Privacy Policy

1. Introduction

Next Door Shop Holdings (Pty) Ltd and Noko Technologies (Pty) Ltd (collectively, 'we', 'us', or 'our') are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use the NDSH application (the 'App').

This Policy is compliant with the Protection of Personal Information Act, 2013 (Act No. 4 of 2013) ('POPIA') and forms part of our commitment to uphold the constitutional right to privacy.

2. Definitions

In this Policy, unless the context indicates otherwise, the following terms have the meanings given to them in POPIA:

• 'Data subject' means the person to whom personal information relates.
• 'Personal information' means information relating to an identifiable, living, natural person, and where applicable, an identifiable, existing juristic person, including but not limited to: information relating to race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language and birth; information relating to education, medical, financial, criminal or employment history; any identifying number, symbol, email address, physical address, telephone number, location information, online identifier or other particular assignment to the person; biometric information; personal opinions, views or preferences; correspondence of a private or confidential nature; the views or opinions of another individual about the person; and the name of the person if it appears with other personal information or if disclosure of the name itself would reveal information about the person.
• 'Processing' means any operation or activity concerning personal information, including collection, receipt, recording, organisation, collation, storage, updating, modification, retrieval, alteration, consultation, use, dissemination, distribution, merging, linking, restriction, degradation, erasure or destruction.
• 'Responsible party' means a public or private body or any other person which, alone or in conjunction with others, determines the purpose of and means for processing personal information.
• 'Operator' means a person who processes personal information for a responsible party in terms of a contract or mandate, without coming under the direct authority of that party.
• 'Information Officer' means the person designated in accordance with Section 55 of POPIA.

3. Who We Are

4. What Personal Information We Collect

We may collect the following categories of personal information:

5. How We Collect Your Information

We collect personal information in the following ways:

• Directly from you – when you register, log in, update your profile, or use the App.
• Automatically – through your use of the App (e.g., IP address, browser type, access times, actions performed).
• From your employer or organisation – when you are added as a user or supplier.
• From the POS system – when orders are created and processed.

6. Purpose of Processing

We process your personal information for the following purposes, which are lawful in terms of Section 11 of POPIA:

7. Lawful Grounds for Processing

We rely on the following lawful grounds for processing your personal information (Section 11 of POPIA):

• Consent – where you have given us explicit consent to process your information for a specific purpose.
• Performance of a contract – where processing is necessary to carry out actions for the conclusion or performance of a contract to which you are a party.
• Compliance with a legal obligation – where processing is necessary to comply with an obligation imposed by law on us.
• Protection of a legitimate interest – where processing protects a legitimate interest of yours.
• Performance of a public law duty – where processing is necessary for the proper performance of a public law duty by a public body (if applicable).
• Legitimate interest – where processing is necessary for pursuing our legitimate interests or those of a third party to whom the information is supplied.

You have the right to object, on reasonable grounds, to the processing of your personal information for purposes of legitimate interest (Section 11(3)(a) of POPIA).

8. Who We Share Your Information With

We may share your personal information with:

• Service Providers and Operators – who assist us in operating the App, processing orders, and providing support (subject to written contracts ensuring compliance with POPIA).
• Law Enforcement or Regulatory Bodies – when required by law or in response to a lawful request.
• Delivery and Logistics Partners – for the purposes of fulfilling orders.
• Suppliers – for the purposes of order fulfilment and quoting.

We do not sell, trade, or rent your personal information to third parties.

9. Transborder Information Flows

We may transfer personal information to third parties in foreign countries only where:

• The recipient is subject to a law, binding corporate rules, or a binding agreement that provides an adequate level of protection;
• The data subject consents to the transfer;
• The transfer is necessary for the performance of a contract; or
• The transfer is for the benefit of the data subject and it is not reasonably practicable to obtain consent (Section 72 of POPIA).

We ensure that any cross-border transfer complies with the provisions of Chapter 9 of POPIA.

10. Data Security

We implement appropriate, reasonable technical and organisational measures to secure the integrity and confidentiality of your personal information, including:

• Access controls – role-based access to personal information.
• Encryption – data in transit and at rest.
• Secure authentication – strong password policies and session management.
• Regular security assessments – to identify and address risks.
• Staff training – on data protection and security practices.
• Incident response – procedures for detecting, reporting, and investigating security breaches.

If a security compromise occurs, we will notify the Information Regulator and affected data subjects as required by Section 22 of POPIA.

11. Data Retention

We retain your personal information only for as long as necessary to achieve the purpose for which it was collected, or as required by law (Section 14 of POPIA). Retention periods are determined based on:

• The purpose of processing;
• Legal and regulatory requirements;
• Contractual obligations;
• Your consent (where applicable).

When personal information is no longer required, we will securely delete, destroy, or de‑identify it.

12. Your Rights as a Data Subject

Under POPIA, you have the following rights (Section 5 and Chapter 3 of POPIA):

13. How to Exercise Your Rights

To exercise any of your rights, please contact our Information Officer using the details below. We will respond to your request within a reasonable time and in accordance with POPIA.

14. Direct Marketing

We will only process your personal information for direct marketing purposes if you have given your consent, or if you are an existing customer and we are marketing our own similar products or services (Section 69 of POPIA). You may object to direct marketing at any time.

15. Cookies and Automated Decision-Making

We use session cookies to maintain your login state. These cookies are essential for the App to function and do not track your browsing activity outside the App. We do not use cookies for marketing or analytics purposes.

We do not make decisions based solely on automated processing of personal information that have legal consequences or substantially affect you, except as permitted by Section 71 of POPIA.

16. Children's Privacy

We do not knowingly process the personal information of children (persons under the age of 18) without the prior consent of a competent person (parent or guardian), except as permitted by Section 35 of POPIA.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and, where appropriate, by email or in-app notification.

18. Complaints to the Information Regulator

If you are not satisfied with how we have handled your personal information, you have the right to lodge a complaint with the Information Regulator:

19. Contact Us

If you have any questions about this Privacy Policy, or if you wish to exercise any of your rights, please contact us: