Who We Are
FootiFlow Media (Pty) Ltd ("FootiFlow," "we," "us," or "our") is a digital marketing agency specialising in Meta Ads (Facebook and Instagram advertising) for law firms. We are registered and operate in the Republic of South Africa, headquartered in Bloemfontein, Free State.
Responsible Party (POPIA)
FootiFlow Media (Pty) Ltd
Bloemfontein, Free State, South Africa
Email: info@footiflow.com
Phone: 066 025 5335
As the Responsible Party under POPIA, we determine the purpose and means of processing personal information collected through our website, marketing activities, and client engagements.
Scope of This Policy
This Privacy Policy applies to all personal information collected by FootiFlow Media through:
- Our website at www.footiflow.com and all subpages
- Contact forms, strategy call bookings, and email communications
- Meta Ads campaigns run on behalf of our law firm clients
- Service agreements and onboarding processes
- Analytics and tracking tools deployed on our website
This policy does not govern the privacy practices of third-party websites linked from our site, or the independent data practices of Meta Platforms, Inc. (Facebook/Instagram). We encourage you to review Meta's own Privacy Policy separately.
Information We Collect
3.1 Information You Provide Directly
When you complete our contact form, book a strategy call, or enter into a service agreement, we collect:
- Full name and professional title
- Law firm name and physical address
- Email address and telephone / WhatsApp number
- Practice area(s) and approximate firm size
- Monthly advertising budget range
- Information about your current marketing activity and pipeline
- Any additional details you choose to share in message fields
3.2 Information Collected Automatically
When you visit our website, we automatically collect certain technical information through cookies and analytics tools, including:
- IP address and approximate geographic location
- Browser type, version, and operating system
- Pages visited, time spent on pages, and referral source
- Device identifiers and screen resolution
- Click behaviour and scroll depth
3.3 Information from Third Parties
We may receive limited information about you from Meta Platforms (Facebook/Instagram) when you interact with our ads, including aggregated audience insights and ad engagement data. This information is anonymised or pseudonymised and does not allow us to identify you individually unless you subsequently contact us directly.
Note for law firm clients: If we run Meta Ads campaigns on your behalf, we act as an Operator under POPIA in respect of any personal data relating to your prospective clients. You, as the law firm, remain the Responsible Party for that data. Our Service Agreement sets out our respective data obligations.
How We Use Your Information
We use your personal information for the following purposes:
| Purpose | Information Used |
|---|---|
| Respond to your enquiry or strategy call request | Name, email, phone, firm details, message content |
| Provide and manage our Meta Ads services | Contact details, firm details, campaign preferences |
| Issue invoices and manage payments | Name, firm name, billing address, email |
| Communicate service updates, reports, and performance data | Contact details, campaign performance data |
| Improve our website and user experience | Automatically collected technical data (anonymised) |
| Send marketing communications (with consent) | Email address, name |
| Comply with legal and regulatory obligations | As required by applicable law |
We do not use your personal information for automated decision-making or profiling that produces legal or similarly significant effects on you.
Legal Basis for Processing
Under POPIA, we process your personal information on the following grounds:
- Contractual necessity: Processing required to enter into or perform a service agreement with you or your firm.
- Legitimate interest: Processing necessary for our legitimate business interests, including responding to enquiries, improving our services, and conducting marketing activities, provided these interests do not override your rights.
- Consent: Where we send direct marketing communications by email or WhatsApp, we rely on your consent. You may withdraw consent at any time.
- Legal obligation: Processing necessary to comply with applicable South African law, including tax and financial record-keeping requirements.
Meta Pixel & Tracking Technologies
6.1 What is the Meta Pixel?
Our website uses the Meta Pixel (also known as the Facebook Pixel), a piece of JavaScript code provided by Meta Platforms, Inc. The Meta Pixel allows us to measure the effectiveness of our advertising by tracking actions taken on our website after viewing or clicking one of our Meta ads.
6.2 What the Pixel Collects
When you visit our website, the Meta Pixel may collect the following information and transmit it to Meta:
- Your IP address (which Meta uses to match to a Facebook/Instagram account)
- Browser type and cookies
- Pages viewed and actions taken (e.g. form submissions, page views)
- Referral URL and timestamp
6.3 Your Choices
You can opt out of Meta's use of your data for targeted advertising by visiting your Facebook Ad Preferences. You can also use browser-level controls such as cookie blocking or the Digital Advertising Alliance opt-out tool.
For law firm clients deploying the Meta Pixel on their own websites: You are responsible for disclosing the use of the Meta Pixel in your own privacy policy and obtaining any required consents from your website visitors. FootiFlow Media will provide guidance on this as part of onboarding.
Sharing Your Information
We do not sell, rent, or trade your personal information to third parties. We may share your information only in the following limited circumstances:
7.1 Service Providers (Operators)
We engage trusted third-party service providers who process data on our behalf as Operators under POPIA. These include:
- Meta Platforms, Inc. — for ad campaign management and audience targeting
- Google LLC — for website analytics (Google Analytics) and email services (Google Workspace)
- CRM software providers — for managing client communications and pipeline tracking
- Accounting software providers — for invoicing and financial record-keeping
All third-party Operators are required to process data only on our instructions and to maintain appropriate security measures.
7.2 Legal Requirements
We may disclose your personal information where required by law, court order, or regulatory authority in the Republic of South Africa, or where disclosure is necessary to protect the rights, property, or safety of FootiFlow Media, our clients, or others.
7.3 Business Transfers
In the event of a merger, acquisition, or sale of all or part of FootiFlow Media's business, personal information held by us may be transferred to the acquiring entity, provided that equivalent privacy protections remain in place.
International Data Transfers
Some of our third-party service providers (including Meta Platforms, Inc. and Google LLC) are located outside the Republic of South Africa. When we transfer your personal information to these providers, we ensure that adequate safeguards are in place as required by Section 72 of POPIA, including:
- Transfers to countries that provide an adequate level of protection for personal information
- Contractual obligations binding the recipient to POPIA-equivalent standards
- Where applicable, the data subject's consent to the transfer
Meta Platforms, Inc. and Google LLC participate in data transfer frameworks and maintain Standard Contractual Clauses that provide equivalent protection for your personal information.
Data Retention
We retain personal information only for as long as necessary for the purposes for which it was collected, or as required by law. Our standard retention periods are as follows:
| Category | Retention Period | Reason |
|---|---|---|
| Enquiry / contact form data | 2 years from last contact | Legitimate interest in business development |
| Client service records | 5 years after contract end | Legal and accounting obligations |
| Financial records and invoices | 7 years | South African tax law (SARS requirements) |
| Email marketing consent records | Until consent withdrawn + 1 year | Compliance with POPIA consent rules |
| Website analytics data | 26 months (anonymised) | Google Analytics default retention |
| Campaign performance data | Duration of contract + 3 years | Client reporting and dispute resolution |
At the end of the applicable retention period, personal information is securely deleted or anonymised so that it can no longer be attributed to any individual.
Your Rights Under POPIA
As a data subject under the Protection of Personal Information Act No. 4 of 2013, you have the following rights:
- Right of access: Request confirmation of whether we hold your personal information and obtain a copy of that information.
- Right to correction: Request that we correct inaccurate, irrelevant, excessive, out-of-date, incomplete, misleading, or unlawfully obtained personal information.
- Right to deletion: Request the deletion or destruction of your personal information where we no longer have a lawful basis for processing it.
- Right to object: Object to the processing of your personal information on grounds relating to your particular situation, or to direct marketing.
- Right to withdraw consent: Where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of prior processing.
- Right to complain: Lodge a complaint with the Information Regulator of South Africa if you believe your rights have been infringed.
How to Exercise Your Rights
Submit your request in writing to: info@footiflow.com
Include your full name, contact details, and a clear description of your request. We will respond within 30 calendar days.
Information Regulator of South Africa
If you are not satisfied with our response, you may contact the Information Regulator:
Website: inforegulator.org.za
Email: inforeg@justice.gov.za
Cookies
Our website uses cookies — small text files placed on your device — to improve functionality, analyse usage, and support our advertising activities. We use the following types of cookies:
- Strictly necessary cookies: Essential for the website to function. These cannot be disabled.
- Analytics cookies: Google Analytics cookies that collect anonymised data about how visitors use our site (e.g. pages visited, session duration).
- Advertising cookies: The Meta Pixel and associated cookies that allow us to measure ad effectiveness and build custom audiences on Meta platforms.
- Preference cookies: Cookies that remember your language, currency preference (ZAR/USD), and other settings.
On your first visit to our website, you will be presented with a cookie consent banner. You may accept all cookies, reject non-essential cookies, or manage individual cookie categories. You can update your preferences at any time through your browser settings.
Most browsers allow you to control cookies through their settings. Please note that disabling certain cookies may impact the functionality of our website.
Children's Privacy
Our services are directed exclusively at legal professionals and law firms. Our website is not intended for use by persons under the age of 18, and we do not knowingly collect personal information from minors.
If you believe we have inadvertently collected personal information from a minor, please contact us at info@footiflow.com and we will take steps to delete that information promptly.
Security
We implement appropriate technical and organisational measures to protect your personal information against accidental loss, unauthorised access, disclosure, alteration, or destruction. These measures include:
- HTTPS encryption for all data transmitted through our website
- Access controls limiting personal data access to authorised personnel only
- Use of reputable, security-certified third-party platforms for data storage
- Regular review of our data processing practices and security posture
Despite these measures, no method of electronic transmission or storage is completely secure. While we strive to use commercially reasonable means to protect your personal information, we cannot guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the Information Regulator as required by POPIA.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal obligations. When we make material changes, we will:
- Update the "Last updated" date at the top of this policy
- Notify active clients by email where the changes are significant
- Display a prominent notice on our website for a reasonable period
Your continued use of our website or services after any changes constitutes your acceptance of the revised policy. We encourage you to review this page periodically.
Contact & Complaints
If you have any questions about this Privacy Policy, wish to exercise your rights, or have a concern about how we have handled your personal information, please contact our Information Officer:
Information Officer — FootiFlow Media
Email: info@footiflow.com
Phone: 066 025 5335
Address: Bloemfontein, Free State, South Africa
We take privacy complaints seriously and will acknowledge your complaint within 5 business days and provide a substantive response within 30 days. If you remain dissatisfied, you have the right to escalate your complaint to the Information Regulator of South Africa at inforegulator.org.za.