Last updated: [date you publish this policy]
Text in [square brackets] needs your details before you publish. This policy was prepared to reflect how the website works; have it reviewed against your own legal advice.
1. Who we are
This policy explains how NxtLvl ([registered company name and registration number]) (“we”, “us”) collects, uses and protects personal information when you visit nxtlvl.africa, sign in, enquire, or use our customer area. We are the responsible party under the Protection of Personal Information Act, 2013 (POPIA).
Contact: hello@nxtlvl.africa · 083 454 8150 · Hyde Park, Sandton, Johannesburg. Information Officer: [name], [email address].
2. Information we collect
- When you contact us or ask about a package: your name, email address, phone number, business name, the package or service you’re interested in, your answers to the enquiry questions, and the page you sent it from.
- When you sign in: your email address and, if you use “Continue with Google”, the name and verified email address Google shares with us. We never receive your Google password. We also keep the date you joined, when you last signed in, and your member level.
- Profile details you choose to share: such as your role, business size and the services you’re interested in.
- If you are a customer: your answers to our business goals questions (which may include revenue ranges and budgets); artwork we send for your approval, with your comments and decisions; quotations, the option you approve and the name you type to approve it; software licenses we manage for you, including license keys; your brand details (logo, colours and website address); and links to files we share with you.
- Technical information: pages visited, device and browser type, and approximate location (country or region), collected through cookies as described in section 4.
3. How we use it, and why we’re allowed to
- To reply to enquiries and prepare quotes (steps you asked us to take before a contract).
- To deliver our services and manage projects, approvals, licenses and renewals (performing our contract with you).
- To keep your account and our systems secure, and to keep records we are required by law to keep (legal obligation and legitimate interests).
- To understand how our website is used and improve it (legitimate interests, and your consent where the law requires it).
- To send you marketing only if you agreed to it, or if you are an existing customer and the message is about similar services; you can opt out at any time (POPIA section 69).
4. Cookies and analytics
We use Google Tag Manager and Google Analytics to measure how visitors use the site. What happens depends on where you are:
- In the European Economic Area, the United Kingdom and Switzerland: analytics and advertising cookies stay off until you choose.
- Everywhere else, including South Africa: analytics cookies are on so we can count visits and see which pages help people. Advertising cookies stay off unless you choose “Accept all”.
You choose in the cookie banner: Accept all (analytics and advertising), Analytics only, or Essential only (no analytics or advertising cookies). Change your choice at any time with Cookie settings at the bottom of every page. When cookies are off, Google may still receive basic, cookieless signals (such as that a page was viewed) that don’t identify you.
We also use Microsoft Clarity to see, in aggregate, where people click and scroll (heatmaps) and to replay visits so we can fix confusing pages. Clarity follows the same choices: it runs only when analytics is allowed, and visitors in the EEA, UK and Switzerland are not tracked with cookies until they accept. Text in sign-in, account, customer and admin areas is hidden in recordings, and what you type in forms is masked.
Essential storage, which the site needs to work, is always on: a sign-in cookie (kept for up to 30 days), a short-lived security cookie used during Google sign-in (10 minutes), and settings saved in your browser such as light or dark mode, your cookie choice and your member progress.
5. Who we share it with
We don’t sell personal information. We use trusted service providers (operators) who process it for us under agreements that require them to protect it:
- Netlify hosts the website, receives form submissions and stores customer-area data and uploaded files.
- Google provides “Continue with Google” sign-in, Tag Manager and Analytics.
- Microsoft provides Clarity heatmaps and visit recordings (with private areas masked).
- [Your email provider] sends sign-in links and notifications from hello@nxtlvl.africa.
- Microsoft OneDrive hosts files we share with customers; access is controlled by your email address.
Some of these providers store information outside South Africa, including in the United States and the European Union. We only use providers bound by data protection rules or agreements that give your information a level of protection comparable to POPIA (section 72).
6. How long we keep it
- Enquiries that don’t become projects: [24 months] after our last contact.
- Member accounts and profiles: until you ask us to delete them, or after [24 months] without sign-in.
- Quotations, approvals and records of work: as long as the law requires for business and tax records (generally at least five years).
- License details: while we manage the license for you, and as required for records afterwards.
7. How we protect it
The site uses encrypted connections (HTTPS). Sign-in is passwordless and sessions are cryptographically signed. Customer-area information, uploaded artwork, logos and license keys can only be seen by that customer and by our admins. No method is completely secure, but we take reasonable steps and will tell you and the Information Regulator if your information is compromised, as POPIA requires.
8. Your rights
You may ask to see the personal information we hold about you, ask us to correct or delete it, object to processing based on our legitimate interests, withdraw consent, and opt out of marketing. Email hello@nxtlvl.africa. We may need to confirm your identity first. You can also complain to the Information Regulator (South Africa) at inforegulator.org.za.
9. Children
Our website and services are meant for businesses and adults. We don’t knowingly collect information from anyone under 18.
10. Changes to this policy
We may update this policy as our services change. The date at the top shows when it last changed.