Privacy Policy

Nile acts in two different capacities depending on whose information is being processed. This distinction matters because it determines who is accountable to you.

Where we are the responsible party, we determine why and how personal information is processed, and we are accountable to you directly under POPIA.

Where we are an operator, the brand you are shopping with is the responsible party. They determine why and how the information is processed, and we process it only on their documented instructions under a written Data Processing Agreement. If you wish to exercise your rights in relation to information held in a brand's Sales Assistant, your request is best directed to that brand. We will assist them in responding, and you may contact us and we will pass the request on.

Our Information Officer is Joy Des Fountain, registered with the Information Regulator, and can be contacted at legal@onnile.shop.

Because we act in two capacities, it is clearest to separate the information we hold for ourselves from the information we process for a brand.

2.1 Information we hold as responsible party
This is information about brands, the people who work at them, website visitors, creators, suppliers and our own staff.

• Name, work email address, telephone number, company name and store URL when you enquire, request a demonstration, request installation or join a waitlist
• Studio account details for the people a brand authorises to use it, including name, email address and role
• Creator records a brand loads into the Studio, being name, image, social network, handle and follower count
• Billing and payment records. Nile does not store full card details.
• Correspondence with us, and your communication preferences
• How you use onnile.shop and the Studio, including IP address, device and browser type, pages visited, time on page and referral source

2.2 Information we process for a brand, as operator
When a shopper buys from a brand through that brand's WhatsApp channel, we process the following on that brand's instructions. The brand decides why and how, and the brand is accountable for it.

• Name, WhatsApp or telephone number, email address and delivery address
• The content of the shopping conversation with the brand's Sales Assistant
• Order and transaction records
• Payment information handled by the payment provider. Neither Nile nor the brand receives full card details from us.

For shoppers: a shopper is dealing with the brand, not with Nile. The brand's own privacy notice governs that relationship. This Policy explains our part in it, and what to do if you want to reach us about it.

In accordance with section 11 of POPIA, we only process personal information where at least one of the following applies:

• you have consented to the processing
• processing is necessary to perform a contract to which you are a party, such as providing the Services to a brand, or enabling a brand to fulfil an order you placed with it
• processing is necessary to comply with a legal obligation
• processing protects a legitimate interest of yours, or
• processing is necessary to pursue our legitimate interests, or those of a brand or third party, and does not unreasonably prejudice your rights

• Provide and maintain the Services, including the Studio and the Sales Assistant technology
• Enable a brand to process orders and payments in its own WhatsApp channel, on that brand's instructions
• Communicate with you about orders, updates and, where you have consented, promotions
• Improve the Services and the Studio
• Analyse usage patterns to improve our services
• Comply with legal obligations and protect our rights

Direct marketing. Where we send you electronic marketing, we do so in line with section 69 of POPIA. If you are not an existing customer, we will only market to you where you have consented. If you are an existing customer, we may market related products to you, and every message will give you a straightforward way to opt out at no cost. We will not approach you again for consent once you have refused.

Automated processing and our Sales Assistant. Our Sales Assistant is an artificial intelligence system. It reads the messages you send, interprets what you are asking, and generates responses, product recommendations and order information automatically. This is automated processing of your personal information.

The Sales Assistant does not make decisions that produce legal consequences for you or that similarly significantly affect you. It helps you browse, answers questions and assembles an order. A person at the brand remains responsible for fulfilling that order, and you can ask to speak to a person at any point in the conversation. Your rights in relation to automated decision-making are set out in section 10.

We do not sell or rent your personal information. We may share information with:

• The brand you bought from: the brand operating the channel receives the order and conversation details, because it is the seller and it fulfils the order
• Service providers: WhatsApp and Meta, Shopify, payment processors, cloud hosting, artificial intelligence and analytics providers who process information on our behalf under written agreements, including their standard data processing terms
• Legal requirements: where required by law, regulation or a competent authority, or to protect our rights and safety
• Business transfers: in connection with a merger, acquisition or sale of assets
• Consent: where you have given explicit consent for a specific purpose

We implement appropriate technical and organisational security measures, including encryption, access controls and staff confidentiality undertakings, to protect personal information against unauthorised access, alteration, disclosure or destruction. No method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

Security compromises. If we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible after discovering the compromise, in accordance with section 22 of POPIA. Where we act as an operator for a brand, we will notify that brand without undue delay so that they can meet their own notification obligations.

We use cookies and similar technologies on onnile.shop. These fall into three categories:

We rely on our legitimate interests under section 11(1)(f) of POPIA for analytics and marketing cookies. South African law does not currently require us to obtain your prior consent before setting them, and we do not currently use a cookie consent banner. You can control or block cookies through your browser settings, and you can opt out of our analytics at any time by contacting legal@onnile.shop. Blocking strictly necessary cookies will stop parts of the site working.

If we begin offering services to people in the United Kingdom or the European Union, we will introduce a consent banner and obtain prior consent for non-essential cookies, as those jurisdictions require.

We retain personal information only for as long as necessary to fulfil the purpose for which it was collected, to meet contractual or legal obligations, or to resolve disputes. Our standard retention periods are:

These periods may be shortened on request where we are not required by law to retain the information. After the retention period, information is securely deleted or de-identified.

Some of our service providers, including the WhatsApp Business Platform and our cloud hosting and artificial intelligence providers, process information outside South Africa. Where this occurs, we take reasonable steps in line with section 72 of POPIA to ensure the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection substantially similar to POPIA, or that you have consented to the transfer.

The Services depend on third parties including the WhatsApp Business Platform operated by Meta, Shopify, social media platforms and payment processors. This Policy does not apply to those services, and we encourage you to review their own privacy notices.

Subject to POPIA, you have the right to:

• Access: request confirmation of, and access to, the personal information we hold about you
• Correction: request correction or updating of inaccurate, incomplete or outdated information
• Deletion: request that we delete or destroy personal information we are no longer authorised to retain
• Export: request a copy of the personal information you have provided to us, in a commonly used electronic format. You can export or delete your data at any time.
• Objection: object, on reasonable grounds, to the processing of your personal information
• Withdrawal: withdraw any consent you previously gave, at any time
• Automated decision-making: not be subject to a decision based solely on automated processing that affects you significantly, without an opportunity to make representations
• Complain: lodge a complaint with the Information Regulator, as set out in section 12

To exercise these rights, contact our Information Officer at legal@onnile.shop. Where the information sits inside a brand's channel and we act as operator, the brand is accountable, so we will direct your request to that brand and assist them in responding within the timeframes POPIA requires.

In line with POPIA, a child is any person under the age of 18 who is not legally competent to act on their own behalf. We do not knowingly collect personal information from children without the consent of a parent or legal guardian, being a competent person, except where permitted by law. If you believe a child has provided us with personal information without appropriate consent, please contact us so that we can take steps to delete it.

If you are unhappy with how we have handled your personal information, you may lodge a complaint with the Information Regulator (South Africa):

• Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
• Email: complaints.IR@justice.gov.za or POPIAComplaints@inforegulator.org.za
• Website: inforegulator.org.za

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated effective date. Your continued use of our services after any update constitutes acceptance of the revised Policy.

Read alongside our Terms and Conditions and our PAIA Manual.