Privacy Policy

Effective date: 19 August 2026

Cossa Nexus Holdings (Pty) Ltd ("Cossa Nexus", "we", "us") is committed to responsible processing of personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and other applicable South African law.

1. Who is responsible for your information

The responsible party for this website is Cossa Nexus Holdings (Pty) Ltd. Where an enquiry is directed to a separate registered Group entity, that entity may become responsible for information it processes for its own business purposes.

2. Personal information we collect

Depending on how you interact with us, we may collect your name, email address, telephone number, location, service required, project details, budget range, newsletter subscription details, correspondence, and technical information reasonably generated when you use our website or systems.

If you use an AI or chat feature, the content you submit may also be processed to provide the requested response, operate the service, prevent abuse and improve reliability.

3. How information is collected

Information may be collected directly from you through quote, callback, contact and newsletter forms; through email, telephone or WhatsApp communications; from contractual or supplier interactions; and automatically through necessary website technologies and security logs.

4. Why we process information

We process information to respond to enquiries, qualify and manage leads, prepare quotations, communicate with customers, deliver requested services, manage supplier and contractor relationships, operate and secure our websites and systems, maintain business records, comply with legal obligations, prevent fraud, and send direct marketing where lawfully permitted.

5. Lawful grounds

Depending on the circumstances, processing may be necessary for your consent, to take steps at your request before entering a contract, to perform a contract, to comply with a legal obligation, or to pursue a legitimate interest that does not unjustifiably interfere with your privacy.

6. CRM, database and service providers

Website enquiries and lead information may be stored in our controlled business systems and databases. We may use operators and service providers for database hosting, website hosting, communications, analytics, security, email and other legitimate business functions. They should receive only information reasonably required for their role and be subject to appropriate contractual and security controls.

7. Group sharing

Where your enquiry relates to a particular Cossa Nexus business, relevant information may be shared with that business so it can respond, quote or provide the requested service. We do not sell personal information.

8. Cross-border processing

Some technology providers may process or store information outside South Africa. Where cross-border processing occurs, we take reasonable steps to ensure it is handled in accordance with applicable POPIA requirements and appropriate safeguards.

9. Direct marketing

We send electronic direct marketing only where permitted by law. You may opt out of marketing communications at any time. Opting out of marketing does not prevent service, contractual, security or legally required communications.

10. Retention

We retain personal information only for as long as reasonably required for the purpose for which it was collected, to meet legal or contractual obligations, resolve disputes, maintain necessary business records or protect legitimate interests. Information that is no longer required should be securely deleted, destroyed or de-identified where appropriate.

11. Security

We use reasonable technical and organisational safeguards appropriate to the nature of the information and risk, including access controls, secure transport, controlled credentials, system monitoring and service-provider controls. No online system can be guaranteed to be completely secure.

12. Your rights

Subject to applicable law, you may request access to personal information we hold about you, request correction or deletion, object to certain processing, withdraw consent where processing depends on consent, and complain about unlawful processing. We may need to verify your identity before acting on a request.

13. PAIA and prescribed requests

Requests for access to records may also be made under the Promotion of Access to Information Act 2 of 2000 (PAIA). See our PAIA information page for the applicable process.

14. Cookies and local storage

See our Cookie Policy for information about browser storage, necessary technologies and analytics.

15. Security incidents

If we have reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, we will assess the incident and take notification or other steps required by applicable law.

16. Contact and Information Officer

Information Officer / Head of Private Body: Abel Nkuna
Email: cossa@cossanexusholdings.co.za
Phone: +27 67 801 1907
Location: Centurion, Pretoria, Gauteng, South Africa

You may also lodge a complaint with the Information Regulator of South Africa if you believe your personal information has been processed unlawfully.

17. Updates

We may update this policy when our systems, services, legal obligations or processing activities change. The effective date above identifies the current published version.