or outdated choices do not permit tracking. You can change your choice using Analytics Preferences in the footer or remove browser storage through your browser settings. If storage is unavailable, your choice may apply only to the current page.
When the enquiry form is available, session storage supports draft recovery for 20 minutes after the last edit. The site removes the saved draft and clears the form after that inactivity period. If the browser suspends the page, cleanup occurs when it resumes. A successful submission also clears the draft. Unavailable forms do not accept personal entry or save drafts. Draft recovery is a convenience, not essential to browsing.
The enquiry service uses a security session cookie for request validation. It is separate from analytics. The server also processes limited anti-abuse and duplicate-request metadata. Security authorisation expires after 20 minutes; removal of session files and hosting logs depends on server cleanup and hosting settings.
Optional Google Analytics
With your permission, Google Analytics 4 helps us understand page engagement and how visitors explore our work. It may process online identifiers, analytics cookies and technical usage information, including device information and location information derived by Google Analytics. This is not anonymous processing. No Google tag loads before an eligible visitor accepts analytics. Rejection leaves ordinary browsing and the enquiry form available.
You can withdraw consent through Analytics Preferences. Withdrawal stops further analytics events, removes accessible analytics cookies and reloads the page where needed. It does not erase information already received by Google. Our analytics events exclude enquiry text, names and email addresses. Advertising storage, Google Signals and advertising personalisation are disabled.
The Google Analytics property retains event data and user data for 14 months, with reset on new user activity turned off. This setting does not extend your local analytics consent choice, which expires after at most 180 days.
International processing
Google Workspace and Google Analytics may process information outside South Africa. Where personal information is transferred internationally, POPIA's applicable transfer requirements apply, including appropriate protection through binding arrangements or another lawful transfer basis. We assess provider arrangements and access requirements when configuring these services.
Retention and deletion
We retain correspondence and business records only for as long as needed for the enquiry, relationship, applicable legal obligations or the establishment, exercise or defence of legal claims. Retention depends on the record and purpose; this policy does not promise a single automatic mailbox deletion period. Contact us to request deletion or to ask about the basis for retaining a particular record.
The website does not maintain an enquiry-body database. Messages delivered to Google Workspace form part of business correspondence. Private anti-abuse records use hashed identifiers and limited delivery state. Expired records are removed during subsequent processing; this does not guarantee physical deletion at an exact time. Hosting logs, backups and server sessions have separate service and cleanup arrangements.
Protecting information
We use reasonable technical and organisational safeguards, including restricted recipients, server validation, security tokens, rate limits, encrypted mail transport and controlled access. Safeguards are reviewed as services and risks change. No online system can guarantee absolute security. Where POPIA requires notification of a security compromise, we will notify the Information Regulator and affected people as applicable.
Your rights and choices
Subject to applicable legal requirements and exceptions, you may request access to your information, correction or deletion, object to relevant processing, or withdraw consent where consent is the basis for processing. Withdrawal does not invalidate earlier lawful processing. We may need proportionate identity verification before releasing or changing information.
Send requests to info@luwa-holdings.com, describing the information and action requested. We will explain any applicable access procedure or lawful reason that prevents us from fulfilling a request. You may also complain to South Africa's Information Regulator, whose website provides current contact details and complaint procedures.
Changes to this policy
We update this policy when our processing or legal requirements change and display the effective date here. Material changes to optional analytics purposes require an updated consent choice where appropriate.
