This policy explains what personal information Nelotec (Pty) Ltd ("we") collects through nelopay (the website, web app, mobile app and kiosk mode), why, who we share it with and your rights under the Protection of Personal Information Act (POPIA).
1. Who is responsible
For your own account (your name, email and how you use nelopay) we are the responsible party.
For the information your organisation keeps in nelopay about its customers, suppliers and employees, your organisation is the responsible party and we are its operator: we process it only to provide the service and on the organisation's instructions. Questions about that information are best sent to the organisation first.
2. What we collect
- Account details: your name, email address, job title and department, role, and a one-way hash of your password and kiosk PIN (never the password or PIN itself).
- Organisation and business details: names, addresses, VAT and registration numbers, banking details shown on documents, and logos.
- What you enter to run your business: clients and suppliers, documents, payments, products, ledger entries and, if you use payroll, employee details such as ID numbers, tax numbers, salaries and bank details.
- Subscription payments: plan, amounts, dates and PayFast references. Card details go directly to PayFast; we never receive them.
- Technical information: sign-in times, IP addresses in security logs, device and app version, and crash reports from the mobile app. Crash reports carry your user and organisation ids, not your name, email or the data you entered.
- Messages you send us, such as support emails.
3. Why we use it
- To provide the service you signed up for: your account, documents, emails you send through the app, PDFs, payroll and reports (performing our contract with your organisation).
- To keep it secure: signing you in, detecting misuse, auditing sensitive actions such as data exports and support access (legitimate interest and legal duty to protect information).
- To bill your organisation and keep our own financial records (contract and legal obligation).
- To support you, fix problems and improve the product, using crash reports and service logs (legitimate interest).
- To send service emails such as trial reminders, payment notices and security alerts. We only send marketing if you've agreed, and every marketing email lets you unsubscribe.
5. Information sent outside South Africa
Some of these providers store or process information outside South Africa (for example in the European Union or the United States). We only use providers bound by data-protection laws or agreements that give protection comparable to POPIA, as section 72 requires.
6. How we protect it
Connections are encrypted (HTTPS). Passwords and PINs are stored only as one-way hashes. Every organisation's data is kept separate and checked on every request, and team members only see the businesses they're given. Payslip PDFs can be protected with a password. On phones, sign-in tokens are kept in the device's secure storage (Keychain or Keystore).
If a breach affects your personal information, we'll tell you and the Information Regulator as POPIA requires.
7. How long we keep it
We keep your organisation's data while the account is open. When an administrator closes the organisation, it stays read-only for 30 days so you can export it, then nobody can sign in.
After closure we keep the data only as long as the law requires or allows (South African tax law generally requires business records to be kept for five years) and then delete it. If you need it deleted sooner and the law allows, ask us.
When a team member deletes their own account, their name, email, password and PIN are removed straight away; records they created stay with the organisation.
We keep our own billing records for as long as tax law requires.
8. Your rights
You can ask what personal information we hold about you, ask us to correct or delete it, or object to how we use it, by emailing privacy@nelopay.co.za. We'll answer within 30 days. You can see and correct your own profile in the app at any time, and delete your account from Profile.
If you're not happy with our answer, you can complain to the Information Regulator (South Africa) at inforeg.org.za.
9. Mobile app, cookies and tracking
The nelopay app doesn't use advertising or tracking SDKs, and doesn't access your location, contacts, camera or photos. It stores only what it needs to keep you signed in, in the device's secure storage.
The web app uses one essential cookie to keep you signed in securely, and records that you've seen the cookie notice. We don't use advertising cookies.
10. Children
nelopay is a business service for people aged 18 and over. We don't knowingly collect information about children, other than what an organisation records about its own employees.
11. Changes and contact
If we change this policy in a way that matters, we'll email administrators before the change applies. The date at the top shows when it last changed.
Nelotec (Pty) Ltd, 1065 Spoonwood Street, Techno Park, Centurion, South Africa. Information Officer: Bogadi Naledi. Privacy questions and requests: privacy@nelopay.co.za.