Data protection (POPI Act)
Last updated: 2 October 2026
Nexa Webdesign CC (registration 2010/102988/23) supports the Protection of Personal Information Act 4 of 2013 (POPIA). This notice explains how we process personal information as a responsible party for our own business, and as an operator when we host websites and mail or archive mail on behalf of our clients.
Information officer
Our information officer is Phillip van Niekerk, Managing Director. Requests, questions and complaints about personal information can be sent to hello@nexawebdesign.com.
What we collect and why
- Client and contact details: names, email addresses, telephone numbers, company details and billing information, used to deliver and invoice our services and to answer enquiries sent through this website.
- Technical data: IP addresses, browser type and server logs, used to run and secure our servers and to investigate abuse.
- Hosted content: websites, databases and mailboxes that clients place on our servers. We process this only to provide the hosting service and do not read or use it for any other purpose.
- Archived mail: for clients who subscribe to the Nexa Mail Archive, a copy of every message sent and received on the archived domain, kept for the retention period chosen by the client (5 years by default). The client is the responsible party for this mail; Nexa is the operator.
Lawful basis
We process personal information to perform a contract with the client, to comply with legal obligations such as tax and company law, and where we have a legitimate interest in running secure and reliable services. We ask for consent where the law requires it, for example before sending marketing email, and consent can be withdrawn at any time.
Where information is kept
Our servers are located in a data centre in South Africa. Encrypted off-site backup copies are kept for disaster recovery. We do not sell personal information and we do not transfer it outside South Africa except where a client instructs us to, or where a backup provider stores encrypted copies under contractual safeguards that meet section 72 of POPIA.
Operators and third parties
We use a small number of suppliers to provide our services, such as data centre, domain registration, SSL certificate and backup providers. Each is bound by agreement to process information only on our instructions and to keep it secure. We disclose personal information to authorities only where the law requires it.
Security
We protect information with firewalls, access control, encryption in transit, audit logging and regular patching. Access to hosted content and archived mail is limited to the people who need it to provide the service, and every access to the Mail Archive is logged. Should a security compromise affect personal information, we will notify the Information Regulator and affected clients as required by section 22 of POPIA.
Retention
We keep client account and billing records for as long as the client relationship lasts and for five years afterwards, as required by tax and company law. Hosted content is deleted when a hosting service is cancelled, after a grace period. Archived mail is deleted automatically when it is older than the retention period agreed with the client, unless a legal hold applies. Server logs are kept for 90 days.
Your rights
Under POPIA you may ask us whether we hold personal information about you, request a copy of it, ask that it be corrected or deleted, object to its processing, and complain to the Information Regulator. Requests should be sent to the information officer at the address above. We will respond within a reasonable time and may ask for proof of identity before releasing information. Where we act as an operator for a client, we will refer the request to that client and assist them in responding.
The Information Regulator can be contacted at inforegulator.org.za or complaints.IR@justice.gov.za.
Changes
We may update this notice from time to time. The date at the top shows when it was last changed.