This Privacy Policy explains how Naughty Bean Consulting (“we”, “us”, “our”), the provider of the AtlasHub software delivery and documentation platform, processes personal information. We are committed to protecting your privacy and handling your information responsibly, lawfully and transparently.
For POPIA purposes we act as the Responsible Party for personal information we collect about website visitors and enquirers, and as an Operator (Processor) for personal information our customers store within their self-hosted or hosted AtlasHub instance. For GDPR purposes these roles map to Controller and Processor respectively.
1. Who we are
Naughty Bean Consulting operates AtlasHub and this website. If you have any questions about this policy or how your information is handled, contact our Information Officer at hello@naughtybean.consulting.
2. Scope & definitions
This policy applies to personal information processed through:
- this marketing website and our contact/quote forms;
- email and other correspondence with us; and
- AtlasHub instances we host or manage on a customer’s behalf.
Key terms used in this policy:
- Personal information / personal data — information relating to an identified or identifiable person (e.g. name, email address, IP address).
- Processing — any operation performed on personal information, such as collection, storage, use, or deletion.
- Data subject — the person to whom the personal information relates.
- Responsible Party / Controller — the party that determines the purpose and means of processing.
- Operator / Processor — a party that processes personal information on behalf of, and under the instruction of, a Responsible Party/Controller.
3. Information we collect
We practise data minimisation — we only collect what we need for a clear purpose.
3.1 Information you give us
- Contact & quote enquiries: your name, company, work email, team size and the message you send us.
- Correspondence: the content of emails and support requests.
3.2 Information collected automatically
- Technical & log data: IP address, browser type, pages visited and timestamps, collected by our web server for security and to keep the service running.
- Local storage: a single preference key (
ah-theme) that remembers your light/dark choice. This never leaves your browser.
3.3 Customer content in AtlasHub
When we host AtlasHub for you, your instance may contain personal information about your own team and users (names, email addresses, page content). We process this only as an Operator/Processor on your documented instructions — you remain the Responsible Party/Controller.
4. How & why we use your information
| Purpose | Examples |
|---|---|
| Respond to enquiries | Prepare and send onboarding quotes, answer questions, arrange demos. |
| Provide & maintain the service | Host, secure, back up and support AtlasHub instances. |
| Security & abuse prevention | Detect, investigate and prevent fraudulent or unauthorised activity. |
| Legal & accounting | Comply with tax, accounting and other legal obligations. |
| Service communications | Send important notices about changes, security or availability. |
We do not sell your personal information, and we do not use it for advertising or automated decision-making that produces legal effects.
5. Lawful basis for processing (GDPR & POPIA)
Where the GDPR applies, we rely on the following lawful bases; the corresponding POPIA justification is noted alongside:
| Activity | GDPR Art. 6 basis | POPIA justification |
|---|---|---|
| Replying to a quote/contact request | Steps at your request prior to a contract / legitimate interests | s11(1)(b)/(f) |
| Delivering a paid service | Performance of a contract | Contract necessity, s11(1)(b) |
| Security & service logs | Legitimate interests | Legitimate interests, s11(1)(f) |
| Legal/accounting records | Legal obligation | Compliance with law, s11(1)(c) |
| Optional marketing (if any) | Consent | Consent, s11(1)(a) |
Where we rely on consent, you may withdraw it at any time without affecting processing carried out before withdrawal.
6. Cookies & tracking
This website is deliberately light on tracking. We do not use advertising or
third-party analytics cookies. The only client-side storage we use is a functional
localStorage entry that remembers your theme preference. Because it is strictly
necessary for a feature you have chosen, it does not require consent under the ePrivacy rules,
and no personal information is stored in it.
7. Sharing & sub-processors
We share personal information only where necessary, and never sell it. Recipients may include:
- Infrastructure & hosting providers that store and serve data on our behalf under written data-processing terms;
- Professional advisers (e.g. accountants, lawyers) where required;
- Authorities where we are legally obliged to disclose.
All sub-processors are bound by confidentiality and data-protection obligations at least as protective as those in this policy.
8. International data transfers
Personal information may be processed in countries other than your own. Where we transfer personal data out of the EEA/UK, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum) or an adequacy decision. Where POPIA applies, cross-border transfers are made in accordance with section 72, ensuring the recipient is subject to comparable protection.
9. Data retention
We keep personal information only for as long as necessary for the purposes described above, then delete or anonymise it:
- Enquiry data: up to 24 months after our last contact, unless you become a customer.
- Customer & contract records: for the duration of the contract plus any period required by law (e.g. tax records for 5 years).
- Hosted AtlasHub content: retained for the term of your agreement and deleted or returned on termination per your instructions.
- Server logs: a short rolling window for security and troubleshooting.
10. How we protect your information
In line with POPIA section 19 and GDPR Article 32, we maintain appropriate technical and organisational measures, including encryption in transit (TLS), access controls and role-based permissions, regular backups, least-privilege administration, and the option to self-host so your data never leaves your own infrastructure. In the event of a data breach that poses a risk to you, we will notify the relevant regulator and affected individuals as required by law, without undue delay.
11. Your rights under the GDPR
If the GDPR applies to you, you have the right to:
- Access the personal data we hold about you (Art. 15);
- Rectify inaccurate or incomplete data (Art. 16);
- Erasure — request deletion (“right to be forgotten”, Art. 17);
- Restrict processing (Art. 18);
- Data portability — receive your data in a portable format (Art. 20);
- Object to processing based on legitimate interests or direct marketing (Art. 21);
- Withdraw consent at any time; and
- Lodge a complaint with your local supervisory authority.
12. Your rights under POPIA
If you are in South Africa, POPIA gives you the right to:
- be notified that your information is being collected and used;
- request access to your personal information held by us;
- request correction or deletion of inaccurate, irrelevant or excessive information;
- object to processing on reasonable grounds;
- not have your information processed for unsolicited direct marketing without consent; and
- lodge a complaint with the Information Regulator (South Africa).
Information Regulator (South Africa): inforegulator.org.za, email enquiries@inforegulator.org.za.
To exercise any of these rights, email us at hello@naughtybean.consulting. We will respond within the timeframes required by law (generally within one month under the GDPR).
13. Children’s privacy
AtlasHub is a business tool and is not directed at children. We do not knowingly collect personal information from children under 18. If you believe a child has provided us information, contact us and we will delete it.
14. Changes to this policy
We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date above and, where appropriate, by notifying you directly.
15. Contact us
For any privacy question, to exercise your rights, or to reach our Information Officer, email hello@naughtybean.consulting.
This policy is provided for transparency and does not constitute legal advice. See also our Terms of Service.