Privacy Policy

1. Controller Identity

certificatesofconformity.co.za is operated by LinkDaddy LLC, a Florida limited liability company, 509 N Prescott Avenue, Suite B, Clearwater, Florida 33755, United States ("LinkDaddy", "we", "us", "our"). LinkDaddy LLC is the responsible party / data controller in respect of personal information processed through this platform.

2. Information We Collect

We collect the following categories of personal information:

• Account information: email address, company name, CIPC registration number (optional), VAT number (optional), SARS customs code (optional).
• Transaction data: Stripe payment records, minting fee amounts, CIF values, CoC metadata (HS code, importer of record, manufacturer, country of origin, applicable SANS standards, issuing body, CoC reference number).
• Technical data: IP address country (via Cloudflare CF-IPCountry header), browser user agent, session identifiers.
• Uploaded documents: CoC PDF files uploaded to the minting station (see §5 for document-specific handling).

3. Purpose of Processing

We process personal information for the following purposes:

• To provide the CoC hashing, minting, and verification service you have purchased.
• To process payments via Stripe and maintain billing records.
• To send transactional emails (magic-link sign-in, mint confirmation, QR code delivery).
• To maintain the public verification registry at /v/{hash}/.
• To comply with applicable law, including responding to lawful requests from competent authorities.

4. Legal Basis

Processing is necessary for the performance of the contract between you and LinkDaddy LLC (the CoC Vault service agreement). Where processing is not strictly necessary for contract performance, it is based on our legitimate interests in operating a secure and reliable verification infrastructure, provided those interests are not overridden by your rights and interests.

5. International Transfer of Personal Information and Document Handling

LinkDaddy LLC is domiciled in the United States. All personal information collected through certificatesofconformity.co.za is processed on infrastructure operated by Cloudflare, Inc. (a US company with global network presence) and TiDB Cloud (a US-domiciled database service).

Documents you upload to certificatesofconformity.co.za are processed and stored entirely outside South Africa. The cryptographic SHA-256 fingerprint of each document is generated client-side in your browser using the Web Cryptography API before transmission, ensuring the original document content is never visible to LinkDaddy LLC personnel during processing.

Encrypted document blobs are stored as primary copies on Cloudflare R2 storage in the Western Europe region. Synchronous encrypted mirror copies are written to Google Cloud Storage in the africa-south1 region (Johannesburg, South Africa) for in-country disaster-recovery and POPIA data-sovereignty resilience. Encrypted backups may additionally be replicated to Google Cloud Storage in the eu-west1 region (Belgium) for geographic redundancy.

The website is hosted on Cloudflare's global network. The publisher entity is LinkDaddy LLC, a US entity registered in Florida. Personal information submitted via this site (such as contact form messages and account data) is processed in the United States. The United States is a recognised jurisdiction for adequate protection under POPIA Section 72(2)(a) when the responsible party has appropriate contractual safeguards in place. LinkDaddy LLC has implemented standard contractual clauses with all data sub-processors.

Cross-border data transfers between South Africa and the European Union are conducted under the Protection of Personal Information Act (POPIA), Section 72(1)(a), which permits transfer to countries with laws or binding corporate rules that are substantially similar to POPIA. The European Union's General Data Protection Regulation (GDPR) is widely recognised, including by the South African Information Regulator, as meeting this standard.

All rights to uploaded documents remain with the user. LinkDaddy LLC acts as a data custodian only, with access limited to (a) executing the verification URL service purchased, (b) operating the encrypted backup mirrors, and (c) responding to lawful requests from competent authorities.

⚠️ This section must be reviewed by a qualified South African attorney before public launch. The legal claims about POPIA Section 72(1)(a) recognised adequacy are accurate to the best of available information at the time of drafting, but a qualified SA attorney must confirm currency and applicability. Do not ship without that review.

6. Retention

CoC hash records and associated metadata are retained permanently — the verification URL must remain resolvable for the full 5-year SARS / Customs Act retention period and beyond. Original CoC PDF files are retained for 30 days after minting for users without an active vault subscription, and indefinitely for vault subscribers. Account data is retained for the duration of your account and for 7 years thereafter for tax and legal compliance purposes.

7. Your Rights

Subject to applicable law, you have the right to access, correct, or request deletion of your personal information. Note that CoC hash records and verification URLs are part of a public tamper-evident registry — deletion of the hash record would destroy the integrity of the verification service and cannot be performed after minting. To exercise your rights, contact us at the address below.

8. Contact

LinkDaddy LLC · 509 N Prescott Avenue, Suite B, Clearwater, Florida 33755, United States
Email: [email protected]