Privacy notice
What NCA collects when you use ncacollective.com, why, who else sees it, how long we keep it, and what you can do about it. Written to meet South Africa’s Protection of Personal Information Act (POPIA).
Last updated
Who we are
This notice covers the website ncacollective.com, run by NCA · New Creative Authority, also known as NCA Collective. We are the "responsible party" under POPIA, which means we decide why and how your personal information is used.
- Address: 100 Voortrekker Road, Salt River, Cape Town, 7925, South Africa
- Email: john@ncacollective.com
- Phone: +27 76 146 9882
- Information Officer: John Daniels, Chief Executive Officer. Write to the email address above and mark it for the Information Officer.
What we collect, and why
We collect only what each part of the site needs. Here is every place information comes in.
| What | When | Why | Our basis |
|---|---|---|---|
| Your name, email address, phone number and message | You send us an enquiry, a campaign brief, a booking request or a course seat request | To reply to you and do the work you asked about | Your request, and our legitimate interest in answering enquiries |
| Pages visited, time on site, device and browser type, where you came from, and your approximate location (city and country) | You browse the site, through Google Analytics | To understand which pages are useful and how to improve the site | Our legitimate interest in running and improving the site |
| Your Discord user ID, username and avatar | You choose "Verify with Discord" to enter the members area | To confirm you are in the NCA Discord server and greet you by name | Your consent, given on Discord’s own approval screen |
| Your name, email, phone number, delivery address, what you ordered, payment status, and the time you accepted the terms | You place a pre-order or purchase (when we open them) | To take payment, hold your items, deliver your order and keep proper records | The contract between us, and our legal duty to keep financial records |
| A scrambled (hashed) version of your IP address | You place a pre-order (when we open them) | To stop one connection from grabbing all the stock or spamming orders. We cannot turn the scramble back into your IP address. | Our legitimate interest in preventing abuse |
| Whether you want news about future drops | You tick the optional marketing box when ordering (when we open pre-orders) | To send you news about NCA drops and projects | Your consent, which you can withdraw at any time |
| Standard server records: your IP address, browser, and the pages you request | Every visit, kept by our hosting provider | To keep the site running, secure and free from attacks | Our legitimate interest in security |
You do not have to give us any of this, but without the details we need we cannot do the related thing: we cannot answer an enquiry without a way to reply, or deliver an order without an address. Sending us your information is always voluntary.
What stays on your device and never reaches us
Some tools on the site keep their data only in your own browser. We never receive it, and clearing your browser data erases it.
- CV Studio (members area): everything you type into your CV is stored in your browser as you work, and the PDF is made on your own device.
- Your bag, if you add items to it.
- Course progress in NCA.EDU classrooms: which episodes you have marked as watched.
Payments
When we take payments, you pay on the page of our payment provider, Paystack. Your card or bank details go to Paystack and never pass through our website or servers. We receive confirmation that a payment succeeded, the amount, and a payment reference.
Cookies and similar technologies
A cookie is a small file a website saves in your browser. We use two kinds: ones the site needs to work, and one analytics set.
| Name | What it does | How long | Kind |
|---|---|---|---|
| _ga and _ga_P18QD5YBZM | Google Analytics. Tells visits and visitors apart so we can count them. | Up to 2 years | Analytics |
| nca_member | Keeps you signed in to the members area. Signed so it cannot be forged, and hidden from scripts on the page. Set only after you sign in with Discord. | 7 days | Needed for sign-in |
| nca_oauth_state | A security check while you sign in with Discord, so a sign-in cannot be hijacked. | 10 minutes | Needed for sign-in |
| nca:on-air | Remembers that you have already seen the opening sequence in this visit. | Until you close the tab | Needed for the site |
| nca:cart, nca:cv, nca:edu:* | Your bag, your CV, and your course progress (see above). | Until you clear your browser data | Needed for the tool |
You can block or delete cookies in your browser settings, though the members area will not work without its sign-in cookies. To stop Google Analytics from counting your visits on any website, install Google's opt-out browser add-on.
Who else sees your information
We use a small number of companies to run the site. They handle your information only to provide their service to us, not for their own purposes (except where noted).
- Google (Analytics): receives visit data from your browser. Google acts under its own privacy terms for this data.
- Vercel: hosts the website.
- Discord: handles the sign-in. You approve what is shared on Discord’s own screen, and we ask only for your identity and the list of servers you are in, to check you are in ours. We do not keep the list and we do not read your messages.
- Amazon Web Services: hosts our database (in Stockholm, Sweden), which holds pre-order records when pre-orders open.
- YouTube and Vimeo: some articles include a video. Nothing is loaded from YouTube or Vimeo until you press play; once you do, that service receives your visit under its own privacy policy (YouTube videos play from its reduced-cookie domain).
- Paystack: processes payments.
- Resend: sends order confirmation and shipping emails.
- Couriers: when we post an order to you, the courier receives your name, address and phone number so they can deliver it.
We do not sell your personal information, and we do not hand it to advertisers. We may disclose it if the law requires us to, or to protect our rights or someone’s safety.
Information sent outside South Africa
Several of the companies above run their systems outside South Africa, including in the United States and Europe, so your information may be processed there. We choose providers that commit to protecting personal information, and where POPIA requires it we rely on your consent or on the contract between us. If you would like to know more about where your information is processed, ask us.
How long we keep it
- Enquiries and emails: for as long as we need to deal with your enquiry and any work that follows, and for a reasonable time after.
- Analytics data: for no longer than 14 months, the longest period Google Analytics allows for detailed data.
- Members sign-in: the sign-in cookie lasts 7 days. We keep no record of your Discord details on our systems.
- Orders: for as long as we need them to fulfil your order, handle returns and queries, and then for the period South African tax and accounting law requires us to keep financial records.
- Delivery addresses and phone numbers: we remove or anonymise them once an order has been delivered and any query window has passed, unless the law requires us to keep them.
- Marketing: until you withdraw your consent or ask us to stop.
How we protect it
We take reasonable technical and organisational steps to keep your information safe. The whole site uses an encrypted connection. Sign-in cookies are signed and cannot be read by scripts running on a page. Order information sits in a database that only our own server can reach, and access to the order administration tools is protected by secret keys. Your payment card details are never on our systems. No system is perfectly secure, so if we ever find that your information has been accessed without permission, we will tell you and the Information Regulator as POPIA requires.
Your rights
Under POPIA you can ask us to:
- tell you whether we hold personal information about you, and give you a copy;
- correct information that is wrong or out of date;
- delete information we no longer need or have no right to keep;
- stop using your information for a purpose you object to, including direct marketing;
- and you can withdraw consent you have given us at any time. Withdrawing does not undo what we lawfully did before.
Email john@ncacollective.com and tell us what you would like. We may need to confirm it is really you before sharing or changing anything. We aim to respond within 30 days.
If you think we have handled your information wrongly and we have not put it right, you can complain to South Africa’s Information Regulator at complaints.IR@justice.gov.za or through inforegulator.org.za.
Children
The site is not aimed at people under 18, and orders must be placed by an adult or with a parent or guardian’s permission. If you believe a child has sent us personal information without that permission, tell us and we will delete it.
Other websites
The site links to other places, including YouTube, TikTok, Instagram and Discord. Once you leave our site, those services handle your information under their own policies, not this one.
Changes to this notice
If what we collect or how we use it changes, we update this page and the date at the top. If the change matters to you, for example a new kind of information, we will make that clear when we ask for it.