Privacy notice

Who is responsible

XINNACE operates this card service, through Xinnace (Pty) Ltd, registration number 2025/316516/07, registered address 22 Umhlanga Boulevard, Umhlanga, KwaZulu-Natal, 4321, South Africa. Which of us is answerable to you under POPIA depends on whose information it is, and it is worth being clear about, because it decides who you ask.

For a card that belongs to an employee

Their employer is the responsible party. The employer decides that a card exists, what goes on it, and when it comes down. XINNACE processes that information on the employer's instructions and is their operator, on the terms of our Operator Addendum with them. Ask the employer first; we will act on their instruction, or pass a request on to them if you send it to us.

For a custom card, and the brief it was built from

XINNACE is the responsible party. A custom card is sold to the person or business it is for, so there is no employer between us: ask us directly. See If you have a custom card.

For enquiries sent through our own form, and for our own account holders

XINNACE is the responsible party, and you can deal with us directly.

Contact: privacy@xinnace.co.za
Marked for the attention of the Information Officer.

If you opened someone's card

You do not need an account, and we do not ask you for anything. What a card records is deliberately thin, and this is the whole of it.

What is recorded when you open a card

• That a view happened — which card, and whether it was a page view, a QR scan, a saved contact, a share, or a tap on one of the links.
• Whether you were on a phone, a tablet or a computer. That category, and nothing else about your device.
• A visitor code that changes every day. It is made by hashing your IP address together with your browser's user-agent string, the date, and a secret we hold. It lets the cardholder see that a card was opened by six people rather than once by six people, and it cannot be used to recognise you tomorrow, because tomorrow it is a different code. We do not store your IP address itself.
• The date and time.

What is not

• No cookie is set. Opening a card, saving the contact or scanning a QR code sets no cookie and sends nothing to anyone else. You will only receive a cookie from us if you use the enquiry form or sign in, and then it is to protect that form and to keep you signed in — never to follow you.
• One thing is remembered, and only by the tab you are reading in. The card plays a short opening turn the first time you see it. So that it does not replay every time you come back to the page, the card notes that you have seen it — in your browser's session storage, which belongs to that one tab and is erased when you close it. It is a single yes, it never reaches us, and it cannot be read by any other site. Nothing else is stored on your device.
• A copy is kept only on a cardholder's own phone, and only if they ask for one. The person a card belongs to can add "My Card" to their home screen, so their QR code opens in one tap. That keeps a copy of their own card on their own phone so it opens without signal. It is refreshed whenever the phone is online, it is deleted the first time the phone learns the card is no longer active, and it never reaches anyone else. Nobody who opens somebody else's card is offered it, and nothing is kept on their device.
• No advertising or analytics trackers. There is no Google Analytics, no Meta pixel, no tag manager, no third-party script of any kind on a card.
• No location. We do not ask for it and the page is served with permission to use it switched off.
• No name, no email, no account. We do not know who you are, and nothing on the card is trying to find out.
• Not where you came from. We used to record the website that referred you and never once looked at it, so we stopped collecting it.

The cardholder's employer sees counts and trends — how many views, on what days, from what kind of device, which links were tapped. They never see a list of visitors, because there is no such list to see.

If you filled in the enquiry form

The Need a card? form is how you ask us about getting cards. It is the one place on a card where we ask you for anything, and it is entirely voluntary — nothing follows from leaving it alone except that we will not contact you.

We also record which card you came from, so we can thank the customer whose card sent you, and a one-way hash of your IP address, which is how the form resists being used by a bot to send us thousands of fake enquiries. We do not keep the address itself.

If you reached us through a link we posted — on LinkedIn, say — that link carries a short label we put on it, naming where we posted it and which post it was. We keep that label with your enquiry so we know which of our posts is worth writing again. It is part of the address you followed, not something read from your device, and nothing about your visit is recorded unless you send the form.

Where it goes. Your enquiry is emailed to XINNACE staff who handle sales enquiries, and stored so we can pick the conversation up again. Our email runs on Google Workspace, so it passes through Google's systems on the way to us. We use what you send to answer you. We do not sell it, and we do not add you to a marketing list off the back of an enquiry.

Our lawful basis is your own action in sending it: you gave us the details in order to be contacted about a product, which is a legitimate interest of both of us. You can ask us to delete the enquiry at any time and we will, unless we are still in the middle of a conversation you started.

If your employer gave you a card

If your employer issues you a card, the information on it is information your employer decided to publish. That is their decision to make and their responsibility to justify — but you should know exactly what is involved, because a digital card is public in a way a paper one is not.

What appears on your card

Your name, job title, department, photograph, work phone numbers, work email address, a work address if your employer adds one, the links your employer publishes, and a short biography if one was written. Your employer's details appear alongside them. Anyone with the link or the QR code can see all of it without signing in.

Every card is served with an instruction to search engines not to index it, unless it is listed in the directory — which needs your own agreement. Reputable search engines follow that instruction. It is a request rather than a lock, though: anybody with the link can still open the card, and a link somebody publishes elsewhere can lead people to it.

What your employer controls and you do not

Your employer decides which parts of your card you can change yourself. Unless they choose otherwise, you can change your mobile number, biography and profile photo, and your display name, job title, department, office number, public email and address are set by them — many of those are employment records rather than personal preferences.

What we send you

When your employer sets you up, we email you once at your work address: an invitation with a link to choose your own password. We never send you a password, and there is none stored anywhere for us to send — the link is the only way in, it works once, and it stops working after 7 days. After that, apart from the directory question below, the only emails you will get from us are ones you ask for: a password reset link when you request one, and a note telling you your password changed, which exists so that a change you did not make does not go unnoticed.

One more, and only if it happens: if your employer asks for your card to be listed in the directory, we email you to ask whether you agree, because that decision is yours rather than theirs.

We do not send marketing, and there is nothing to unsubscribe from.

What we hold beyond the card

• Your sign-in email address and a hash of your password. We never store the password itself and cannot recover it.
• A record of sign-ins to your account — success or failure, the kind of device, and a hash of the IP address. This is how an intrusion gets noticed.
• An administrative record of changes made to your card and by whom.
• The uncropped original of any photograph you upload, kept so a crop can be redone without asking you for the picture again. Location data in the photograph's metadata is stripped and never stored.

If you want your card taken down, ask your employer — it is their decision, not ours. If they instruct us, we will remove it. If you believe it should come down and your employer disagrees, you can complain to the Information Regulator; see Complaints.

If you have a custom card

A custom card is set up and hosted by us for one person, for a fixed term paid for by them or by their business. There is no employer in between, so XINNACE is the responsible party for everything in this section, and you deal with us directly.

The card brief

Before a card is quoted we may send you a card brief: a short form, issued to your email address or mobile number and opening only for the one it was sent to. It asks for:

• The name, professional designations, job title, firm and any regulatory wording the card should carry.
• Your mobile, office and WhatsApp numbers, email address, website and physical address — with, for each, whether it may be shown on the card or is only for us to reach you.
• Your social and website links, and the order you want them in.
• Your brand: colours, typeface, something to work from, and whether any of the branding belongs to somebody else.
• A short line about you, the term you want, and who else may ask us for changes later.
• Your logo and photograph, if you upload them.

When you send it, we record your agreement that the details you marked as public may be published on your card: the email address or number the form was opened with, the date and time, and a one-way hash of the connection it came from. The hash cannot be turned back into an address. A brief link that is never used stops working after 14 days.

What we send you

The brief link; an order form for the card, and a confirmation when you accept it; the invoice and, if it goes unpaid, reminders; notices as the card's term nears its end; and, if you ask, a link to add My Card to your phone's home screen. If your card is proposed for the directory, we ask you first. We do not send marketing.

Where it goes

What you marked as public is published on your card, as with any card. The rest — anything you marked private, your brief, your order and your invoices — stays with us and the providers named in Who else sees it. The page your card is built on is written with the help of an AI tool, which is never given your details; see Information that leaves South Africa.

How long it is kept

Your brief, and the files you uploaded with it, are kept as the record of what you asked for and agreed to publish, whether or not a card is made from it, until you ask us to delete them.

When your card's term ends and is not renewed, the card stops working at once: its address, its QR codes and its save-to-contacts all stop. Its details are not deleted. They are kept, with its design and its address, so it can be renewed without being rebuilt, until you ask us to delete them. Invoices keep your name and email address either way, because a tax record has to.

To see, correct or delete any of it, write to privacy@xinnace.co.za.

If your card is in the directory

The directory at cards.xinnace.co.za/directory lists businesses that have asked to be listed. A listing shows one card, and anyone can find it by searching a name, an industry or a service.

It is not open yet. A listing can be requested and agreed now, but nothing is shown until the directory opens.

Your card is only there because you said it could be. Your employer — or, for a custom card, the business it was sold to — decides whether to advertise. They do not decide this part. Your card carries your name, your photograph and your contact details, and putting those somewhere they can be browsed and searched is a different thing from having a card at an address you hand out — so we ask you directly, by email, and nothing appears until you answer. If you decline, or simply never reply, your card is not listed and nothing else about it changes.

The legal ground is your consent, under section 11(1)(a) of POPIA, and what we keep as the record of it is: the exact sentence you were shown, the date and time you agreed, and a one-way hash of the connection it came from. The hash cannot be turned back into an address; it exists so we can show the agreement was given, not so we can work out where you were.

You can withdraw at any time, without giving a reason, by writing to sales@xinnace.co.za. We take the listing down; your card itself is untouched and goes on working exactly as it did. Withdrawing does not undo the fact that the listing was public while it was up, which is why we ask before rather than after.

Two things worth being plain about. A directory is meant to be found, so search engines may index a listing and may keep a copy in their own caches for a while after it comes down — that is outside our control, and it is part of what you are agreeing to. And the card shown in the directory is the live card, not a snapshot, so a change you make to your card shows there too.

Nothing extra is collected because of a listing. It shows the card you already have, and the views it earns are counted the same way as any other visit — see If your employer gave you a card.

How long we keep things

POPIA says information may not be kept longer than the purpose needs. These periods are enforced by an automatic deletion built into the service — they are not a description of what we intend to do, they are what the system does whether anyone remembers or not.

One exception, stated plainly: invoices keep the name and email address of each person billed for, and survive the deletion of the card, because a tax record has to show what was charged and for whom.

Who else sees it

We do not sell personal information, and we do not share it for advertising. It reaches only these hands:

• The employer whose card it is — their own cards and their own analytics, never another company's.
• XINNACE staff — only where support or billing requires it, and every administrative action is recorded.
• Our hosting provider, which runs the servers the service sits on, in South Africa.
• Google — for email delivery only (Google Workspace). See below.
• Anthropic — the AI assistant used as a tool when writing a custom card's page. It is given the design brief and placeholder text, never the details of the person the card is for. See below.
• Anyone the law obliges us to tell, where we are legally required to and the request is valid.

Information that leaves South Africa

One thing crosses the border, and we would rather tell you than have you discover it. A second is set out below because an earlier version of this notice said it crossed too — it does not, and saying so plainly is better than removing the paragraph and hoping nobody kept a copy.

Email. Our email runs on Google Workspace, so every email between you and us passes through Google's systems, which are outside South Africa: enquiries you send us, and what the service sends you — invitations and password links, card briefs, order forms and their confirmations, invoices and reminders, renewal notices, directory listing requests and My Card links.

That is a transfer to the United States under section 72 of POPIA, made on the basis that it is necessary to perform the service you are using, and to a recipient bound by its own data protection commitments.

Building a custom card. A custom card's page is written by hand for one client, and we use an AI assistant — Claude, operated by Anthropic in the United States — as a tool while writing it. What that tool is given is the design brief: what the card should look like and do, the colours and typefaces, the kind of business it is for, and invented placeholder text standing in for the real content.

The individual's own details are not among them. The page that gets built is a template with gaps in it. The name, job title, telephone numbers, email address, physical address and photograph are put into those gaps by this platform, from the record held here, at the moment somebody opens the card — which is also why correcting a telephone number is an edit on one screen rather than a rebuild. They are never sent to the tool, and neither is anything else: card analytics, sign-in records, invoices and the enquiries other people send us all stay here.

So no personal information leaves South Africa for this, and section 72 does not apply to it. An earlier version of this notice said the opposite — that the details the card was about to publish passed through the tool — and described a second transfer to the United States on that basis. That was wrong, and it was wrong in the direction of claiming to send more than we do. It is corrected here rather than quietly deleted, because a privacy notice that changes what it says without saying so is worth less than one that admits it.

This applies to custom cards only. A company card built by an organisation in the Service's own builder does not go near the tool at all, and neither does any employee record.

Looking at a card does not. An earlier version of this notice said that the typefaces cards are set in were fetched from Google Fonts, which sent your IP address and the address of the card to Google every time one was opened. Those typefaces are now served from our own servers in South Africa, and that transfer no longer happens. Opening a card contacts us and nobody else.

Your rights

Under POPIA you may:

• Ask what we hold about you, and get a copy.
• Have it corrected if it is wrong, or completed if it is half a picture.
• Have it deleted where we no longer have a reason to keep it.
• Object to us processing it, on grounds relating to your situation.
• Complain to the Information Regulator.
• Go to court over a breach of the Act.

If you have an account, you do not need to ask us for the first one. Sign in and open My data: it shows everything held about you, right then, and lets you download a copy. Signing in is the proof of identity, so there is nothing to wait for.

Otherwise, write to privacy@xinnace.co.za. We answer within 30 days. We will ask you to prove who you are first — handing someone's information to a stranger who claimed their name would be the very thing this notice exists to prevent.

To be deleted, ask your employer: they issued the card, so it is theirs to take down, and they can erase your details immediately rather than waiting out the 90-day period that follows an ordinary removal. What survives either way is the record of the days your card was billed for, which a tax record has to keep.

If the request concerns a card your employer issued, we will tell you so and pass it to them, because they decide what is on it. We will not sit on a request without telling you where it went.

How it is protected

• Everything travels over an encrypted connection, enforced by the browser.
• Passwords are stored as one-way hashes and cannot be read back, by us or anyone with the database.
• IP addresses are hashed with a secret before storage. This is not the same as anonymous — someone who obtained both the database and the secret could reverse it — so we bound the exposure with the retention periods above rather than claim more than is true.
• One company's information is separated from another's at every query.
• Administrative actions are recorded, including where a staff member acts on a customer's behalf.
• Sign-in and form submissions are rate limited, and forms are protected against being submitted from other sites.

If a breach happens that puts your information at risk, we will notify the Information Regulator and you, as section 22 requires.

Complaints

Tell us first if you can — privacy@xinnace.co.za — but you are not obliged to, and you can go straight to the regulator.

Access to information (PAIA)

Separately from your POPIA rights above, you have rights of access to records under the Promotion of Access to Information Act. A request can be sent to our Information Officer at the address in Contact us below.

Changes to this notice

When what the service does changes, this notice changes with it, and the date at the top moves. If a change materially affects people who already hold cards, we will tell the companies whose cards they are rather than rely on you re-reading this page.

Contact us

Information Officer: Poobalan Soobramoney, Chief Executive Officer