Legal Document
Privacy Policy
How we collect, use, protect, and respect your personal information.
Team Training
Table of Contents
01
Introduction
02
Audience
03
Responsible Party
04
What is Personal Information?
05
How We Collect Information
06
Purpose of Processing
07
Legal Basis for Processing
08
Cross-Border Data Transfers
09
Data Recipients
10
Data Retention
11
Security Safeguards
12
Your Rights
13
Children's Information
14
Third-Party Links
15
NFC Hardware vs Digital
16
Changes to This Policy
Section 01
Welcome to Our Privacy Policy
The purpose of this policy is to describe:
What We Cover
- The types of personal information we collect
- How and why we use it
- Who we share it with
- How long we retain it
- Your rights under law
Legal Alignment
- Protection of Personal Information Act, 4 of 2013 (POPIA)
- General Data Protection Regulation (EU) 2016/679 (GDPR)
- FSCA Joint Communication 2 of 2025 (Cloud Computing & Offshoring of Data)
Section 02
Who This Policy Applies To
This policy applies to you if you are any of the following:
Member of the Public
A member of the public who taps an NFC card or scans a QR code to view a digital profile.
Product Customer
A customer who has purchased NFC business cards, NFC phone tags, or related products from us.
Digital Subscriber
A subscriber to our digital business card service (optional add-on at R49/month).
Corporate Client
A corporate client managing a team of NFC card users under a company account.
Section 03
Who This Policy Applies To
ProfileMe (Pty) Ltd — Trading as NFC Cards South Africa
We are the Responsible Party under POPIA and a Controller under GDPR.
Information Officer
Reach our appointed Information Officer at: hello@nfccardsouthafrica.co.za
Information Regulator
Lodge a complaint with the Regulator at: inforeg@justice.gov.za
Section 04
What Is Personal Information?
The purpose of this policy is to describe:
What Is Included
- Information we collect automatically when you visit our website
- Information you provide when ordering NFC cards, phone tags, or digital subscriptions
- Information submitted through contact forms, support requests, or custom branding uploads
- Information collected when you create a digital business card profile
- Optional information that you provide voluntarily
What Is Excluded
- Information that has been anonymised so that it no longer identifies a person
- Permanently de-identified information that cannot reasonably be linked back to a person
- Non-personal statistical information
Section 05
How We Collect Information
We collect personal information through the following touchpoints:
Product Orders
When you purchase NFC business cards, phone tags, or custom branded products — we collect your name, email, delivery address, and payment details.
Custom Branding Uploads
When you upload your logo or branding assets for custom NFC cards or bulk tags, we process these files to prepare your order.
Digital Business Card Setup
If you subscribe (R49/month), you provide your name, job title, company, contact details, profile photo, cover image, and social links.
NFC Taps & QR Scans
When someone taps your NFC card or scans your QR code, we log IP address, device type, browser, timestamp, and geographic location (country/city only).
Contact & Support Forms
When you contact us via our website, email, or WhatsApp for support, quotes, or general enquiries.
Browser Activity & Cookies
We automatically receive limited usage information such as IP address and device/browser details. See our Cookie Policy for full details.
Section 06
Purpose of Processing
We may process your personal information for the following clearly defined purposes:
- Fulfil product orders— processing, packaging, and shipping NFC business cards, phone tags, and custom branded products to your delivery address.
- Process custom branding— reviewing, preparing, and printing your logo on custom NFC cards or bulk tags.
- Deliver digital business card services (optional)— hosting your digital profile, enabling NFC taps and QR scans, providing analytics, lead capture, and WhatsApp integration.
- Manage your account— providing login access, order history, support, and administration for digital business card subscribers or corporate team accounts.
- Enable communication— sending order confirmations, shipping updates, product setup instructions, support responses, or newsletters (where consented).
- Ensure compliance— meeting legal obligations, tax requirements, or regulatory requests.
- Improve our products and services— through aggregated, anonymised analytics to understand product usage and customer preferences.
- Provide customer support
We do not sell your data. Your personal information is used only for the purposes stated above and is never sold to third parties.
Section 07
Legal Basis for Processing
Consent
For publishing a public digital business card profile, sending marketing newsletters, or using optional digital features.
Contract
To perform our obligations when you purchase NFC products or subscribe to digital business card services.
Legitimate Interest
To maintain security, improve products and services, respond to customer enquiries, and provide analytics.
Legal Obligation
Where law requires us to keep certain records — e.g. tax, accounting, and consumer protection requirements.
Section 08
Cross-Border Data Transfers
CDN — Public Content Only
Public-facing digital business card profiles are delivered via a global CDN. The CDN only caches and serves static, non-confidential content (profile text, images, layout files). No private or sensitive personal information is stored or distributed through the CDN.
Core Application Data
Order details, customer accounts, payment information, authentication data, databases, and APIs are hosted and processed within secure cloud environments subject to strong contractual and technical safeguards.
How We Ensure Compliance
- Using reputable cloud service providers under binding data processing agreements
- Applying recognised cross-border transfer mechanisms where required
- Implementing appropriate technical and organisational security measures
- Full alignment with POPIA, GDPR, and FSCA requirements
Section 09
Who We Share Data With
| Recipient | Purpose | Data Shared |
|---|---|---|
| Service Providers | Cloud hosting, email, customer support, related services | Bound by contracts and Data Processing Agreements |
| Payment Processors | Securely process credit card, debit card, or EFT payments | Payment details only (via PCI-DSS compliant processors) |
| Courier & Delivery Partners | Fulfil shipping of NFC cards and phone tags | Name, delivery address, phone number, order details only |
| Printing & Production Partners | Manufacture custom branded NFC cards and bulk tags | Logo, branding assets, and order specifications only |
| Authorities | Where required by law or regulation | Tax authorities, law enforcement, regulatory bodies |
Section 10
Data Retention
We retain personal information only as long as necessary to fulfil the purposes for which it was collected, unless a longer retention period is required by law.
| Data Type | Retention Period | Reason |
|---|---|---|
| Order Records (NFC cards, phone tags) | At least 5 years | South African tax and consumer protection law |
| Digital Business Card Profile Data (optional) | While subscription is active; deleted/anonymised within 30 days after cancellation | Service delivery; data minimisation |
| Custom Branding Files (logos, designs) | Duration of relationship; deleted upon request or within 1 year of account closure | Future orders or reprints support |
| Analytics & Usage Logs | While subscription is active, then anonymised | Aggregated analytics may be retained indefinitely |
| Marketing Lists & Newsletters | Until you unsubscribe | Consent-based processing |
| Support & Inquiry Records | 3 years | Customer service and dispute resolution |
Section 11
Security Safeguards
We use industry-standard security measures to protect your personal information:
Encryption in Transit
Encryption at Rest
Strict Access Controls
Reputable Cloud Providers
Security Audits & Incident Response
Payment Security
Section 12
Your Rights
Under POPIA and GDPR, you have the following rights regarding your personal information:
Right of Access
Request a copy of the personal information we hold about you.
Right to Correct or Delete
Update inaccurate information or request deletion of your data (subject to legal retention requirements).
Right to Object
Object to processing in certain circumstances — e.g. for marketing purposes or where processing is based on legitimate interest.
Withdraw Consent
Unsubscribe from marketing emails or deactivate your digital business card profile at any time.
Data Portability
Request a copy of your data in machine-readable format where applicable (GDPR right)
Lodge a Complaint
Contact the Information Regulator at inforeg@justice.gov.za if you believe we have violated your privacy rights.
We may require you to verify your identity before actioning a request.
To exercise any of these rights, contact our Information Officer at hello@nfccardsouthafrica.co.za
Section 13
Children's Information
Our website and digital business card profiles may contain links to third-party websites, social media platforms, or external services such as LinkedIn, Instagram, WhatsApp, and Calendly.
We are not responsible for the privacy practices of third-party websites or services. We encourage you to review the privacy policies of any third-party sites you visit before providing any personal information.
Section 14
Third-Party Links & Services
Our Services Are Not Directed at Children Under 18
We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected information from a child under 18, we will delete it promptly. If you believe a child has provided us with personal information, please contact us immediately at hello@nfccardsouthafrica.co.za.
Section 15
NFC Card Hardware vs Digital Services
Hardware Products
When you purchase NFC business cards, NFC phone tags, or custom branded products (no subscription required), we collect:
- Order history and shipping tracking information
- Your logo or branding files (for custom products only)
- Your name, email, delivery address, and payment details (to fulfil your order)
Hardware products include a free vCard that works standalone without any subscription. We do not collect data from vCard taps unless you separately subscribe to the digital service. Digital Business Card Service
- Profile information: name, job title, company, bio, photo, cover image, social links
- Analytics data: IP address, device type, browser, timestamp, location (when tapped/viewed)
- Lead form submissions (if you enable lead capture forms on your profile)
This data is retained only while your subscription is active and is deleted or anonymised within 30 days after cancellation. Section 16
Changes to This Policy
We may update this Policy from time to time to reflect changes in our practices, legal requirements, or service offerings. The updated version will always be available at nfccardsouthafrica.co.za/privacy-policy.
We will notify you of material changes by:
- Posting a notice on our website
- Sending an email to registered customers (if we have your email address)
- Displaying a prominent notice in your account dashboard (for digital business card subscribers)
Continued use of our services after updates means you accept the revised terms. If you do not agree, please discontinue use of our services and contact us to delete your account.