What this site collects, and what it doesn’t.

Who I am, and what this covers

Marques & Co. is the trading name of Marques and Co (Pty) Ltd, a South African company. Manny Marques is the sole director, and under POPIA that makes me the Information Officer - the person responsible for everything on this page, and the person you come to first.

Registered name

Marques and Co (Pty) Ltd

Information Officer

Manny Marques. 083 702 8458 or manny.marques28@outlook.com

This notice covers the website and nothing else. What happens once you get in touch - the site visit, the quote, photographs of the work - isn’t covered here.

What I collect

Nothing that identifies you, unless you do one of two things.

You message me. WhatsApp, email, a phone call, or the form at the bottom of the home page. I get whatever you choose to send - your name, your number, your suburb or street, and whatever you tell me about the property. If you send nothing, I know nothing.

The form asks for four things: your name, your email address, your suburb, and what needs doing. It won’t send without the tick that says I may contact you about it, and that tick is separate from the banner - one is about reaching you, the other is about counting. Rejecting the banner does not stop the form.

You press Accept on the banner. Then I start counting: which pages get opened, which sections get scrolled past, which links get pressed, and which advert or which site sent you here. That is measurement, not identification - it tells me which sections get read and which don’t.

Press Reject, or dismiss the banner without answering, and none of the second list happens - with one exception. If you send the form before answering the banner, and the link you arrived on carried a campaign tag (clause 03), the tag goes with your enquiry, so I can see which advert or link it came from. Press Reject and it doesn’t.

Clause 04 explains why the form asks for an email address rather than only a phone number.

What’s stored on your device

I don’t set cookies. The site uses browser storage instead, and there are exactly two entries in it.

mco-consent

Your Accept or Reject, saved so I only ask once. It stays until you change it or clear your browser storage. A Reject is saved too - that’s what stops the banner nagging you.

mco-attr

The campaign tag off the link you arrived on, if the link carried one - an advert click ID, or the utm values on a tracked link, with the page you landed on and when. Nothing is written here for an ordinary visit. It goes into storage that is wiped when you close the tab, and it only becomes permanent - for 90 days, which is Google Ads’ own window - if you press Accept. Send the form before you answer the banner and the tag goes with your enquiry. Press Reject and both copies are deleted, and it is not written again on a later visit either. A no is a standing answer, not a per-page one.

Before you answer the banner, nothing outlives the tab, and nothing leaves this browser unless you send the form.

The scrambled email that goes to Google

The form exists now. The advertising account it would feed does not, so today this describes what will happen and not what does. I’d rather over-explain now than change the rules on you later.

The form asks for your email address. Once the advertising account is running, and only if you have pressed Accept, your browser runs that address through a one-way scramble - SHA-256, the method Google requires - and what travels to Google is the scrambled string, never the address. It lets Google work out which advert produced the enquiry, which is how I know which adverts are worth paying for.

Until that account exists the scramble isn’t made at all. Not made and thrown away - not made. There is nothing to send, so nothing gets calculated.

Be clear about what that does and doesn’t protect. A scramble can’t be reversed, but it can be matched: if Google already holds your email address, it can tell the two are the same person. That is the entire point of it, and you should know it before you press Accept.

None of it runs unless you have accepted. If you rejected, the form still works and still reaches me - the scrambled copy just isn’t sent.

Who else sees it

These are the companies that handle any of it on my behalf. They all operate outside South Africa, which is why POPIA section 72 says I have to name them here rather than leave you to guess.

Cloudflare

Hosts the site and serves the pages. Every visit passes through their network. If a page fails to load, your browser may send Cloudflare a short error report with the page address, so they can find faults in their network. That happens whether or not you press Accept, and it isn’t a setting I can switch off.

Umami

The counting in clause 02. Its script is only ever loaded after you press Accept, and it sets no cookie of its own.

Google

Runs the adverts, and receives the scrambled email described in clause 04.

Resend

Delivers what you write in the form to my inbox. Your name, email, suburb and description pass through them, and the campaign tag from clause 03 if there was one and you hadn’t pressed Reject.

Pushover

Sends the alert to my phone so I see an enquiry quickly. It carries your name, your suburb and the first part of what you wrote.

Resend and Pushover only ever see a form submission. Message me on WhatsApp, by email or by phone and neither of them is involved at all.

Where they are: Resend, Pushover and Google process in the United States. Umami keeps the counting in the European Union. Cloudflare serves the site from data centres around the world.

What makes that lawful under POPIA section 72: Cloudflare, Resend and Pushover only carry what you ask me to - a page you open or an enquiry you send - so they rest on section 72(1)(c), steps you’ve asked me to take before any contract. Umami and Google only get anything after you press Accept, so they rest on your consent, section 72(1)(b). Resend’s and Umami’s data-processing terms also apply to this site automatically; Google’s apply once the ads account is set up.

One that isn’t mine to control: WhatsApp belongs to Meta, so messaging me there means Meta carries the message. That is true of every WhatsApp conversation you have. Phone or email if you’d rather it didn’t.

I don’t sell anything to anybody, and nobody buys advertising space on this site.

How long I keep it

Your consent choice

Until you change it or clear your browser storage. It lives on your device, not on a server of mine.

The campaign tag

90 days if you accepted. If you didn’t, until you close the tab. If it went with an enquiry, I keep it as long as I keep the enquiry.

The counting

Six months on the analytics account, then it’s deleted.

Your enquiry

If it doesn’t turn into a job, I delete it within 12 months. If it does, the quote and invoice are kept for seven years, because company law requires it, and the messages about that job stay with them.

What you can ask me to do

POPIA gives you all of this, and none of it costs anything.

• Ask what I hold about you and get a copy of it. Section 23.
• Have it corrected or deleted - if it’s wrong, out of date, or I never had a good reason to hold it. Section 24.
• Object to me using it at all. Section 11(3).
• Change your mind about the banner. Press Privacy settings at the foot of any page.
• Complain to the Information Regulator if you think I’ve handled it badly. You don’t have to come to me first. Email POPIAComplaints@inforegulator.org.za, call 010 023 5200, or lodge it through the eService Portal at inforegulator.org.za.

One caveat on changing your mind, because it matters and it isn’t obvious: withdrawing consent stops any further measurement and deletes the campaign tag from your device. It can’t un-send what was already sent. I’m not going to pretend otherwise.

Ask me on 083 702 8458 or at manny.marques28@outlook.com.

If this changes

I’ll change the date at the top of the page. If a change affects what gets collected or who sees it, I’ll ask for your consent again rather than treat the old answer as covering something you were never told about.

Last updated 3 October 2026