Privacy Policy

1. Who We Are

Nexo Technologies (Pty) Ltd ("Nexo", "we", "us", "our") is a company registered in South Africa. We provide a unified point-of-sale, payments, and AI operations platform for retail, hospitality, and related industries.

2. Personal Information We Collect

We collect personal information only where reasonably necessary for the purposes described in this policy. This may include:

From prospective and existing customers

• Name, surname, and job title
• Business name and registration details
• Email address and telephone number
• Physical and postal address
• Banking and payment information (processed through regulated payment partners)
• Monthly card turnover and transaction data
• Industry and business type

From users of the Nexo platform

• Login credentials (username; passwords are stored in hashed form only)
• Device identifiers and IP addresses
• Usage logs, audit trails, and session data
• Video footage processed through Nexo Vision (where enabled) — retained and managed by the customer as the responsible party for their staff and premises data

From visitors to nexo.app

• Browser type, pages visited, and referring URL (via Google Analytics)
• Demo request form submissions (name, business, email, phone, industry, turnover range)

3. How We Collect Personal Information

• Directly from you when you complete a demo request, onboarding form, or contract
• Through your use of the Nexo platform and its API integrations
• Automatically via cookies, analytics tools, and server logs on our website
• From third parties such as payment processors, banks, and business registries, where you have authorised this

4. Why We Process Your Personal Information

We process personal information for the following purposes:

• Service delivery: To set up, manage, and support your Nexo account and platform
• Payments processing: To facilitate card transactions and reconciliations through our banking partners
• Sales and onboarding: To respond to demo requests and onboard new customers
• AI operations (Nexa): To generate insights, alerts, and recommendations based on your business data
• Security and fraud prevention: To detect and prevent unauthorised access and fraudulent transactions
• Legal and regulatory compliance: To meet obligations under POPIA, the Financial Intelligence Centre Act (FICA), and applicable payment industry regulations
• Communication: To send service updates, invoices, and (with your consent) relevant product news
• Product improvement: To analyse usage patterns and improve the platform (using aggregated or anonymised data where possible)

5. Legal Basis for Processing

We rely on the following grounds under POPIA to process your personal information:

• Contractual necessity: Processing required to perform our agreement with you
• Legal obligation: Processing required by South African law (e.g. FICA, tax legislation)
• Legitimate interest: Processing that serves our legitimate business interests and does not override your rights (e.g. fraud prevention, platform security, analytics)
• Consent: Where we rely on consent (e.g. marketing emails), you may withdraw it at any time without affecting prior processing

6. Sharing Your Personal Information

We do not sell your personal information. We share it only in the following circumstances:

• Service providers (operators): Hosting providers, payment processors, banking partners, and software vendors who process data on our behalf under written agreements that impose equivalent POPIA obligations
• Payment network partners: Banks and card scheme participants required to process your transactions
• Legal and regulatory authorities: Where required by law, court order, or to protect the rights and safety of Nexo, its customers, or the public
• Business transfers: In the event of a merger, acquisition, or sale of assets, subject to confidentiality undertakings

7. Cross-Border Transfers

All primary data processing and storage for Nexo takes place on South African soil. We are committed to keeping your data on-shore wherever possible.

Some third-party services we use (such as Google Analytics) may process data outside South Africa. Where such transfers occur, we ensure adequate safeguards are in place as required by section 72 of POPIA, including standard contractual clauses or equivalent protections.

8. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. General guidelines:

• Customer account data: Duration of the contract, plus 5 years after termination (in line with general commercial record-keeping obligations)
• Transaction records: 5 years, as required by FICA and tax legislation
• Demo request submissions: 12 months if no contract results
• Website analytics: 14 months (Google Analytics default retention period)
• Security logs: 12 months

On expiry of the applicable retention period, personal information is securely deleted or anonymised.

9. Security

We implement appropriate technical and organisational measures to protect your personal information against loss, unauthorised access, disclosure, alteration, or destruction. These include:

• Encryption of data in transit (TLS) and at rest
• Role-based access controls and least-privilege principles
• Regular security testing and vulnerability assessments
• Incident response procedures with notification obligations as required by POPIA

No method of electronic transmission or storage is completely secure. We will notify the Information Regulator and affected data subjects of any security compromise as required by law.

10. Cookies and Analytics

Our website uses cookies and Google Analytics to understand how visitors use the site. This includes collecting your IP address and browsing behaviour in anonymised or pseudonymous form. You can control cookies through your browser settings. Disabling analytics cookies will not affect your ability to use the site.

11. Your Rights Under POPIA

As a data subject you have the right to:

• Access: Request confirmation of whether we hold your personal information and obtain a copy
• Correction: Request that inaccurate, incomplete, or outdated information be corrected
• Deletion: Request that your personal information be deleted, subject to our legal retention obligations
• Objection: Object to the processing of your personal information on grounds relating to your particular situation
• Withdraw consent: Where processing is based on consent, withdraw it at any time
• Complain: Lodge a complaint with the Information Regulator if you believe your rights have been infringed

To exercise any of these rights, contact our Information Officer at [email protected] or [email protected]. We will respond within a reasonable time and no later than 30 days.

12. The Information Regulator

If you are not satisfied with our response, or wish to lodge a complaint directly, you may contact South Africa's Information Regulator:

13. Children's Privacy

Our platform and website are not directed at children under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently done so, please contact us immediately.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify existing customers of material changes by email. The date at the top of this page reflects the most recent revision. Continued use of our services after a change constitutes acceptance of the updated policy.

15. Contact Us