Section 01
Who We Are
NanoGram is an AI automation agency based in Sandton, Johannesburg, South Africa. We build automation solutions exclusively for South African real estate agencies, focusing on compliance (FICA, KYC, POPIA), financial operations, and lead management.
For the purposes of the Protection of Personal Information Act 4 of 2013 ("POPIA"), NanoGram acts as the Responsible Party in respect of personal information collected directly through this website, and as an Operator in respect of personal information processed on behalf of our clients (real estate agencies).
Our designated Information Officer is responsible for overseeing compliance with POPIA. Contact details are set out in Section 13.
Section 02
Information We Collect
2.1 Information you give us directly
- Enquiry and contact forms - name, email address, phone number, agency name, and any details you include in your message.
- Service onboarding - identity documents, proof of address, company registration details, and other information required to set up your account and comply with FICA.
- Communications - emails, calls, or messages you send to us.
2.2 Information collected automatically
- Usage data - pages visited, time on site, referring URL, device type, browser, and operating system.
- IP address - collected by our web hosting and analytics provider.
- Cookies and similar technologies - see Section 10.
2.3 Information we receive from clients (as Operator)
When NanoGram processes personal information on behalf of a real estate agency client, the client is the Responsible Party and NanoGram acts as Operator. This may include personal information about the agency's own clients - property buyers, sellers, landlords, tenants, and beneficial owners - processed for KYC verification, FICA onboarding, financial operations, and lead management automation. This processing is governed by our Data Processing Agreement with each client, not this policy.
What we do not collect
We do not knowingly collect special personal information (race, religion, health, sexual orientation, biometric data, criminal history) through this website. If your enquiry involves such information in a professional compliance context, it will be handled in accordance with the applicable Data Processing Agreement.
Section 03
How We Use Your Information
| Purpose | Information Used |
|---|---|
| Respond to website enquiries | Name, email, phone, message content |
| Onboard and deliver services to clients | Identity, company, and financial information |
| Issue invoices and manage payments | Contact details, company registration, banking information |
| Comply with legal obligations (FICA, POPIA, PRECCA) | Identity documents, onboarding data |
| Improve our website and services | Usage data, cookies, aggregated analytics |
| Send service-related communications | Email address, name |
| Marketing (with your consent) | Email address, name, agency name |
We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.
Section 04
Lawful Basis for Processing
Under POPIA, NanoGram processes personal information only where we have a valid condition for processing. The conditions we rely on are:
- Contract - processing is necessary to perform our services agreement with a client, or to take steps prior to entering into such an agreement.
- Legal obligation - processing is required to comply with applicable law, including FICA, FIC Directive 11 (2026), and PRECCA.
- Legitimate interest - processing is necessary for our legitimate interests (such as website analytics and fraud prevention) and does not override your privacy rights.
- Consent - where we send direct marketing communications, we will first obtain your consent and you may withdraw it at any time.
Section 05
Who We Share Your Information With
NanoGram shares personal information only where necessary and always under binding data protection obligations. Third parties we work with include:
| Party | Role | Purpose |
|---|---|---|
| Anthropic, PBC (USA) | Sub-operator | Claude LLM API - AI-powered document processing and KYC automation |
| n8n GmbH (Germany) | Sub-operator | Workflow automation platform |
| Peach Payments / PayFast | Sub-operator | Payment processing |
| Google (Analytics / Workspace) | Sub-operator | Website analytics and business productivity tools |
| SA attorneys (as required) | Professional advisor | Legal compliance and contract review |
| Financial Intelligence Centre (FIC) | Regulatory authority | Reporting obligations under FICA |
| SARS | Regulatory authority | Tax filing and compliance (VAT201, EMP201) |
We may also disclose personal information where required by law, court order, or regulatory authority - including the Information Regulator.
Section 06
Cross-Border Transfers
Some of our sub-operators (including Anthropic and n8n) are based outside the Republic of South Africa. Where personal information is transferred outside South Africa, NanoGram ensures such transfers comply with POPIA section 72, meaning the recipient country or party provides an adequate level of protection, or appropriate safeguards (such as contractual protections) are in place.
Anthropic maintains data processing agreements and privacy protections consistent with applicable data protection law. You can review Anthropic's privacy practices at anthropic.com/privacy.
Section 07
How Long We Keep Your Information
- Website enquiries - retained for up to 2 years from last contact, or until you request deletion.
- Client records - retained for the duration of our services agreement plus 5 years, to comply with FICA record-keeping requirements (FICA section 22).
- Financial records - retained for 5 years in accordance with the Income Tax Act and VAT Act.
- Marketing consent records - retained until consent is withdrawn and for a reasonable period thereafter for compliance purposes.
Personal information is securely deleted or anonymised once the applicable retention period expires, unless we are required by law to retain it for longer.
Section 08
Your Rights Under POPIA
As a Data Subject, POPIA grants you the following rights in relation to your personal information:
Right of Access
Request confirmation of whether we hold your personal information and obtain a copy.
Right to Correction
Request that we correct inaccurate, misleading, or incomplete personal information.
Right to Deletion
Request deletion of personal information we no longer have a lawful basis to retain.
Right to Object
Object to processing based on legitimate interest, including direct marketing.
Withdraw Consent
Withdraw consent for processing at any time, where consent was the lawful basis.
Lodge a Complaint
Submit a complaint to the Information Regulator if you believe your rights have been violated.
To exercise any of these rights, contact our Information Officer at nanogramza@gmail.com. We will respond within 30 days of receiving your request. We may need to verify your identity before fulfilling certain requests.
Information Regulator
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Regulator of South Africa: inforeg@justice.gov.za | +27 (0)10 023 5207.
Section 09
Security
NanoGram takes the security of personal information seriously. We implement appropriate technical and organisational measures to protect personal information against loss, damage, destruction, or unlawful access, as required by POPIA section 19. These include:
- Encryption of personal information in transit (TLS) and at rest
- Role-based access controls and multi-factor authentication
- Regular security assessments and vulnerability management
- Staff training on data protection obligations
- Incident response procedures for security compromises
In the event of a security compromise affecting your personal information, we will notify you and the Information Regulator as required by POPIA section 22, without undue delay.
While we take all reasonable precautions, no method of electronic transmission or storage is 100% secure. We encourage you to contact us immediately at nanogramza@gmail.com if you suspect any unauthorised access.
Section 10
Cookies & Tracking
Our website uses cookies and similar technologies to operate correctly and improve your experience. We use:
| Cookie Type | Purpose | Can You Opt Out? |
|---|---|---|
| Essential | Required for the website to function (session management, security) | No - necessary to use the site |
| Analytics | Understand how visitors use our site (Google Analytics - anonymised) | Yes - via cookie banner or browser settings |
| Marketing | Track ad campaign performance (Google Ads conversion tracking) | Yes - via cookie banner |
You can manage cookie preferences through our cookie consent banner or by adjusting your browser settings. Note that disabling certain cookies may affect the functionality of the site. For Google's cookie and privacy practices, see policies.google.com/privacy.
Section 11
Children
Our website and services are directed at business clients - South African real estate agencies and their representatives - and are not intended for persons under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, please contact us at nanogramza@gmail.com and we will delete it.
Section 12
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law. When we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, notify you by email.
We encourage you to review this policy periodically. Your continued use of our website or services after changes are posted constitutes acceptance of the updated policy.
Section 13
Contact Us
To exercise your data subject rights, raise a concern, or ask any questions about this Privacy Policy or how NanoGram handles personal information, please contact our Information Officer: