Privacy and Content Policy
Last updated 13 August 2026
Welcome to The Newbi Project. We are committed to protecting your personal information and ensuring transparency in how we collect, use, and share your data. This Privacy and Content Policy (Policy) is a binding legal document and forms part of our contractual relationship with you. This policy outlines our practices concerning the collection, use, and disclosure of your information in compliance with the Protection of Personal Information Act (POPIA), the General Data Protection Regulation (GDPR), and other applicable laws.
Definitions
Personal Information: Information relating to an identifiable, living natural person or existing juristic person, as defined by POPIA and GDPR. Data Subject: The individual or entity to whom the personal information relates. Processing: Any operation or activity concerning personal information, including collection, storage, use, dissemination, or destruction. Child: For the purposes of this policy, a person under the age of 18 years. Platform: The website, mobile application, and digital services operated by Newbi Project (Pty) Ltd, registration number 2025/418252/07, trading as "Newbi" and "The Newbi Project".
Application of POPIA, GDPR, and the UAE PDPL
To the extent relevant and applicable, all references to the Protection of Personal Information Act, 4 of 2013 (POPIA), the General Data Protection Regulation (EU) 2016/679 (GDPR), and the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) shall be construed as functionally equivalent and shall be interpreted interchangeably for the purposes of this Policy. The provisions of this document shall therefore be read and applied in a manner that gives effect to the core principles, rights, and obligations prescribed by any or all of these regimes. Where a conflict arises between POPIA, GDPR, and the PDPL, or where jurisdiction-specific requirements differ, the more stringent, expansive, or protective standard affording greater rights to the Data Subject shall prevail. This ensures that, regardless of the applicable jurisdiction, the highest level of data protection and privacy compliance is maintained at all times. Nothing in this Policy shall be construed as limiting any rights afforded to a Data Subject under any of these legal regimes, and The Newbi Project undertakes to implement reasonable and appropriate safeguards to uphold those rights consistently across all regions in which it operates.
Processing
The Newbi Project acknowledges its legal and ethical obligation to protect the personal information of users and complies with the Protection of Personal Information Act, 4 of 2013 (POPIA). We undertake to process all personal information in accordance with the conditions for lawful processing as set out in Chapter 3 of POPIA, including accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards, and data subject participation. Personal information will only be collected and processed where: (a) the data subject consents thereto; (b) processing is necessary to carry out actions for the conclusion or performance of a contract; (c) processing complies with an obligation imposed by law; (d) it protects a legitimate interest of the data subject or a third party; or (e) it is necessary for the proper performance of a public law duty or to pursue our legitimate interests. In accordance with POPIA, data subjects have the right to: access their personal information; request correction, deletion or destruction of personal information; object to processing or to direct marketing; and lodge a complaint with the Information Regulator. The Newbi Project has implemented appropriate, reasonable technical and organisational measures to secure the integrity and confidentiality of personal information in its possession, to prevent loss, damage, unauthorised destruction, or unlawful access.
Information we collect
We may collect the following types of personal information: Contact Information — name, email address, phone number, physical address. Professional Details — job title, company name, industry. Digital Identifiers — IP address, browser type, device information. Usage Data — interactions with our platform, preferences, and settings. Content Provided — any information you choose to include in your vCard, such as social media links, biographies, images, videos, products, or booking availability. Payment and Transaction Data — any information required to process payments, including billing addresses and transaction history. Device and Technical Data — operating system, device type, technical identifiers, and, where you enable push notifications, a device push-notification token so we can alert you to new orders, bookings, and leads.
How we collect information
We collect personal information through: Direct Interactions — when you register, create or update your vCard, or contact us. Automated Technologies — cookies and similar tracking technologies that collect data about your interactions with our platform. Third-Party Integrations — when you link or interact with third-party services through our platform. Public Sources — where legally permissible, we may collect information from public records or social media profiles.
Purpose of collection
We process your personal information for the following purposes: Service Delivery — to create and manage your vCard and provide our services. Communication — to send updates, respond to inquiries, and provide customer support. Improvement — to analyse usage patterns and improve our platform. Legal Compliance — to comply with legal obligations and protect our rights. Fraud Detection and Risk Management — to detect and prevent fraudulent activities. Marketing (with consent) — to send promotional content, offers, or updates you have opted into.
Marketing communications
We may use your information to send promotional emails or marketing materials where you have opted in, or where we rely on legitimate interest. You may withdraw consent or opt out of marketing communications at any time by clicking unsubscribe or contacting us directly.
Legal basis for processing
The Newbi Project processes personal information in accordance with the lawful bases provided under POPIA and GDPR. Consent: where you have given voluntary, specific, and informed consent for the processing of your personal information for one or more defined purposes — you may withdraw your consent at any time, provided that such withdrawal does not affect the lawfulness of processing conducted prior to withdrawal. Contractual Necessity: where processing is necessary to enter into or perform a contract with you, including providing access to our platform, managing your account, or responding to service requests. Legal Obligation: where we are required to process your personal information to comply with applicable laws, regulations, legal processes, or enforceable governmental requests. Legitimate Interests: where processing is necessary for our legitimate business interests, such as improving and securing our platform, preventing fraud, enforcing legal claims, or understanding user behaviour, except where such interests are overridden by your fundamental rights and freedoms. We apply the legal basis most appropriate to the specific processing activity and the jurisdiction in which it takes place. Where more than one basis applies, we will rely on the one that offers the highest level of protection to the data subject.
Sharing of information
We may share your personal information with: Service Providers — third parties who assist us in operating our platform, subject to confidentiality agreements. These currently include Supabase (database, authentication, and file storage), Resend (transactional email), Paddle and Paystack (payment processing), Apple and Google (Wallet passes and push notifications), and Expo (mobile app push delivery). Each provider is bound by its own data-processing terms and only receives what it needs to perform its function. Legal Authorities — when required by law or to protect our legal rights. Business Transfers — in the event of a merger, acquisition, or sale of assets. Affiliates and Subsidiaries — for internal business, compliance, and administrative purposes. We do not sell your personal information to third parties.
AI processing
Newbi's AI assistant, Naya, and its business-card scanner send the relevant text or photo to third-party AI providers — currently Google Gemini, Groq, DeepSeek, or OpenRouter, depending on availability — solely to generate a reply or extract contact details from a scanned card. These providers process the request under our commercial terms with them and do not use it to train their own models. Card-scanner photos are discarded once the contact details have been extracted; we do not retain a copy of the photo itself.
Data security
We implement appropriate technical and organisational measures to protect your personal information, including: Encryption — securing data in transit and at rest. Access Controls — limiting access to authorised personnel. Regular Audits — monitoring and testing our security systems. Breach Notification — in the event of a data breach, we will notify you and the appropriate regulators in accordance with legal requirements.
Data retention periods
We retain your personal information only as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required by law. For example, user account information is retained for the duration of your active use and up to 12 months after closure. Billing records are kept for 5 years in accordance with tax laws. Upon request, we will delete or anonymize your personal information, subject to legal and contractual obligations. Data no longer required will be securely destroyed or anonymized.
Your rights
Under POPIA, GDPR, and the UAE PDPL, you have the right to: Access — request access to your personal information. Correction — request correction of inaccurate or incomplete information. Deletion — request deletion of your personal information. Restriction — request that we limit how we use your personal information in certain circumstances. Data Portability — request a copy of your personal data in a structured, commonly used, machine-readable format. Objection — object to the processing of your personal information, including for direct marketing. Automated Decisions — request human review of, and not be subject to, a decision based solely on automated processing that produces a legal or similarly significant effect on you, except where permitted by law. Complaint — lodge a complaint with the Information Regulator (South Africa), a competent EU supervisory authority, the UAE Data Office, or the relevant authority in your jurisdiction. To exercise these rights, please contact us at admin@newbi.app. We will respond to your request within the statutory time frame and may request identity verification before actioning.
Cookies and tracking technologies
We use essential cookies to keep you signed in and to run core features of the platform — these cannot be switched off. With your consent, given through the cookie banner shown on your first visit, we may also use cookies to understand how the site is used. You can accept or limit non-essential cookies at any time from that banner, or by clearing your cookies and revisiting the site to be asked again.
Third-party links
Our platform may contain links to third-party websites. We are not responsible for the privacy practices of these websites and encourage you to read their privacy policies. Use of such links is at your own risk.
Children's privacy
Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children without parental consent. If we become aware that we have collected personal information from a child without verification of parental consent, we will take steps to delete that information. In accordance with children's data-protection codes and GDPR: Age of Consent — users must be at least 16 years old to provide consent, unless the applicable law allows for a lower age (not below 13 years). Parental Consent — for users under the age of consent, verifiable parental consent is required. Data Minimization — we collect only the data necessary to provide our services to children with parental consent. Transparency — our privacy notices are written in clear and plain language suitable for children. Default Settings — the highest privacy settings are enabled by default for child users. We reserve the right to restrict or terminate child user accounts if parental consent cannot be verified.
International data transfers
We may transfer your personal information to countries other than the one in which you reside, including to service providers located outside South Africa, the European Economic Area, and the United Arab Emirates. Where we do, we rely on one or more recognised safeguards — such as an adequacy decision by the relevant authority, standard contractual clauses, or your explicit consent — to ensure your personal information continues to receive a level of protection consistent with POPIA, GDPR, and the UAE PDPL.
Changes to this policy
We may update this policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically. Substantive changes will be communicated to you where required by law.
Contact us
If you have any questions or concerns about this policy or our data practices, please contact us at: Newbi Project (Pty) Ltd, registration number 2025/418252/07, registered office: 350 Parkstation Road, Greenwood Park, Durban, KwaZulu-Natal, 4051, South Africa. Email: admin@newbi.app.
Device information
We may collect certain personal information related to your device when you visit our websites, such as your device's IP address, the referring website, the pages your device visited, and the time and date that your device visited our websites.
Preferences
We may collect personal information on your preferences for receiving marketing communications and details about how you engage with us.
Chatbot data
We may collect a log of your interactions with the Newbi chatbot.
Administrative and support data
We may collect personal information about your use of and access to our services, which may include administrative and support communications with us, third-party integrations you use (if any), and messages, persons, features, content, and links you interact with.
Payment information
We may collect and store payment information as needed to facilitate transactions with the Newbi Project.
Developer community data
When you participate in our Developer Community, Newbi may collect your contact information, including mailing address, email address, photo, domain details, username, and other similar information, as well as information about your device.