Privacy policy

Last updated 2026-10-21

Who is responsible

Athena Advisors SA 786 (Pty) Ltd (registration 2013/032888/07), trading as Athena, is the responsible party for the personal information collected through this site. We are in McCoy Street, Stellenbosch, Western Cape 7600.

What we collect, and why

When you send us an enquiry

• Your name and email address, so we can reply. Both are required.
• Your phone number and company, optional, used only to reach you about your enquiry.
• Project type, budget range and timeline, optional, used to scope a realistic response.
• The message you write.
• When you send the form, we check that the domain of your email address, the part after the “@”, is able to receive mail, and we turn away known throwaway addresses. That check is a public mail-record lookup of the domain, typically gmail.com or your company’s domain, not of you: your name, your message and the rest of your enquiry are never sent anywhere to make it. Its only purpose is to catch a mistyped or fake address so your request does not vanish.
• Technical detail attached automatically: your IP address, browser user-agent, the page you submitted from and the referring page. This is kept to detect and block automated abuse of the form, and is not used to profile you.

When you fill in the enquiry form but don’t send it

Our own analytics record the enquiry form field by field as you complete it, and this includes the text you entered, not merely the fact that a field was filled. We do this so that an enquiry you began but were interrupted before sending is not simply lost to us, and so we can see which questions make people hesitate and improve them. In plain terms: if you type your name and email and then close the tab without pressing send, we may hold what you entered against that visit.

• This applies to the public enquiry form only. Password fields are never recorded, in your browser or on our server, and no sign-in form is ever captured this way.
• It runs only while our own analytics run. If your browser sends Do Not Track or Global Privacy Control, we record nothing at all, and that includes this.
• Whatever you entered is stored beside the rest of that visit and is deleted on the same analytics schedule set out below, never kept for longer. We can also switch this capture off across the whole site from our console.
• If you would like anything you typed removed, write to us and we will delete the records relating to you.

When you apply for a job

If you apply through our careers page, we collect what you give us for that purpose: your name and contact details, your CV and any cover letter or portfolio you attach, your answers to the role’s screening questions, and details such as your current role, notice period, salary expectation and availability. We process this to consider you for the role, on the basis of the consent you give by ticking the box on the application form and in order to take steps at your request before a possible contract of employment.

• Your CV and documents are stored on our own server, outside the public website, and are reachable only by the people at Athena handling hiring. They are never published or shared for marketing.
• We keep a record of how your application progresses — stages, interview notes and internal scorecards — so the hiring team has a shared, fair picture. This is kept with your application.
• We use a lightweight in-browser check on the application form to keep out automated bots, and we confirm your email domain can receive mail, exactly as described above for enquiries.
• If you are not successful, we keep your application for a limited retention period (twelve months by default) in case a more suitable role opens up, and then delete it and its files automatically. If you are hired, your details become part of your employee record. You can ask us to delete your application at any time and we will erase it and the documents you sent.

When you simply browse the site

We run our own analytics on our own server, and we also use Google Analytics. Our own records stay on our machine. Google Analytics is a third-party service: it sets its own cookies, records the pages you visit, and sends that information to Google, whose servers are outside South Africa. We do not use it for advertising, and we have not enabled Google Signals, advertising features or cross-device tracking. For each visit our own records keep:

• The pages you viewed, when, how long the page took to render, how far down you scrolled and how long you stayed.
• How you arrived: the referring website, or the campaign tags on the link you followed.
• Your device type, browser, operating system, screen size, language and time zone.
• Interactions with the page: which portfolio projects you opened, which filters you used, whether you clicked a phone number or email address, and whether you started the contact form.
• A two-letter country code, only if our hosting provider supplies one. We do not use a geolocation database and we never derive your location from your IP address.

What we keep of your IP address

We record your full IP address against each visit. We do this so we can investigate abuse of the site and fraudulent enquiries, and so we can tell one visitor from another with certainty. It is deleted with the rest of the visit record at the end of the retention period below, and it is never sold, shared or used for advertising.

If you would rather we did not hold it, write to us and we will delete the records relating to you.

How we tell one visit from another

Instead of a tracking cookie we store a one-way SHA-256 hash of your IP address, your browser user-agent, a secret held on our server, and the current date. That value cannot be reversed into an address, and because the date is part of it, the hash changes at midnight, so we cannot follow the same person from one day to the next, and we cannot connect your browsing to any enquiry you send unless you send one.

If you send an enquiry, we do record which visit produced it, so we know which marketing channel is working. That link exists only for enquiries you chose to send.

Where we work out your location from

Location comes from a database held on our own server, or from a header set by the content delivery network in front of the site. No request about you is made to any third-party lookup service, so your address is not shared with another company in order to place you on a map. The result is approximate, typically the town of your internet provider's exchange, not where you are sitting.

How to switch analytics off

If your browser sends a Do Not Track or Global Privacy Control signal, we record nothing at all, no page views, no events, no session. This is honoured on every page, and there is no setting on our side that overrides it. Most browsers and privacy extensions can send one or both of these; in Firefox it is under Privacy & Security, and extensions such as Privacy Badger or DuckDuckGo send GPC by default.

Known search-engine crawlers and monitoring bots are excluded entirely.

Cookies

This site sets one cookie of its own: a session cookie. It exists so the contact form's anti-forgery token works and, if you are signed in, so the site knows who you are. It carries no personal information, is not readable by any other site, and expires when you close your browser.

Google Analytics sets its own cookies, typically named _ga and _ga_<id>, which last up to two years and let Google recognise a returning browser. These are analytics cookies set by a third party, and we ask before any of them is set.

Your choice

The first time you arrive we ask whether Google Analytics may run. Nothing from Google loads until you say yes, so declining is not a matter of switching something off after the fact: it never starts. Both answers are one click, and the site behaves identically either way. We record what you chose, when, and which version of this policy you were shown.

If your browser sends Do Not Track or Global Privacy Control we take that as your answer, do not load Google Analytics, and do not interrupt you with the question at all. Your own analytics record is kept regardless, because it never leaves our server.

Changed your mind? Clearing your choice below brings the question back.

Clear my cookie choice

Google also publishes a browser add-on that blocks it everywhere, at tools.google.com/dlpage/gaoptout.

If you use the client portal

Clients signing in to the project portal have an account holding a name, email address, a hashed password and the projects they are attached to. Portal activity, documents opened, issues raised, approvals given, invoices viewed, is recorded against that account so both sides have a shared record of what happened and when. Payment card details are never stored on our systems: card payments are processed by our payment provider, and we receive only the outcome and a reference.

Our lawful basis

We process your enquiry on the basis of your consent, which you give by ticking the consent box before sending the form, and because processing is necessary to take steps at your request before entering into a contract. You may withdraw consent at any time.

Who else sees it

Enquiries are stored in our own database on our own hosting and are read by the people at Athena who would respond to you. We do not sell, rent or share your details with third parties for marketing. Our email provider necessarily processes the notification and acknowledgement messages in transit. The only automated check that reaches beyond our own server is the mail-record lookup described above: it asks the public domain name system whether your email provider’s domain can receive mail, and it carries nothing about you or your message.

Where it is stored, and for how long

Our own records are held on our servers in South Africa. Google Analytics is the exception: the visit information it collects is processed by Google on infrastructure outside South Africa, under Google's own terms and retention settings rather than ours.

• Enquiries, three years from the last contact, so we have a record of what was discussed and quoted. Records flagged as automated spam are deleted within 30 days.
• Analytics, raw visit records, including anything kept of an IP address, are deleted after 400 days by an automated job. Only anonymous daily totals, which identify nobody, are kept beyond that.
• Job applications, kept for twelve months from the decision if you are not successful, then deleted automatically together with your CV and documents. Successful applications become part of the employee record.
• Client portal records, kept for the life of the engagement and then for five years afterwards, which is the period South African tax and company law requires us to retain records of work done and invoiced.

Your rights

Under POPIA you may ask us to confirm what personal information we hold about you, correct anything that is wrong, delete it, object to how we are using it, or ask for it in a portable format. Write to info@athena-sa.com and we will respond within 30 days. There is no charge for a reasonable request.

If you are not satisfied with how we have handled a request, you may complain to the Information Regulator (South Africa) at inforegulator.org.za.

Security

The site runs over HTTPS. Form submissions carry an anti-forgery token, are rate limited by IP address, and every database query uses prepared statements. To keep automated bots out of the enquiry and referral forms, your browser quietly completes a small mathematical puzzle when you submit, proving a real person is filling the form in; this runs entirely on your device and gathers no additional information about you. Administrative access is password protected with hashed credentials, attempt limiting and an audit log. No security is absolute, but nothing here is left to a framework default.

Changes

If this policy changes materially we will update the date at the top of this page. Enquiries already submitted continue to be handled under the policy that applied when you sent them.

Contact

Questions about this policy: info@athena-sa.com or +27 (0)72 220 8741.