Legal
Privacy Policy
This Privacy Policy explains how Xava ("Xava", "we", "us" or "our") collects, uses, shares, protects and retains your personal information when you visit our website, complete our contact form, or use the Xava cashless tipping service. We are committed to processing your personal information lawfully, minimally and transparently, in line with South Africa's Protection of Personal Information Act, 2013 (POPIA).
1. Who we are
Xava is operated by Nerdcode (Pty) Ltd, trading as "Xava" (registration number 2015/238954/07), a company registered in South Africa and based in Gauteng. For the purposes of POPIA, Xava is the "responsible party" that determines how and why your personal information is processed.
2. Our data minimisation promise
We collect and keep only the personal information we genuinely need — nothing more. In practice that means:
- Personal information is limited to what is required for tipping, paying out tips, verifying identity where the law requires it, and responding to your enquiries.
- We do not collect personal information "just in case", and we do not sell it — ever.
- When information is no longer needed for its purpose, it is deleted or anonymised.
3. The information we collect
Depending on how you interact with us, this may include:
- Contact form details: your name, cellphone number, email address, region (province and city/town), profession and the description of your query.
- Worker registration details: if you register to receive tips — your name and surname, cell number, email address, job title, employer/venue, a profile photo (selfie), identity verification information required by law, and the bank account details used to pay your tips to you.
- Tipping activity: tip amounts and related transaction records.
- Technical information: basic, non-identifying website analytics such as pages visited (only where applicable).
Providing information via our contact form is voluntary.
4. Payments — what we never see
All tip payments are processed by a licensed South African payment provider on PCI-DSS-compliant infrastructure. Card capture, tokenisation and bank authentication happen entirely within the payment provider's secure hosted environment.
- Xava never sees, touches or stores your card number, banking login details or payment credentials.
- Tippers can pay by card, Apple Pay, Google Pay or instant EFT — all through the payment provider's secure platform.
- Workers' tips are paid out directly to the worker's own verified bank account.
5. Why we process your information (purpose)
- To respond to your enquiry and arrange a Xava band.
- To register workers, verify identity where required by law, and pay tips to the correct verified bank account.
- To provide, operate, secure and improve the Xava tipping service.
- To send you updates about our launch and service, where you have asked us to.
- To comply with our legal and regulatory obligations.
6. Our lawful basis
We process your personal information on the basis of your consent (which you give by submitting our form or registering), to take steps at your request before entering into a service relationship, to comply with our legal obligations (including financial-sector verification laws), and to pursue our legitimate interests in running and improving Xava — always balanced against your rights.
7. Sharing your information
We do not sell your personal information. We share it only with trusted service providers (operators) who help us run Xava — such as our payment provider and secure hosting/database providers — under appropriate confidentiality and data-protection terms, and with authorities where the law requires it.
8. Data retention — kept to a minimum
We keep personal information only for as long as it is needed for the purposes above, or as long as the law requires — whichever applies. As a guideline:
- Contact enquiries: kept only as long as needed to resolve your query, and no longer than 12 months from our last interaction, unless you ask us to remove it sooner.
- Worker verification records: retained for the minimum period required by South African financial-sector law, then securely destroyed.
- Transaction records: retained for the period required by applicable tax and financial-services law.
- Marketing preferences: until you unsubscribe or withdraw consent.
9. How we protect your information
We take reasonable, appropriate technical and organisational measures to safeguard your information against loss, unauthorised access and misuse, including:
- Encrypted connections (HTTPS) and access controls on our systems.
- Storing data with reputable, secured providers.
- Keeping all payment processing inside our payment provider's PCI-DSS-compliant environment, so card-data risk never sits with Xava.
- Limiting who inside Xava can see personal information to those who need it to do their jobs.
No method of transmission is perfectly secure, but we work to protect your information at every step. If a data breach occurs that affects you, we will notify you and the Information Regulator as POPIA requires.
10. Your rights under POPIA
You have the right to:
- Access the personal information we hold about you.
- Ask us to correct or update inaccurate information.
- Ask us to delete or destroy your information where appropriate.
- Object to or withdraw your consent to processing (this will not affect processing already carried out).
- Lodge a complaint with the Information Regulator.
To exercise any of these rights, contact us at queries@xava.africa.
11. Enquiries, complaints and disputes — our service levels
- General and contact-form enquiries: we will attend to your enquiry within 5 business days.
- Disputes (including tip or payment disputes): we work to a 72-hour service level from the time you raise the dispute with us at queries@xava.africa.
See our Terms of Use for more on how enquiries and disputes are handled.
12. Information Officer
Xava has an appointed Information Officer responsible for our POPIA obligations. You can reach the Information Officer regarding any privacy matter at queries@xava.africa.
13. Complaints to the Information Regulator
If you believe we have not handled your personal information lawfully, you may lodge a complaint with the Information Regulator (South Africa):
- Website: inforegulator.org.za
- Email (complaints): complaints.IR@justice.gov.za
- Email (general): inforeg@justice.gov.za
14. Cookies
Our website uses only essential functionality and does not currently use non-essential tracking cookies. If this changes, we will update this policy and seek your consent where required.
15. Changes to this policy
We may update this Privacy Policy from time to time. The latest version will always be available on this page, with the "Last updated" date revised accordingly.
16. Contact us
For any privacy questions, email queries@xava.africa.