Privacy Policy.

This policy explains how Ryan Hendricks, trading as Sax by Ryan (“we”, “us”), collects and processes your personal information when you use saxbyryan.com. We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”).

1. Who we are

The responsible party is Ryan Hendricks, trading as Sax by Ryan, based in Cape Town, South Africa. Ryan Hendricks acts as the Information Officer. For any privacy-related questions or requests, contact ryan@saxbyryan.com.

2. What we collect and why

Booking & contact forms

When you submit a booking inquiry or contact form, we collect your name, email address, phone number, event details (type, date, city, venue, guest count) and your message. We use this to respond to you, prepare quotes and invoices, and manage your booking. This processing is necessary to conclude and perform a contract with you.

Course waitlist

If you join the course waitlist, we collect your name and email address with your consent, and use it only to tell you about the course. You may unsubscribe at any time.

Payments

Payments are processed by PayFast, a South African payment gateway. We never see or store your card details. We receive only confirmation of payment, the amount, and a payment reference, which we keep for accounting and record-keeping.

Email correspondence

Replies you send to our booking emails are processed (including with the assistance of automated tools) so we can respond to you and manage your booking. Correspondence is stored as part of your booking record.

AI chat widget

Messages you type into the chat widget are processed by Anthropic's Claude API to generate responses. Please do not share sensitive personal information in the chat.

Accounts and technical data

If you sign in to the client portal, authentication is handled by Clerk, which processes your email address and login credentials. Our hosting provider (Vercel) automatically logs limited technical data, such as IP addresses, for security and reliability. We use only strictly necessary cookies (for example, to keep you signed in) — no advertising or third-party tracking cookies.

3. Third-party service providers

We use a small number of service providers (operators under POPIA) to run this website. Each processes personal information only on our instructions:

• PayFast — payment processing (South Africa)
• Resend — transactional email delivery (USA)
• Clerk — sign-in and authentication (USA)
• Anthropic — AI chat responses (USA)
• Neon — database hosting
• Vercel — website hosting (USA)

Some of these providers store information outside South Africa. Where personal information is transferred across borders, we do so in accordance with section 72 of POPIA, using providers that are subject to laws or binding agreements providing an adequate level of protection. We do not sell your personal information, and we do not share it with anyone else except where required by law.

4. How long we keep your information

We keep booking records, invoices, and payment references for as long as required for legal, accounting, and tax purposes (generally five years for financial records), after which they are deleted. Waitlist details are kept until you unsubscribe or the course launch communications conclude. Inquiry correspondence that does not lead to a booking is deleted within a reasonable period.

5. How we protect your information

All traffic to and from the website is encrypted (HTTPS). Personal information is stored in an access-controlled database, admin access is restricted and authenticated, and we never store card details. While no system is perfectly secure, we take reasonable, appropriate technical and organisational measures as required by section 19 of POPIA.

6. Your rights

Under POPIA, you have the right to:

• request access to the personal information we hold about you;
• request correction or deletion of your personal information;
• object to the processing of your personal information;
• withdraw consent where processing is based on consent; and
• lodge a complaint with the Information Regulator.

To exercise any of these rights, email ryan@saxbyryan.com and we will respond within a reasonable time.

The Information Regulator (South Africa) can be reached at JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001, or via enquiries@inforegulator.org.za / POPIAComplaints@inforegulator.org.za.

7. Changes to this policy

We may update this policy from time to time. The latest version will always be available on this page, with the effective date shown at the top.