Privacy Policy

1. Introduction

Nexcard (“Nexcard”, “we”, “us” or “our”) provides digital business cards, smart NFC cards, QR-code sharing, digital profiles, lead capture, contact scanning, team administration, analytics and related services (the “Services”). This Privacy Policy explains how we process personal data when you visit our website, create or view a Nexcard profile, buy an NFC product, submit information through a lead form, use a team account, contact support or otherwise interact with us.

Nexcard intends to process personal data in accordance with the Personal Data Protection Act, 2022 (Cap. 44) and the Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023, together with other applicable laws of Tanzania.

2. Roles: Controller and Processor

For information about website visitors, customers, account holders, purchases, subscriptions, support requests and Nexcard’s own marketing, Nexcard generally acts as the data controller because it determines why and how the information is processed.

For lead/contact information that a business or organisation captures, imports or manages through Nexcard for its own purposes, that organisation may be the data controller and Nexcard may act as its data processor. In that situation, requests about the organisation’s use of your data may need to be directed to that organisation, and Nexcard will assist as required by law and any applicable data processing agreement.

3. Personal Data We May Collect

3.1 Information you provide

• Account data: name, username, email address, phone number, password or authentication credentials and account preferences.
• Digital profile data: job title, company, biography, profile photograph, logo, business address, contact details, websites, portfolio links, social-media links and other information you choose to display.
• Order and billing data: products ordered, subscription plan, billing details, delivery information, payment status and transaction references. Payment-card or mobile-money credentials may be processed directly by a payment provider rather than stored by Nexcard.
• Lead and contact data: information submitted through lead forms or captured/imported by users, such as name, organisation, role, phone number, email, notes and other business contact information.
• Team data: organisation name, administrators, members, roles, seat assignments, branding settings and account activity.
• Support and communications: messages, feedback, enquiries, complaint records and correspondence with Nexcard.

3.2 Information collected automatically

• Device and technical data such as IP address, browser type, operating system, device identifiers and approximate location derived from network information.
• Usage data such as pages viewed, profile taps/scans, QR interactions, feature usage, timestamps, referring pages and diagnostic logs.
• Cookie and similar-technology data used for essential functionality, preferences, security and—where permitted and appropriately disclosed—analytics or marketing.

3.3 Information from third parties

We may receive information from payment processors, delivery partners, authentication providers, integrations, business customers, referral partners or other services that you choose to connect. The information received depends on the third party and your settings with that service.

4. Why We Use Personal Data

• to create and manage accounts and digital business profiles;
• to provide NFC, QR, lead capture, contact management, analytics and team features;
• to process orders, subscriptions, payments, delivery and customer support;
• to authenticate users, prevent fraud, investigate abuse and secure the Services;
• to maintain, troubleshoot, analyse and improve performance and user experience;
• to communicate service notices, security alerts, billing information and important changes;
• to send marketing communications where permitted by law and subject to applicable consent or opt-out requirements;
• to comply with legal obligations, lawful requests, accounting requirements and dispute resolution;
• to establish, exercise or defend legal claims; and
• to create aggregated or de-identified statistics that do not reasonably identify an individual.

5. Lawful Basis and Fair Processing

Nexcard will collect and process personal data only for lawful, specific and legitimate purposes and will seek to process data that is adequate, relevant and not excessive for those purposes. Depending on the activity, processing may be based on consent, performance of a contract, compliance with a legal obligation, protection of legitimate interests where permitted, or another lawful basis recognised by Tanzanian law. Where consent is required, you may withdraw it, subject to lawful limits and without affecting processing already lawfully undertaken.

6. Public Digital Profiles

A core purpose of Nexcard is to help users share professional information. Information that you choose to publish on your Nexcard digital profile may be accessible to anyone who receives or discovers the relevant link, QR code or NFC tap. Public information may be copied, saved or shared by recipients outside Nexcard. You control much of the information displayed and should avoid publishing confidential, sensitive or unnecessary personal data.

7. Lead Capture and Contact Scanning

When you submit information through another user’s Nexcard lead form, that user or their organisation may receive and independently use your information. Their use is governed by their own privacy responsibilities and notices. Nexcard users must have an appropriate lawful basis and provide required notices when collecting, uploading, scanning, importing, storing or using information about other people.

8. How We Share Personal Data

Nexcard does not sell personal data merely because it operates the Services. We may disclose personal data only as reasonably necessary and lawfully permitted, including to:

• service providers that support hosting, cloud storage, email/SMS delivery, analytics, customer support, cybersecurity, payment processing, fulfilment and delivery;
• an organisation and its authorised administrators where your Nexcard profile is managed under that organisation’s team or enterprise account;
• third-party services that you intentionally connect to or direct us to use;
• professional advisers such as lawyers, auditors, insurers and accountants where necessary;
• competent courts, regulators, law-enforcement agencies or public authorities where disclosure is required or permitted by law;
• a buyer, investor, successor or relevant adviser in connection with a genuine merger, financing, restructuring or sale of all or part of the business, subject to appropriate confidentiality and legal safeguards.

Service providers are expected to process personal data only for authorised purposes and subject to appropriate contractual, confidentiality and security obligations.

9. Cross-Border Transfers

Some service providers or infrastructure used by Nexcard may be located outside Tanzania. Where personal data is transferred outside Tanzania, Nexcard will take steps required by applicable Tanzanian law, which may include assessing the destination and safeguards, using appropriate contractual protections, obtaining required approvals or consent where applicable, and maintaining records of the transfer.

10. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including to provide the Services, maintain legitimate business and security records, meet tax/accounting obligations, resolve disputes and comply with law. Retention periods vary by data type. When information is no longer required, we will delete, anonymise or securely dispose of it, subject to backup cycles and legal retention requirements.

For account and profile data, retention will generally continue while the account is active and for a limited period after closure to allow orderly deletion, security investigation, dispute handling and legal compliance.

11. Security

Nexcard uses reasonable administrative, technical and organisational safeguards appropriate to the nature and risk of the data processed. These may include access controls, authentication, encryption in transit where supported, secure development practices, backups, logging, vendor controls and incident response procedures. No internet service is completely secure, so we cannot guarantee absolute security. Users are responsible for using strong credentials and protecting account and administrative access.

12. Personal Data Breaches

If Nexcard becomes aware of a personal data breach, it will investigate, contain and remediate the incident and make notifications to the Personal Data Protection Commission and affected individuals where required by applicable law. Business customers must promptly inform Nexcard of security incidents affecting data processed through their accounts where Nexcard’s assistance may be required.

13. Your Data Protection Rights

Subject to the Personal Data Protection Act, 2022 and applicable exceptions, you may have rights to:

• be informed about the collection and processing of your personal data;
• request access to personal data held about you;
• request correction of inaccurate or incomplete personal data;
• request erasure or destruction where the legal requirements are met;
• object to or restrict certain processing where provided by law;
• withdraw consent where processing depends on consent;
• raise concerns about certain automated decision-making where applicable;
• request information about disclosures or transfers where the law provides such rights; and
• lodge a complaint with the Personal Data Protection Commission (PDPC) or pursue other remedies available under law.

To exercise a right, contact Nexcard using the privacy contact details published below. We may need to verify your identity and authority before acting on a request. We will respond within the time required by applicable law.

14. Marketing Communications

Where permitted, Nexcard may send product updates, offers or promotional communications. You may opt out of marketing emails or messages using the unsubscribe/opt-out method provided or by contacting us. Opting out of marketing does not prevent necessary service, security, transactional or legal communications.

15. Cookies and Similar Technologies

Nexcard may use cookies, local storage, pixels or similar technologies for essential operation, session management, preferences, security, analytics and, where applicable, marketing. Non-essential technologies should be deployed in accordance with applicable consent and transparency requirements.

16. Children

Nexcard is primarily designed for professionals, businesses and organisations and is not directed to young children. We do not knowingly seek to collect children’s personal data in circumstances requiring parental or guardian consent without obtaining the required authorisation. If we learn that personal data has been collected from a child unlawfully, we will take appropriate steps to delete or otherwise lawfully handle it.

17. Third-Party Links and Integrations

Nexcard profiles can link to third-party websites, social networks, messaging applications and other services. Nexcard does not control those third parties’ privacy practices. When you leave Nexcard or interact with a third-party integration, review that provider’s privacy notice and settings.

18. Organisational Accounts

If your employer or another organisation provides or manages your Nexcard profile, authorised administrators may be able to view, create, modify, suspend or delete your profile and manage associated business information. The organisation is responsible for ensuring that its administration of employee or member information complies with applicable law and workplace/privacy obligations.

19. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in law, technology, vendors or the Services. We will post the updated version with a revised effective date and provide additional notice for material changes where required or reasonably appropriate.

20. Contact Nexcard

Privacy questions, rights requests and complaints should be directed to Nexcard through the contact details published on the Nexcard website.

21. Personal Data Protection Commission

Individuals may also contact or lodge a complaint with Tanzania’s Personal Data Protection Commission (PDPC) using the Commission’s official channels.