Nexys (Pty) Ltd trading as NexysCloud, reg. 2024/316570/07. Version 2026-11-draft. Afrikaans text follows; until then the English version applies to both language editions of the site.
Part B: Privacy notice (POPI)
17. Who is responsible
Nexys (Pty) Ltd trading as NexysCloud is the responsible party under the Protection of Personal Information Act, 4 of 2013 (POPI). Information Officer: [name, email, phone]. [Registered with the Information Regulator on date / registration pending].
18. What we collect and why
| Information | Why | Lawful basis |
|---|---|---|
| Your name, role, email, mobile, password (hashed) | To create and secure your login, verify you, and send the update reminder | Performing the listing agreement |
| Business name, address, pin, phone, WhatsApp, email, hours, products, story, charity details, logo, photos | To publish the listing (this is the point of the service) | Performing the agreement; publishing is at your request |
| Blog posts and testimonials | To publish them on your listing | Performing the agreement |
| Verification records (call, SMS or WhatsApp code, documents) | To confirm authority and prevent fraud | Legitimate interest |
| Technical logs (IP address, browser, pages viewed) | Security, abuse prevention and basic statistics | Legitimate interest |
| Marketing consent record | To know whether we may tell you about other services | Your consent (section 69), which you may withdraw at any time |
We do not collect card or bank details for a free listing.
19. Publication is public
Your listing is public by design. Search engines and AI assistants read it. A named person's direct email or mobile that you put in the public listing becomes public too, so only publish contact details you want the world to see. The owner's login details are never published.
20. Who we share it with
- Service providers that run the Directory: hosting in
[South Africa, provider], Cloudflare (network, images, backups), the email provider[Resend / Amazon SES], and the map provider. They process data for us under contract. - Google, only the Place ID you give us.
- The public, for the listing itself.
- Authorities, where the law requires.
- We do not sell personal information.
21. Cross-border transfers
Some providers store copies outside South Africa (for example backups on Cloudflare R2 and email logs). We only use providers bound by contract to a standard of protection similar to POPI (section 72).
22. Retention
- Live listing: for as long as it is live, plus 90 days.
- Account and verification records: 3 years after the listing closes, for fraud and dispute purposes.
- Marketing consent and opt-out records: kept indefinitely so that we honour opt-outs.
- Backups: daily for 7 days, weekly for 4 weeks, monthly for 12 months, then deleted.
23. Your rights
You may ask what we hold about you, ask us to correct or delete it, object to processing, withdraw marketing consent, and complain to the Information Regulator (inforegulator.org.za). Email the Information Officer. We answer within 30 days. Our PAIA manual is at [link].
24. Marketing
We only email, SMS or WhatsApp you about other NexysCloud services if you ticked the separate marketing box, or if you are already a paying customer for a similar service. Every such message has an opt-out, and we check the National Opt-Out Registry before campaigns. The three-monthly listing update email is not marketing.
25. Security and breaches
Passwords are hashed. Sign-in links expire and work once. Data is encrypted in transit and backups are encrypted at rest. If a breach is likely to affect you, we will tell you and the Information Regulator as soon as reasonably possible (section 22).
26. Cookies
The public Directory uses only cookies needed to run the site (search preferences, town choice). The business login uses a session cookie. We do not use advertising cookies. If we add analytics, this notice will say so first.