Under POPIA s. 21 and GDPR Article 28 we publish every third party that processes personal information on our behalf. The list below applies to all Veva Group tenants; any additions are announced via this page (the version + effective date in the header above is the audit trail).
We do not use advertising sub-processors. There is no Google Analytics, no Meta Pixel, no LinkedIn Insight Tag on this site.
Infrastructure
Compute + database hosting (Hetzner Cloud, Germany). Encrypted at rest, ringed off-host backups.
EU (Germany)
DNS, edge TLS termination, WAF. (Turnstile bot-detection challenge — solves a no-cookie proof-of-humanity check before contact-form submission. No personal information processed.)
Global edge, EU egress preferred
Source control
Communications
Inbound enquiry routing — when you submit the contact form, a notification is sent to the practice mailbox via Telegram so we reply within one business day. Notifications fan out to the practice owner for the specific site you contacted (Norman for vevalaw, Tertius for vevasolutions/vevasoftware, Charlotte for vevacon).
Global (Telegram cloud)
Security
Issuer of the TLS certificates used to encrypt your traffic to this site.
Global
Analytics
Privacy-friendly traffic analytics. Loaded only after you grant the "analytics" cookie category. No cookies are set; IP addresses are anonymised server-side. Data categories processed: page URL, referrer URL, anonymised IP, user-agent (browser + OS class). No cross-site tracking, no advertising re-targeting. Retention: 24 months on the Plausible side. DPA + SCCs in place — see https://plausible.io/dpa.
EU (Germany)
Transactional email delivery — auto-reply confirmations to contact-form submissions, double-opt-in newsletter confirmations. Data categories processed: name (when supplied), email address, the message body submitter chose to send. Email delivery logs retained 30 days by processor; we retain submitter copies per our own retention schedule (24 months default). DPA + SCCs in place — see https://resend.com/legal/dpa.
United States (DPA + SCCs)
If you object to any processor on this list and you are a data subject whose personal information we process, email info-officer@vevalaw.co.za and we will tell you what alternative is feasible.