Privacy Policy
Last updated Sep 2025
1. Introduction
Nimble Group (‘Company’, ‘we’, ‘us’, ‘our’) and all of its subsidiaries understand your concern about how we use your personal data. This policy explains how we collect, share and protect your personal information, what your rights are and how you may complain, as required by the Protection of Personal Information Act (“POPIA”), and our Company Code of Ethics.
This policy applies to all personal information that we process including personal and special information you give to us or which we may collect from third parties. Some information fields will be mandatory if you want to use a product or service. This includes but is not limited to the following:
- If you are a customer or potential customer of one of our products or services or related to that person.
- If you are a customer or potential customer of our client or related to that person.
- If you are part of one of our legitimate databases.
We may change the policy from time to time if the law or our business needs require it. The latest version will always be published on the websites.
2. Definitions
POPIA: Protection of Personal Information Act.
Subsidiaries: These include Nimble Group (South Africa, Namibia, Botswana), Nimble Special Opportunities, Nimble Credit Solutions.
Nimble: Means Nimble Group and all subsidiaries operating under the name “Nimble”.
Personal Information is Information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person, including, but not limited to –
- Information relating to the race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language and birth of the person;
- Information relating to the education or the medical, financial, criminal or employment history of the person;
- Any identifying number, symbol, e-mail address, physical address, telephone number, location information, online identifier or other particular assignment to the person;
- The biometric information of the person;
- The personal opinions, views or preferences of the person;
- Correspondence sent by the person that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the contents of the original correspondence;
- The views or opinions of another individual about the person; and
- The name of the person if it appears with other personal information relating to the person or if the disclosure of the name itself would reveal information about the person.
Special Personal Information is information that relates to the religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life or biometric information of a data subject. It also includes criminal behaviour relating to alleged commissions of offences or any proceeding dealing with alleged offences.
Process: Means any operation or activity, whether automated or not, concerning personal information, including: collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation, use, dissemination by means of transmission, distribution or making available in any other form, merging, linking, as well as blocking, degradation, erasure or destruction of information. “Processing” will have a similar meaning.
3. Categories of Personal Information
Different categories of Personal Information will be processed, depending on the reason for processing. Generally speaking, we may process any or all of the following categories of Personal Information:
- General Personal Information and contact details like name, address, contact numbers, email address, age, employment etc;
- Financial, payment, banking and account information;
- Credit bureau and fraud;
- Cookies and device information like browser settings, IP address, time of logging on etc;
- Advertising and online information like your interactions with websites and platforms where we advertise our products;
- Views and opinions;
- Consent records.
4. Privacy
Nimble takes your privacy and the protection of your personal information very seriously, and we will only use your personal information for the purposes for which it was collected, and in accordance with this Policy and applicable data protection legislation. It is important that you take all necessary and appropriate steps to also protect your personal information yourself.
5. Data Collection
A) What Do We Collect?
| Data Category | What We Collect | Purpose / Legal Basis |
|---|---|---|
| Identity & Contact Data | Name, surname, ID or passport number, email address, phone number, physical/postal address. | To process payments, manage accounts, perform debt collection, prevent fraud, and comply with financial regulations. |
| Financial Data | Bank account details, payment history, credit bureau information, billing details. | To secure our systems, improve website functionality, detect misuse, conduct analytics, and personalise your online experience. |
| Technical & Usage Data | IP address, browser type/version, operating system, device identifiers, pages viewed, time/date of visits, cookies, location data (approximate). | To send you relevant updates and marketing (only where you have given consent) and to respect your communication preferences. |
| Marketing & Preference Data | Communication preferences, cookie consent, opt-ins for newsletters or promotions. | Processed only with your consent or where required by law (e.g., HR obligations, compliance checks, security requirements). |
| Special Personal Information (only if necessary) | Health information (e.g., medical certificates for employees), biometric data, or criminal history checks (where legally required). | To manage our workforce, administer contracts, comply with labour and tax laws. |
| Employee & HR Data | Employment history, payroll details, performance records, disciplinary records, training records. | To perform our contractual obligations, manage relationships, conduct due diligence, and comply with regulatory requirements. |
| Client and Business Partner Data | Company contact information, authorised signatories, directors' or shareholders' information. | To provide customer service, keep records of interactions, and resolve queries, complaints, or disputes. |
| Correspondence & Interaction Data | Emails, call recordings, chat logs, letters, forms submitted on our website. | To provide customer service, keep records of interactions, and resolve queries, complaints, or disputes. |
B) How Do We Collect Your Data?
5.1 Directly from You
You provide information to us when you:
- Complete forms on our website (e.g., enquiries, registrations, job applications);
- Communicate with us by phone, email, post, or chat;
- Use our services, sign agreements, or enter into a contract with us;
- Respond to surveys, marketing campaigns, or provide feedback.
Why: To provide services, respond to enquiries, manage contracts, and meet legal obligations.
5.2 Automatically When You Use Our Website or Services
Certain information is collected automatically through digital tools, including cookies and similar technologies:
- Device and browser information (IP address, browser type/version, operating system);
- Usage data (pages viewed, time/date of visit, how you navigate our site);
- Cookie identifiers, web beacons, and pixels that help us analyse website traffic and improve services.
Why: To secure our systems, enhance user experience, personalise content, and understand service performance.
5.3 From Third Parties and External Sources
We may also receive personal information about you from:
- Our clients (for services we perform on their behalf, e.g., debt collection or tracing);
- Credit bureaus, fraud prevention agencies, and business partners;
- Government registers or publicly available databases;
- Social media platforms or service providers that you have interacted with;
- Third-party service providers who support us in delivering services (IT providers, payment processors, analytics partners).
Why: To verify information, comply with legal/regulatory obligations, prevent fraud, and perform contractual duties.
6. How Will We Use Your Data?
| Data Category | Purpose | Legal Basis |
|---|---|---|
| Identity & Contact Data | To verify your identity, provide services, communicate with you, and respond to enquiries. | Contractual necessity, legal obligation, or your consent. |
| Financial Data | To process payments, perform debt collection, prevent fraud, and comply with financial regulations. | Legal obligation, legitimate interest. |
| Technical & Usage Data | To secure our systems, improve website performance, detect misuse, analyse traffic, and personalise your experience. | Legitimate interest in IT security and service improvement, consent (for cookies/analytics). |
| Marketing & Preference Data | To send you marketing communications (only where you have opted in), tailor communications, and record consent choices. | Consent, legitimate interest. |
| Special Personal Information (only if necessary) | To comply with labour laws, assess employee health/benefits, or where explicit consent is provided. | Explicit consent, legal obligation. |
| Employee & HR Data | To administer employment contracts, manage payroll, benefits, training, and performance. | Contractual necessity, legal obligation. |
| Client & Business Partner Data | To perform due diligence, manage relationships, and comply with legal/regulatory requirements. | Contractual necessity, legal obligation. |
| Correspondence & Interaction Data | To provide customer service, resolve disputes, and keep records of communications. | Contractual necessity, legitimate interest. |
7. Data Retention
Personal data is kept only as long as necessary for the stated purpose or as required by law. Examples:
- Client/debtor records: up to 5 years after case closure;
- Employee records: as required by labour law (typically 3–7 years);
- Cookie/analytics data: see Cookie Policy (usually 6–24 months).
8. International Transfers
If personal data is transferred outside South Africa, we ensure adequate protection through contractual clauses or transfers only to jurisdictions with equivalent protection standards.
9. Security
We have implemented reasonable technical and operational measures to keep your personal information secure. Nimble ensures that personal data is stored securely using modern software that is kept up to date. Access to personal data is limited to personnel who need access and appropriate security is in place to avoid unauthorised sharing of information. Data is encrypted at rest and in transit. Access is restricted on a need-to-know basis, and regular audits are performed.
All our third-party suppliers must have appropriate Data Protection and Security measures in place that will comply with our Privacy Statements and rules if we choose to outsource any services. When personal data is dehumanized, this is done safely so that the data is irrecoverable.
In the event of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data, we will inform you by contacting you on the contact details we have available, by press release, or by any other reasonably suitable method. We will also report a data breach to the Information Regulator.
10. Your Rights
You may request access, correction, deletion, objection, restriction, portability, or withdrawal of consent. Requests can be submitted to our Information Officer (with PAIA Form 2 link).
11. How Do We Store Your Data?
We are committed to protecting your personal information through a combination of technical, administrative, and organizational measures.
11.1 Data Encryption
All personal data is encrypted in transit using industry-standard TLS (Transport Layer Security). All personal data is encrypted at rest when stored in our databases, backups, or file systems.
11.2 Password Security
We do not store or log passwords in plain text. Passwords are stored using secure hashing to ensure they cannot be easily reversed. Authentication systems are regularly reviewed to align with best security practices.
11.3 Access Controls
Access to personal information is strictly role-based (RBAC) and follows the principle of least privilege. Only authorized personnel who require access for legitimate business purposes may handle personal data. All access is logged, monitored, and subject to regular audit reviews.
11.4 Data Segregation and Backup
Personal data is stored in secured environments with logical segregation from other datasets. Regular backups are taken and encrypted to ensure availability in case of system failures.
11.5 Monitoring and Testing
Our systems are monitored for unauthorized access and suspicious activity. We conduct regular vulnerability assessments, penetration testing, and audits to maintain compliance with industry standards.
11.6 Data Breach Notification
If a breach occurs that affects your personal information, we will notify you in line with our legal obligations and report it to the Information Regulator as required by POPIA.
13. International Data Transfers
Where personal information is transferred outside South Africa (or your country of residence), we ensure that appropriate safeguards are in place to protect it. These safeguards may include:
- Transfers only to countries which have been legally recognized as providing an adequate level of data protection.
- The use of Standard Contractual Clauses (SCCs) or other legally binding contracts approved for international transfers.
- Intra-group data transfer agreements where data is shared across our subsidiaries in different jurisdictions.
Where required, your explicit consent for certain international transfers. By using our services, you acknowledge that your personal data may be transferred, stored, and processed outside your home country, but always with appropriate legal and technical protections.
14. Data Rights
“Your Data Protection Rights”. Under the Protection of Personal Information Act (POPIA) and, where applicable, the General Data Protection Regulation (GDPR), you have the following rights over your personal information:
- Right to be Informed: You have the right to clear and transparent information about how we collect and use your personal data (which is why we provide this Privacy Notice).
- Right of Access: You can request a copy of the personal information we hold about you.
- Right to Rectification: You can ask us to correct or update inaccurate or incomplete personal information.
- Right to Erasure (“Right to be Forgotten”): You can request that we delete your personal information where there is no legal or contractual reason for us to keep it;
- Right to Restrict Processing: You can request that we limit how we process your personal information in certain circumstances (for example, while we verify its accuracy);
- Right to Data Portability: You can request that we provide your personal information to you, or to a third party you nominate, in a structured, commonly used, and machine-readable format (where technically feasible);
- Right to Object: You can object to the processing of your personal information where it is based on our legitimate interests, or to receiving direct marketing communications;
- Rights in Relation to Automated Decision-Making and Profiling: You have the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects or significantly affects you, unless necessary for a contract, authorized by law, or with your explicit consent.
14.1 Your Rights in relation to PAIA
- You may request details of personal information which we hold about you under the Protection of Personal Information Act, 2013 (“POPIA”).
- Fees to obtain a copy or a description of personal information held about you are prescribed in terms of the Promotion of Access to Information Act, 2000 (“PAIA”). Confirmation of whether or not we hold personal information about you may be requested free of charge.
- You may at any time request that we update or correct your personal information by contacting our Information Officer at Informationofficer@nimblegroup.co.za and by submitting the prescribed Form 2 as per Regulation 3 of Information officer.
- Please ensure that the information we hold about you is complete, accurate and up to date.
- You have a right in certain circumstances to request the destruction or deletion or dehumanization of and, where applicable, to obtain restriction on the processing of personal information held about you. If you wish to exercise this right, please contact us using the contact details set out below.
- You have a right to object on reasonable grounds to the processing of your personal information where the processing is carried out in order to protect our legitimate interests or your legitimate interests, unless the law provides for such processing.
15. How You Can Exercise These Rights
You may submit a request to exercise any of your rights by contacting our Information Officer:
Email: InformationOfficer@nimblegroup.co.za
Postal: 33 Brickfield Road, Saltriver, Cape Town, 7925, South Africa
POPIA/PAIA Form 2 (for access requests): https://nimblecreditsolutions.co.za
We will respond within the legally required timeframe (30 days under PAIA, extendable where permitted). Before fulfilling your request, we may need to verify your identity to ensure your rights are protected. Please note that some rights are subject to legal or contractual restrictions (for example, we may not be able to delete records that we are legally required to retain).
17. Managing and Withdrawing Consent
When you first visit our website, you will see a cookie banner that allows you to accept or reject different categories of cookies. You can also control cookies through your browser settings. Please note that disabling cookies may impact the functionality of the site.
19. Do Not Track Policy
Some web browsers offer a “Do Not Track” (DNT) setting that sends a signal to websites indicating that you do not wish to be tracked. At present, there is no universally accepted standard for how websites should respond to these signals. As a result we do not currently respond to DNT signals sent by browsers. Instead, we provide other mechanisms that allow you to control tracking, such as:
- Our cookie banner and preference centre, where you can manage analytics and advertising cookies;
- Browser settings that allow you to block or delete cookies;
- Third-party opt-out tools (e.g., Google Analytics opt-out);
- We will continue to monitor developments in this area and update our approach if an industry or legal standard for DNT is established.
20. Children's Privacy
Our services and website are not directed to, and we do not knowingly collect personal information from, children under the age of 18. If you are under this age, please do not provide any personal information to us. If we discover that we have inadvertently collected personal information from a child without verifiable parental consent, we will delete it as quickly as possible.
Parents or guardians who believe that their child has provided personal information to us may contact our Information Officer at InformationOfficer@nimblegroup.co.za to review, request deletion, or stop any further collection or use of their child’s information. If in the future we offer services directed at children, we will implement all required parental consent mechanisms and disclosures under applicable laws, including the Children’s Online Privacy Protection Act (COPPA) in the United States and equivalent international laws.
21. How We Process Special Personal Information
You may provide Personal Information to us either directly or indirectly (via third-parties) by/when using our products and services in the following ways:
- Processing is carried out with the consent of a data subject; or
- Processing is necessary for the establishment, exercise or defence of a right or obligation in law.
22. How We Collect Personal Information
You may provide Personal Information to us either directly or indirectly (via third-parties) by/when using our products and services in the following ways:
- You register for any service or product that we provide;
- You provide any information to us online or through any other communication channel;
- Our client provides your information to us.
We may also collect your Personal Information from our group entities and its partners, credit providers, service providers or other third-parties that may hold such information. Some Personal Information is automatically collected when you use any of our digital channels, like our website, we receive, and store information generated by your activities (usage data gathered by cookies) and other information that are automatically collected from your browser or mobile device.
Cookies help us learn how well our site, services and tools perform in different locations. We also use cookies to understand, improve, and research products, features, and services, including when you access Nimble or any of our subsidiary websites, or from other websites, applications, or devices such as your work computer or your mobile device. Most of this data is generally not personally identifiable. However, some of this data, either alone or when linked with other information, may allow your identity to be discovered. We treat this combined data as personal information, and we protect it accordingly. Cookies are small text files that are created when you view a website. They gather usage data which includes information about the sites you visited, the number of times you visit, the date, time and length of your visit, which products or services you viewed and which areas of the site you visited. We may assign you one or more unique identifiers to help keep track of your future visits. We may use first-party or third-party cookies and web beacons to deliver content relevant to your interests, on our sites or on third-party sites. This includes using technologies to understand the usefulness of the content that has been delivered to you. Other information automatically collected may include your IP address, preferred language, geographic location, operating system and computer platform.
23. How We Use Your Information
We may use, transfer, share and disclose your personal information for the purposes of:
- Providing you with the services, products or offerings you have requested, and keeping you informed.
- Enriching the accuracy and quality of our data.
- Managing your account or contract/relationship with us.
- Detecting and preventing fraud and money laundering and/or in the interest of security and crime prevention.
- Assessing and dealing with complaints and requests.
- Operational, marketing, auditing, legal and record keeping requirements.
- Identifying you, verifying your identity or the identify of your beneficial owner.
- Complying with applicable laws, including lawful requests for information received from law enforcement, government and tax collection agencies.
- Recording and/or monitoring your telephone calls and electronic communications to/with Nimble in order to process instructions and requests.
- Conducting market research and providing you with information about Nimble's products or services from time to time via our website, email, telephone or other means.
- Disclosing your personal information to third parties for reasons set out in this Notice or where it is not unlawful to do so;
- Monitoring, keeping record of and having access to all forms of correspondence or communications received by or sent from Nimble or any of its employees, agents or contractors, including monitoring, recording and using as evidence all communications between you and Nimble.
- Run valuation models.
- Statistical, historical and research purposes; and
24. Data Analytics
We may from time to time (and at any time) contact you about services, products and offerings available from Nimble or specific Group subsidiaries which we believe may be of interest to you, by email, phone, text or other electronic means.
25. Transferring Personal Information Cross-Border
You agree that we may transfer your personal information cross border if our business interests require trans-border flow of information. This may typically happen where we have decided to store information with a trusted third-party in another country or where a service provider makes use of systems or processes cross border.
Where it becomes necessary to transfer data to other countries to ensure an ongoing service to our customers, we will ensure that all appropriate measures are in place to comply with Data Privacy and Security Laws applicable to that country, ensuring the safeguarding of your personal data.
26. Retention of Your Information
We will retain your personal information as required by law and/or physical requirements and for as long as necessary considering the purpose for which it was collected. Where we provide a service to a client, we will retain your information in accordance with the client's instructions.
27. Complaints
Should you believe that Nimble has utilised your personal information contrary to applicable laws, we request that you contact our Information Officer to attempt to resolve any concerns with us.
If you are not satisfied with such process, you have the right to lodge a complaint with the Information Regulator, using the contact details listed below:
Website: https://inforegulator.org.za
Address: 27 Stiemens St, Braamfontein, Johannesburg, 2017
Contact Number: 010 023 5200
28. How to Contact Us
If you have any questions about this Policy, please contact our Information Officer at Informationofficer@nimblegroup.co.za.