Privacy Policy

ROI Nexus Digital ("ROI Nexus", "we", "us") is a digital growth agency based in Cape Town, South Africa, offering smart websites, lead management systems, paid media, reputation management and business automation. We work with businesses in South Africa and around the world.

We are the "responsible party" for your personal information under South Africa's Protection of Personal Information Act 4 of 2013 (POPIA). This policy explains what we collect, why, how we protect it, and the rights you have, wherever you are located.

Information you give us: your name, email address, phone number, business name, job title, website, and anything you share in forms, emails, calls, WhatsApp messages or meetings.

Client account information: billing details, invoicing records, and access credentials or permissions you grant us to your advertising, analytics, website or CRM accounts so we can deliver our services.

Information collected automatically: IP address, browser and device type, pages visited, referral source, and similar usage data, collected through cookies and similar technologies (see section 8).

We do not intentionally collect special personal information (such as health, religious or biometric data), and we ask that you do not send it to us.

We process your personal information only for specific, lawful purposes:

• To respond to enquiries and provide quotes or proposals.
• To deliver, manage and bill for the services you engage us for.
• To communicate with you about your projects, account or our services.
• To improve our website and understand how visitors use it.
• To send marketing communications, but only where you have consented or are an existing client and have not opted out.
• To meet our legal, tax and regulatory obligations.

Our legal grounds include your consent, performing a contract with you, complying with the law, and our legitimate interests in running and growing our business, always balanced against your rights.

When we build websites, lead management systems or advertising campaigns for clients, we may handle personal information about their customers and leads (for example, form submissions or customer lists used for ad audiences). In these cases our client is the responsible party and we act as their "operator", processing that information only on their instructions and under written agreement. If you are a customer of one of our clients, please contact that business directly about your information.

We will only send you electronic marketing if you have opted in, or if you are an existing client and the messages relate to similar services. Every marketing message includes a simple way to unsubscribe, and you can opt out at any time by emailing us.

We never sell your personal information. We share it only where necessary with trusted third-party service providers who help us run our business and deliver ourservices, such as providers of website hosting, customer relationship management, communication, analytics, advertising, reporting, payment and accounting services.

These providers are bound by confidentiality and data protection obligations and may only use your information to provide their services to us. We may also disclose information where required by law, court order or a regulator.

Some of our service providers store or process data outside South Africa, including in the United States and the European Union. Where this happens, we transfer information only as permitted by section 72 of POPIA, for example where the recipient is subject to laws, binding agreements or corporate rules that provide protection substantially similar to POPIA, or where the transfer is necessary to perform our contract with you.

If you are located outside South Africa, your information will be processed in South Africa and in the countries where our providers operate. We apply the same standard of care to your information regardless of where you are.

Our website uses cookies and similar technologies to keep the site working, measure traffic and, where applicable, support advertising (for example, Google Analytics or the Meta Pixel). You can control or delete cookies through your browser settings, and where required we will ask for your consent before setting non-essential cookies. Blocking some cookies may affect how the site works.

We take reasonable technical and organisational measures to protect your information against loss, misuse and unauthorised access, including access controls, secure passwords and multi-factor authentication, and using reputable providers with strong security practices. No system is completely secure, but if a security compromise affects your information, we will notify you and the Information Regulator as required by law.

We keep personal information only for as long as needed for the purpose it was collected, or as required by law (for example, financial records kept for tax purposes). When it is no longer needed, we delete, destroy or de-identify it.

Under POPIA you have the right to:

• Ask whether we hold your personal information and request a copy of it.
• Ask us to correct, update or delete it.
• Object to processing, including for direct marketing, at any time.
• Withdraw consent where we rely on it.
• Lodge a complaint with the Information Regulator.

If you are located elsewhere (for example in the EU, UK or United States), you may have additional rights under your local laws, such as data portability or restriction of processing. We will respect those rights wherever they apply to us.

To exercise any right, email clinton@roinexus.digital. We may need to verify your identity first, and we aim to respond within 30 days. Requests are generally free of charge.

Our services are aimed at businesses. We do not knowingly collect personal information from anyone under 18 without the consent of a parent or guardian. If you believe we have, please contact us and we will delete it.

Our site may link to other websites or platforms. We are not responsible for their privacy practices, so please review their policies separately.

If you have a concern, please contact us first and we will do our best to resolve it. You may also contact South Africa's Information Regulator:

If you are outside South Africa, you may also contact your local data protection authority.

We may update this policy from time to time. The latest version will always be on this page, with the effective date shown at the top. Where changes are significant, we will let clients know directly.