Privacy notice

This notice explains how NEXUSFLOW TECHNOLOGIES (PTY) LTD (“Nexusflow”, “we”, “us”) handles personal information when you visit our website, contact us, or use NexusCore. We aim to handle personal information in accordance with South Africa’s Protection of Personal Information Act (POPIA).

Who is responsible for the information?

For enquiries, account administration, billing and information about our own services, Nexusflow is responsible for the personal information we collect and use. For personal information that a customer puts into NexusCore about its own clients, contacts or staff, the customer generally determines why and how that information is used. We process that workspace information to provide the service and follow the customer’s documented instructions and applicable agreement.

Information we may handle

• Names, work contact details, organisation and enquiry details you provide through a form, email or support request.
• Account, authentication, organisation membership, role and service administration information.
• Workspace information you or your organisation enter, such as client and contact records, service requests, projects, communications, tasks, time records, website details, maintenance reports, uploaded files and backup archives.
• Invoices, billing contacts, payment references and transaction status. Payment details are handled according to the payment method and its provider.
• Technical and security information generated when the website or service is used, such as IP address, request and error metadata, browser information, authentication events and audit records.

Please do not put sensitive personal information into the service unless your organisation has confirmed that it is necessary and that the service is suitable for that use.

Why we use it

We use personal information to respond to enquiries, create and administer accounts, deliver and support NexusCore, store and retrieve customer files, send service messages, handle billing, secure the service, investigate incidents, maintain records required by law, and resolve disputes. Where required, we rely on your consent; otherwise we process information where needed for a contract, a legal obligation, or a legitimate operational interest that does not override your rights.

Service providers and transfers

We use service providers to host, secure and operate the service. Depending on the feature used and the deployment configuration, these include Laravel Cloud for application hosting, Cloudflare for DNS, traffic delivery and security, Google Cloud Storage for configured document and backup storage, Resend for email delivery, and PayFast for payment flows. These providers may process information on our behalf or in their own capacity under their terms.

Service providers may process information in South Africa or other countries. The actual storage region, Cloudflare features, and applicable transfer safeguards depend on our active provider settings and agreements. We do not promise that all processing remains in South Africa.

Retention and security

We keep information for as long as needed to provide the service, meet legal and accounting requirements, maintain security records, resolve disputes and enforce agreements. Customer workspace data and backups are also subject to the applicable customer agreement and the retention settings for the relevant service. Retention periods can differ by record type and provider; contact us if you need the current schedule for a particular category.

We use technical and organisational safeguards intended to protect information. No internet service can guarantee absolute security. If a security compromise affects personal information, we will assess and respond in accordance with applicable law.

Your choices and rights

You may ask to access or correct personal information about you, or raise an objection or other request available under POPIA. Send the request to [email protected]. We may need to verify your identity and may ask you to direct a workspace-data request through your organisation’s administrator where that organisation controls the data.

If you are not satisfied with our response, you may contact the Information Regulator of South Africa.

Changes and contact

We may update this notice when our service or practices change. The date at the top shows when this version was last updated. For questions or privacy requests, contact our registered Information Officer at [email protected].