Legal
Data processing, documented.
The POPIA detail behind the privacy policy: processing purposes, data categories, every recipient, retention, and how responsibilities divide between GatorScale and client practitioners.
Roles
For enquiries submitted through this website, GatorScale Media is the responsible party. Where GatorScale Media operates campaigns and pipelines on behalf of a client practitioner and processes enquiry data for that client's mandate conversations, the client practitioner is the responsible party for that downstream processing and GatorScale Media acts as an operator under POPIA — processing on the client's documented instructions. Engagement agreements should record this division explicitly.
Processing purposes
Responding to enquiries; routing enquiries to the correct practitioner; campaign measurement and optimisation; spam prevention and rate limiting; and — only with analytics consent — aggregate usage measurement of this website.
Categories
| Data subjects | Categories processed |
|---|---|
| Website visitors | Technical data (IP, user agent), consent choice, session attribution; analytics events only after consent |
| Enquirers (practitioners and property owners) | Contact details, area, focus, message, optional assessment answers, submission metadata |
| Client practitioners | Business contact details, engagement and reporting data |
Recipients and sub-processors
| Recipient | Role | Receives |
|---|---|---|
| Render | Hosting provider | All traffic to this site (processing infrastructure) |
| Resend | Email delivery | Enquiry contents for admin notification and confirmation emails |
| Configured lead webhook (CRM / Zapier / Make / Google Sheets) | Lead delivery and storage, where enabled | Enquiry contents |
| Google (Analytics, Tag Manager) | Analytics, consent-gated | Usage events after consent; storage denied before consent |
| Meta (Pixel and Conversions API) | Campaign measurement, consent-gated and only where configured | Event data after consent |
Several of these providers process data outside South Africa. POPIA permits cross-border transfers where the recipient is subject to laws or binding agreements providing adequate protection, or with consent; we rely on the providers' standard contractual protections and limit what is sent to what each purpose needs.
Retention
Enquiry records: for the life of the enquiry and any resulting engagement, then deleted on request or periodic review. Webhook-delivered copies: governed by the receiving system's retention, which for client-configured CRMs is the client's responsibility as responsible party. Analytics: per configured Google Analytics retention. Consent choice: stored in the visitor's own browser, removable by them at any time.
Security measures
HTTPS with HSTS; security headers (frame, content-type, referrer and permissions policies); per-IP rate limiting on submission endpoints; honeypot-based spam rejection; secrets held in environment configuration rather than code; and payload limits on all API endpoints.
Requests
Data-subject requests — access, correction, deletion, objection — go to leads@gatorscalemedia.com and are honoured as described in the privacy policy.
Next step
Start with an assessment, not a sales call.
Answer six questions about your area and follow-up capacity. You get a readiness result, a recommended first test and the risk most likely to cost you mandates — before anyone contacts you.