Website Privacy Policy

1 · WHO WE ARE

This Privacy Policy explains how Nebula Marketing Group (Pty) Ltd (registration number 2026/686243/07), trading as "Nebula Marketing" ("Nebula", "we", "us", "our"), collects, uses, discloses, and protects personal information gathered through our website, nebulamarketing.digital (the "Site").

We are the "responsible party" for this personal information as that term is defined in the Protection of Personal Information Act 4 of 2013 ("POPIA").

Our electronic dealings with you through the Site — including the validity of electronic communications and any agreements formed electronically — are also governed by the Electronic Communications and Transactions Act 25 of 2002 ("ECTA").

Contact email: hello@nebulamarketing.digital

This policy covers the Site only. If you engage Nebula as a client, a separate services agreement governs how we handle information connected to that engagement; where the two overlap, the services agreement takes precedence for that relationship.

2 · PERSONAL INFORMATION WE COLLECT

2.1 Information you give us directly

When you use the Contact form on the Site, we collect:

— Your name

— Your email address

— The service(s) you are interested in (selected from a checklist)

— Any message or additional details you choose to include

The message field is free text, so please do not include sensitive or special personal information (such as health, religious, or biometric details) unless it is genuinely necessary for us to respond to your enquiry.

If you email us directly at hello@nebulamarketing.digital, we collect whatever personal information is contained in that correspondence.

2.2 Information collected automatically

Like most websites, the Site may automatically collect limited technical information when you visit — such as your IP address, browser and device type, pages viewed, and referring page — through cookies and similar technologies. The Site uses Google Analytics 4, the Meta Pixel, and the LinkedIn Insight Tag, which — once you have accepted non-essential cookies through the Site's cookie banner — collect additional information about your visit for analytics and advertising purposes. Full detail on these tools, the cookies they set, and how long they last is set out in our separate Cookie Policy, which forms part of this Privacy Policy by reference.

The Contact form does not ask for payment information, government identification numbers, or any of the "special personal information" categories POPIA singles out for extra protection (health, religion, race, biometric data, criminal history, and similar), and we do not intentionally request these categories through the Site. Because the message field is free text, it is technically possible for a visitor to include this kind of information voluntarily — see Section 2.1 above.

3 · WHY WE COLLECT IT, AND ON WHAT LEGAL BASIS

We process your personal information for the following purposes, and on the following lawful grounds under POPIA:

— To respond to enquiries submitted via the Contact form or by email — necessary to take steps at your request before, and in the performance of, a possible agreement with you.

— To provide, administer, and improve our services to clients — performance of a contract, or our legitimate interest in running our business responsibly.

— To send you marketing communications — Nebula does not currently send direct electronic marketing communications through the Site. If we do so in future, this will be a separate processing purpose from responding to your enquiry: submitting the Contact form or emailing us is not, by itself, consent to receive marketing. We will only send marketing communications with your separate, opt-in consent (which you may withdraw at any time — see Section 8), in accordance with section 69 of POPIA and the opt-in/opt-out requirements for unsolicited electronic communications under section 45 of the Electronic Communications and Transactions Act 25 of 2002 ("ECTA").

— To maintain the security, performance, and functionality of the Site — our legitimate interest in operating a safe and reliable website.

— To comply with a legal obligation, or to exercise or defend a legal right, where required.

Providing your details through the Contact form is voluntary — you are not obliged to submit them. However, if you do not provide your name, a valid email address, and enough detail about your enquiry, we will not be able to respond to you.

4 · WHO WE SHARE YOUR INFORMATION WITH

We do not sell personal information. We share it only in the following limited circumstances:

— Service providers who process personal information on our behalf (our "operators" under POPIA) — our website hosting and forms platform (Framer); Google, which provides Google Analytics and hosts the Google Sheet in which Contact form submissions are logged; our email provider; Meta, which provides the Meta Pixel; and LinkedIn, which provides the LinkedIn Insight Tag (see our Cookie Policy for the analytics and advertising tools). We take reasonable steps to ensure these providers protect your information to a standard consistent with POPIA.

— Professional advisers (such as our accountant or attorney) where reasonably necessary.

— A regulator, court, or other authority, where required or permitted by law.

— A successor entity, in the event of a sale, merger, or restructuring of our business, subject to that entity being bound by terms at least as protective as this policy.

5 · CROSS-BORDER TRANSFERS

Some of the service providers referred to in Section 4 (including Framer, Google, Meta, and LinkedIn) may store or process personal information on servers located outside South Africa. Where we transfer personal information across South Africa's borders, we do so only where the recipient is subject to a law, binding corporate rules, or an agreement that provides an adequate level of protection substantially similar to POPIA, or where another condition permitted by section 72 of POPIA applies (for example, your consent, or the transfer being necessary for the performance of a contract with you).

6 · HOW LONG WE KEEP YOUR INFORMATION

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, or as required by law (for example, tax and financial record-keeping obligations under South African law). Enquiry details submitted via the Contact form that do not lead to a client engagement are retained for 12 months after your last interaction with us, after which they are deleted or anonymised, unless a longer period is required by law or justified by another lawful purpose.

7 · HOW WE PROTECT YOUR INFORMATION

We take reasonably practicable technical and organisational measures to protect personal information against loss, unauthorised access, interference, and disclosure, appropriate to the nature of the information involved — including restricting access to personal information to those who need it, and using a securely hosted website platform (HTTPS encryption in transit).

If we become aware of a breach where there are reasonable grounds to believe your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and, where required, you, as soon as reasonably possible, in accordance with section 22 of POPIA.

8 · YOUR RIGHTS

Subject to POPIA, you have the right to:

— Be notified that your personal information is being collected, and for what purpose (this notice).

— Establish whether we hold personal information about you, and to request access to it.

— Request that we correct, destroy, or delete personal information about you that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully.

— Object, on reasonable grounds, to the processing of your personal information.

— Object at any time, free of charge, to your information being processed for direct marketing purposes, or to refuse unsolicited electronic communications from us, including the right under section 45 of ECTA to require us to stop sending unsolicited commercial communications.

— Not be subject to a decision based solely on automated processing that affects you in a significant way (we do not currently use automated decision-making of this kind).

— Submit a complaint to the Information Regulator regarding any alleged interference with the protection of your personal information (contact details in Section 11).

— Institute civil proceedings regarding any alleged interference with the protection of your personal information.

To exercise any of these rights, contact us using the details in Section 10. We will respond within a reasonable time, and in any event within the timeframes POPIA requires.

9 · CHILDREN'S INFORMATION

The Site is intended for business use and is not directed at children. We do not knowingly collect personal information from children without the consent of a competent person (such as a parent or guardian) as required by POPIA. If you believe a child has provided us with personal information without appropriate consent, please contact us so we can delete it.

10 · OUR INFORMATION OFFICER, AND HOW TO CONTACT US

Any request, question, or complaint regarding this Privacy Policy or our handling of your personal information can be directed to:

David John Wilson, Information Officer

Nebula Marketing Group (Pty) Ltd

Email: hello@nebulamarketing.digital

11 · COMPLAINTS TO THE INFORMATION REGULATOR

If you believe we have not adequately addressed your concern, or have processed your personal information unlawfully, you may lodge a complaint with South Africa's Information Regulator:

Information Regulator (South Africa)

Physical address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

General enquiries: enquiries@inforegulator.org.za

POPIA complaints: POPIAComplaints@inforegulator.org.za

Tel: 010 023 5200 · Toll-free: 0800 017 160

Website: inforegulator.org.za

12 · CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, the tools we use on the Site, or the law. The version published on the Site is always the current one; material changes will be reflected by an updated effective date at the top of this page.