Legal
Privacy policy
Last updated: 29 October 2026
1. Who we are
This policy explains how Nexed (Pty) Ltd (registration number 2022/502097/07) ("we", "us") processes your personal information when you visit nexed.works or buy from our store at store.nexed.works (together, the "Site"). We are the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA).
We only process personal information lawfully, for specific purposes, and to the minimum extent needed for those purposes.
Our details
- Registered address: 1 Mount Quray Street, Co-work at Midstream, Midlands Office Park West, Midstream, Midstream Estate, Gauteng, 1683, South Africa
- Email: [email protected]
- Information Officer: Duncan Dean, reachable at [email protected]
This policy applies to customers, account holders, newsletter subscribers and visitors to the Site. It does not cover third-party websites we link to.
2. What we collect
We collect only what we need to sell and deliver products, run your account and keep the Site working. Most of it comes from you directly; some is generated when you use the Site.
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Name, email, phone number | You, at checkout or sign-up |
| Delivery and billing | Delivery and billing address, company name and VAT number (if given) | You, at checkout |
| Account | Username, hashed password, order history, saved addresses | You and our store system |
| Orders and payments | Items bought, amounts, payment method, payment status, transaction references | You, our payment providers |
| Communications | Support emails, messages, warranty or return requests | You |
| Marketing | Newsletter subscription status and consent record | You, when you opt in |
| Technical and usage | IP address, browser and device type, pages viewed, referring site, cookie identifiers | Your browser, automatically |
We do not collect or store full card numbers, CVV codes or bank login details. We do not intentionally collect special personal information (such as health, religion or biometric data).
3. Why we use it and our lawful basis
Each use below rests on one of the grounds in section 11 of POPIA. Supplying information is voluntary, but without the details needed to process and deliver an order we cannot complete it.
| Purpose | Lawful basis (POPIA s11) |
|---|---|
| Process, deliver and support your orders, returns and warranty claims | Performance of a contract with you |
| Create and run your customer account | Performance of a contract; your consent |
| Take and confirm payment, prevent fraud | Performance of a contract; our legitimate interests |
| Keep tax, VAT and accounting records | Legal obligation |
| Send service messages (order confirmations, shipping updates) | Performance of a contract |
| Send our newsletter and product news | Your consent (see section 6) |
| Understand how the Site is used and improve it | Our legitimate interests; your consent for non-essential cookies |
| Protect the Site against abuse and attacks | Our legitimate interests |
We will not use your information for a purpose incompatible with the one it was collected for without telling you and, where required, asking for your consent.
4. Payments
We never see or store your full card or bank login details. How your payment data is handled depends on the method you choose.
- Card and instant EFT are processed by Payfast. You enter payment details on their secure page, and they process them under their own privacy policy and PCI DSS obligations. We receive the payment status, amount and a transaction reference.
- Bitcoin payments are handled by our own self-hosted BTCPay Server; no third-party payment processor sees your order. Bitcoin transactions are recorded on a public blockchain. We link the transaction or invoice reference to your order, but do not publish that link. If you request a refund, we will ask for a Bitcoin address or Lightning invoice to pay it to.
- Manual EFT (bank transfer): you pay into our bank account directly. We see the name, reference and amount that your bank shows on our statement, and use it only to match payment to your order.
5. Cookies and analytics
We use strictly necessary cookies to run the store, and analytics only as described below. You can block or delete cookies in your browser, but the cart and checkout will not work without the necessary ones.
| Type | What it does | Examples |
|---|---|---|
| Strictly necessary | Keeps your cart, login session and checkout working; protects against attacks | WooCommerce cart and session cookies, WordPress login cookies, Cloudflare security cookies |
| Analytics | Tells us which pages are visited and how people find the Site | Plausible: cookieless, no personal profile |
We do not use advertising or cross-site tracking cookies, and we do not sell your information.
6. Newsletter and marketing
We send marketing emails only to people who have opted in, or to customers about our own similar products as section 69(3) of POPIA allows. We never treat silence or a pre-ticked box as consent.
- Subscribers join by ticking an unticked box or signing up on a form. We record when and how you consented.
- Customers: if you bought from us, we may email you about similar products of ours. You can object when you give us your email at checkout, and in every email after that.
- Unsubscribing is free and takes one click via the link in every email, or an email to [email protected]. We stop within 5 business days and keep a minimal record so we don't email you again.
Our newsletter is sent through Mailpro. Order and shipping emails are not marketing and are sent regardless of your newsletter choice.
7. Who we share it with
We share personal information only with service providers ("operators") who need it to do work for us, and with authorities when the law requires. Operators may process it only on our instructions and must keep it secure, as sections 20 and 21 of POPIA require.
| Recipient | Why | Where |
|---|---|---|
| Rackzar | Hosts the Site and store database | South Africa |
| Cloudflare | Delivers the Site, blocks attacks, sees IP addresses and requests | Global network, USA-headquartered |
| Payfast | Processes card and instant EFT payments | South Africa |
| The Courier Guy | Delivers your order (name, address, phone) | South Africa |
| Mailpro | Sends order and marketing emails | Switzerland |
| Plausible Analytics (CE) | Site usage statistics | Self-hosted by us, South Africa |
| Wingman Accounting, SARS and other authorities | Tax, accounting and legal compliance | South Africa |
Transfers outside South Africa. Some providers above process information outside South Africa. We transfer it only where section 72 of POPIA allows: the recipient is bound by law, binding corporate rules or an agreement giving protection substantially similar to POPIA, or the transfer is needed to perform our contract with you, or you have consented.
We do not sell, rent or trade your personal information.
8. Security
We take reasonable technical and organisational measures to protect your information against loss, damage and unauthorised access, as section 19 of POPIA requires. These include:
- encryption in transit (HTTPS/TLS) across the whole Site
- passwords stored only as salted hashes
- access to customer data limited to people who need it, with strong authentication
- regular software updates and encrypted backups
- network-level protection against attacks
No system is perfectly secure. If we have reasonable grounds to believe your information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible, as section 22 of POPIA requires, and tell you what we are doing about it.
9. How long we keep it
We keep personal information only as long as we need it for the purpose it was collected, or as long as the law requires (section 14 of POPIA). Then we delete or de-identify it.
| Information | Kept for |
|---|---|
| Order, invoice and payment records | 7 years after the transaction (Companies Act and Tax Administration Act) |
| Customer account | Until you close it, then order records as above |
| Support and warranty correspondence | 2 years after the matter is closed, or longer if a claim is open |
| Newsletter subscription and consent record | While you are subscribed, plus a suppression record after you unsubscribe |
| Server and security logs | 90 days |
| Analytics data | 90 days |
10. Your rights
Under POPIA you have the right to:
- know whether we hold personal information about you and get a copy of it (section 23)
- ask us to correct, update or delete information that is inaccurate, out of date, excessive or unlawfully held (section 24)
- object to processing based on our legitimate interests, and to direct marketing at any time (section 11(3))
- withdraw consent you have given, without affecting processing done before you withdrew it
- complain to the Information Regulator
To exercise any of these, email our Information Officer at [email protected]. Objections and requests for correction or deletion are free. We may ask you to verify your identity first, and will respond within a reasonable time, normally 30 days.
Information Regulator (South Africa)
- Website: inforegulator.org.za
- Complaints: [email protected]
- General enquiries: [email protected]
We'd appreciate the chance to resolve your concern first, but you may go to the Regulator directly.
11. Children, changes and contact
Children. The Site is not aimed at people under 18, and we do not knowingly collect their personal information. If you believe a child has given us information, contact us and we will delete it.
Changes. We may update this policy as our services or the law change. The date at the top shows the latest version, and we will tell account holders by email about material changes.
Contact. Questions about this policy or your information: [email protected], or write to our Information Officer at the address in section 1.