NUVATION BUSINESS SOLUTIONS

Privacy Policy

Version 1.0 · Effective 7 August 2026 · South Africa

This notice describes how NuVation processes personal information through its website and Business ERP. Business customers remain responsible for the personal information they choose to place in their business records.

1. Who we are and how to contact us

Jaco du Toit, a South African sole proprietor trading as NuVation Business Solutions ("NuVation", "we", "us" or "our"), provides the NuVation website and Business ERP. Privacy enquiries, objections and requests for the Information Officer must be sent to nuvationsolutions@gmail.com. You may also telephone 061 051 3710 or use our contact page for general assistance, but the Gmail address is the authoritative Information Officer channel.

Administrative and legal address: 16 Doorn Street, Potchefstroom, North West, 2531, South Africa. NuVation is online-only and does not provide ordinary walk-in support at this address. A lawful privacy or access-to-records appointment may be arranged in advance.

Information Officer: Jaco du Toit. NuVation Business Solutions is registered with the Information Regulator under organisation registration number 2026-063948. Access-to-records procedures appear in the PAIA Manual.

2. Scope and roles

This notice applies to visitors, account holders, invited users, Professionals and people whose information is entered into the Service.

A business customer generally decides why and how its customer, supplier, employee and operational records are processed. For that information, the business is generally the responsible party and NuVation acts as an operator providing the Service under the business's authority. NuVation is separately responsible for information it determines how to process for account creation, authentication, subscriptions, service security, fraud prevention, support, legal compliance and its own operations. The exact legal role depends on the context.

3. Information we process

The Service is an internal business-administration tool. It is not intended for children's, medical, biometric, criminal-record or credit-reporting information. Do not enter passwords, complete payment-card details, special personal information or information you are not authorised to process. If a business considers using records from the Service for regulated, legal, tax, credit, medical or other sensitive reporting, it must first have the source information and intended use independently vetted for lawfulness and accuracy.

4. Required and optional information

A confirmed account email, authentication credential, profile type, required agreement acceptance and the information needed to establish or join the correct business are mandatory for the relevant account workflow. Without them, NuVation cannot create or authenticate the account, establish authority, provide protected business access or record the agreement. When paid checkout opens, the selected products, billing identity, required payment information and order acceptance will be mandatory to process and fulfil that purchase. Complete card details are supplied directly to PayFast, not NuVation.

Most business settings and operational records are optional to NuVation: a customer chooses whether to use the corresponding feature and which lawful information to enter. Omitting optional information may make a particular document, report or workflow incomplete or unavailable, but does not by itself remove unrelated features. Information about another person must not be entered merely because a field exists; the business must first have a lawful reason and provide any notice required in its circumstances.

NuVation does not claim that every requested item is required by law. Where applicable, some account, transaction, request, security and agreement records are processed or retained to meet duties under POPIA, PAIA, the Electronic Communications and Transactions Act, the Consumer Protection Act, tax or record-keeping law, payment-provider requirements, or to establish, exercise or defend legal rights.

5. Where information comes from

Information comes from you, the business owner or authorised users, people who invite or connect with you, the operation of the Service, and contracted providers supporting authentication, hosting and payments. Professionals receive data only after accepting an invitation sent to their exact confirmed account email.

6. Why we process information

Depending on the context, processing may be based on performing an agreement, consent where required, compliance with law, protection of legitimate interests that do not unjustifiably override affected rights, or the business customer's lawful instructions.

7. Business-customer responsibilities

Business owners and authorised users choose which third-party information to enter. They are responsible for lawful collection and use, transparency notices, accuracy, data minimisation, permissions, retention, responding to the relevant people and deciding whether Professional disclosure is appropriate. Each business must maintain and update its own privacy notices, policies, retention rules and data-subject request procedures to reflect its actual use of NuVation. This NuVation Privacy Policy does not replace the business customer's own legal documents or compliance duties. A request about information inside a business account may need to be referred to that business.

8. Employee, administrator and Professional access

Owners control employee and administrator invitations and permissions. Revoked users lose active access, but business records they created and an opaque actor identifier may remain to preserve audit integrity.

Job records may preserve the assigned owner's or employee's UUID and readable name snapshot, the person who completed each Job Card, the person who made an assignment, and snapshots of vehicles, machines or equipment linked to the work. These accountability records may remain with the business history after the underlying user or resource record is removed.

Professional account logins are authenticated, but NuVation does not verify identity documents, qualifications, professional registration, competence or trustworthiness and does not recommend or endorse the person as a qualified professional. A business must independently verify the recipient and exact email before invitation. Accepted Professional access is read-only and limited to designated financial records, but read-only information can still be copied or disclosed. Professionals may connect to multiple businesses, must keep each business's information confidential and must not use it outside the authority provided by that business.

9. Sharing and service providers

We do not sell personal information. Information may be disclosed:

Provider names and arrangements may change as the Service develops. We will update this notice when a change materially affects processing.

10. International processing

The production Supabase project is hosted primarily in the West EU (Ireland) region. Supabase and its authorised subprocessors may process limited information in other locations under their contractual terms and data-processing arrangements. GitHub Pages delivers the static public website through global infrastructure and records visitor IP addresses for security. PayFast is based in South Africa but its published privacy arrangements describe group operations and authorised processing in other countries. Domain, DNS, Gmail and WhatsApp/Meta services may also route or process technical and communication information outside South Africa when those channels are used.

Where POPIA section 72 applies, NuVation relies on an available lawful mechanism appropriate to the transfer, such as recipient law or binding agreements that provide an adequate level of protection, a transfer necessary to perform or conclude the relevant contract, or consent where that is the proper basis. Provider locations and arrangements are reviewed and this notice must be updated if a material change affects the transfer. Business customers should assess whether their own instructions or industry rules require additional safeguards.

11. Browser storage and cookies

The closed-preview public website does not contain NuVation analytics, advertising scripts or a data-submission form. The authenticated ERP uses browser storage and essential cookies or similar technologies to maintain authentication, protect sessions, remember necessary state and operate requested functionality. Hosting and network providers may process ordinary technical request information needed to deliver and secure the website. If NuVation introduces non-essential analytics, advertising or tracking, this notice and any required consent mechanism must be updated before it is enabled.

You can clear browser data, but doing so may sign you out or reset necessary application state.

12. Retention

We retain information only for as long as reasonably required for the relevant purpose, the customer relationship, security and audit needs, dispute handling, backup recovery or legal obligations. Different records have different retention needs, and retention is reviewed against purpose, legal requirements, sensitivity, risk and whether the record can be safely deleted or de-identified.

Customers must retain independent copies of records they are legally required to keep; the Service is not their sole statutory archive.

13. Account and organisation deletion

Employees and Professionals may request deletion of their own NuVation user account. Their access and membership can be removed while business-owned records and opaque audit identity remain. An owner may request destructive deletion of the organisation, subject to authentication and confirmation safeguards. Some information may still be retained where required for legal claims, security evidence, payment records, statutory duties or temporary backup recovery.

14. Security

We use technical and organisational measures intended to protect confidentiality, integrity and availability, including authentication, role and permission controls, tenant isolation, restricted server operations, validation, private storage and security testing. No system is absolutely secure. Users must use strong unique passwords, protect devices, restrict permissions and report suspected compromise promptly.

15. Security compromises

We investigate suspected unauthorised access and take reasonable containment and recovery steps. Where NuVation is the responsible party, it will notify the Information Regulator and affected people as soon as reasonably possible after discovery when POPIA requires that notification, subject to lawful delay. Where NuVation acts as an operator for customer-controlled data, NuVation will notify the responsible business immediately after it has reasonable grounds to believe that an unauthorised person accessed or acquired that personal information, and will provide reasonably available information and assistance for the business's response.

16. Your rights

Subject to POPIA and other applicable law, you may ask whether we hold personal information about you and request access, correction or deletion; object to certain processing; withdraw consent where processing depends on consent; or complain about processing. Rights may be limited where retention or processing is legally required or where another person's rights must be protected.

Send POPIA requests to the Information Officer at nuvationsolutions@gmail.com. We may need to verify your identity, authority and the relevant business relationship before acting. Requests concerning records controlled by a customer business may be directed to that business. Formal requests for access to records under PAIA must follow the process in the NuVation PAIA Manual.

17. Communications and direct marketing

NuVation does not currently use customer email addresses for promotional email marketing. Email and similar direct messages are limited to necessary account, invitation, authentication, security, support, service, legal, billing and payment communications. NuVation currently promotes the Service through public channels such as Facebook and word of mouth. This notice and any required consent process must be updated before promotional electronic messaging is introduced.

18. Children

The Service is intended solely for adult business users and is not directed to children or designed to process children's information. Do not create a child account or enter children's personal information into the Service. Contact NuVation before using the Service if a proposed workflow could involve children's information.

19. Complaints

Please contact the Information Officer first so we can investigate. You may also contact the South African Information Regulator at enquiries@inforegulator.org.za or 010 023 5200. Current POPIA and PAIA complaint forms, eServices and office details are available at inforegulator.org.za.

20. Changes to this notice

We may update this notice when the Service, providers, legal requirements or processing practices change. The version and date appear at the top. Material changes will be communicated through the Service, email or another suitable channel, and renewed acceptance will be requested where appropriate.

Back to website Terms of Service Refund & Cancellation Policy Supplier Information Data Processing Terms PAIA Manual