Privacy Policy
NebOS is committed to protecting your personal information in accordance with the Protection of Personal Information Act, 4 of 2013 (POPIA), the Promotion of Access to Information Act, 2 of 2000 (PAIA), and all applicable South African data protection legislation.
1. Who we are
NebOS (operated by [Company Name (Pty) Ltd], registration number [______], South Africa) is a South African insurance and broker management platform. Each brokerage or funeral parlour using NebOS ("Tenant") is the Responsible Party for the personal information of its own clients, members, and policyholders, and determines the purpose and means of processing that information. NebOS acts as an Operator under POPIA when processing personal information on a Tenant's behalf, and as a Responsible Party for information about Tenant staff, billing contacts, and platform usage.
2. What we collect
Depending on how the platform is used, we (or the Tenant, using our platform) collect: identifying information (full name, SA ID/passport number, date of birth, contact details, next-of-kin details); financial information (banking details, premium and payment history, claims amounts); policy and underwriting information (cover details, dependants, beneficiaries, medical or cause-of-death information for claims and funeral cases); employment and payroll information for Tenant staff; and technical information generated through platform use (login activity, audit logs, device and browser information, cookies).
3. Special personal information
Funeral and claims processing may involve special personal information as defined in POPIA section 26, such as health information (e.g. cause of death) or, in limited cases, information relating to criminal behaviour. This information is processed only where necessary to assess or pay a claim, administer a policy, or comply with a legal obligation, and is subject to additional access restrictions within the platform.
4. Why we process it
Personal information is processed to: create and administer insurance policies, funeral plans, and claims; verify identity and prevent fraud and money laundering (FICA); process premium collections and payouts; communicate with policyholders, members, and beneficiaries (including SMS/email/WhatsApp notifications); comply with legal and regulatory obligations (FAIS, FSCA, FICA, SARS, the Long-Term Insurance Act); and improve the security, reliability, and functionality of the platform.
5. Direct marketing
Where a Tenant sends you direct marketing communications via the platform, this is done in accordance with POPIA section 69 and the Electronic Communications and Transactions Act, 25 of 2002 (ECTA). You may opt out of direct marketing at any time using the unsubscribe link provided, or by contacting the relevant Tenant or our Information Officer directly.
6. Who we share it with
Personal information may be shared with: insurers, underwriters, and reinsurers to fulfil policy and claims obligations; payment processors and banks for premium collection and claim payouts (e.g. PayAt, DebiCheck); SMS/email service providers for transactional notifications (e.g. Africa's Talking, Resend); regulators and law enforcement where required by law; and sub-processors providing cloud hosting and infrastructure (e.g. Supabase, Vercel), under written data processing agreements that require POPIA-equivalent protections.
7. Cross-border transfers
Some service providers (such as cloud hosting and email infrastructure) may process information outside South Africa. Where this occurs, we ensure the recipient is subject to a law, binding corporate rules, or agreement that provides an adequate level of protection substantially similar to POPIA, in accordance with POPIA section 72.
8. How we protect it
We implement technical and organisational safeguards including encryption in transit and at rest, role-based access control, branch- and tenant-level data isolation (row-level security), multi-factor authentication for administrative accounts, audit logging, and regular security reviews. Despite these measures, no system can be guaranteed 100% secure.
9. Data breach notification
If we become aware of a security compromise that has affected your personal information, we will notify the affected Tenant(s) and, where required by POPIA section 22, the Information Regulator and affected data subjects, as soon as reasonably possible.
10. Your rights under POPIA
Subject to applicable exceptions, you have the right to: be notified that your information is being collected; access the personal information held about you; request correction, deletion, or destruction of inaccurate, irrelevant, excessive, or unlawfully obtained information; object to processing of your personal information, including for direct marketing; and lodge a complaint with the Information Regulator (South Africa) at enquiries@inforegulator.org.za. To exercise these rights, contact the Tenant directly (for client/member data) or our Information Officer at privacy@nebos.co.za.
11. Retention
We retain personal information for as long as necessary to fulfil the purposes outlined above and to meet legal and regulatory record-keeping requirements — typically a minimum of five years for FICA/insurance records and seven years for financial records, in line with SARS and FSCA requirements. Funeral case records, including next-of-kin and beneficiary details, are retained for the statutory minimum applicable to insurance and funeral policy records.
12. Children's information
Funeral and family policies commonly include minor dependants as beneficiaries. Information about minors is collected and processed only with the consent of, or at the instruction of, a competent person (parent or legal guardian) as contemplated in POPIA section 35, and only to the extent necessary to administer the relevant policy.
13. Cookies and similar technologies
The platform uses essential cookies required for authentication and session management, and may use additional cookies for analytics and security monitoring (e.g. error tracking via Sentry). We do not use cookies for third-party advertising.
14. Changes to this policy
We may update this policy from time to time to reflect changes in law, regulation, or our processing activities. Material changes will be communicated via the platform. Continued use after changes constitutes acceptance.
Contact our Information Officer
For privacy enquiries, subject access requests (PAIA), or to exercise your POPIA rights:
privacy@nebos.co.za
If you are not satisfied with our response, you may lodge a complaint with the Information Regulator (South Africa): enquiries@inforegulator.org.za, JD House, 27 Stiemens Street, Braamfontein, Johannesburg.