Privacy Policy

Applies to: the Nia Within web application, its WhatsApp assistant, and the public website.

---

1. Who we are

Nia Within ("the Platform") is provided by Nia Impact (trading as Nia Impact Invest), company number 221851, registered address Lot 02, Floor 1, CentrePoint, Trianon, Mauritius.

Under South Africa's Protection of Personal Information Act 4 of 2013 ("POPIA") we are the responsible party. Where the EU General Data Protection Regulation ("GDPR") applies to our processing of your information — for example because the Platform is made available to you in the European Union — we are the controller. The South African data-protection roles this policy assigns — responsible party, operator and Information Officer — are under review by our legal counsel following the move to a Mauritius entity

Trigger Consulting built the Platform and runs it on our behalf. It acts as our operator (POPIA) / processor (GDPR) and may only process your information on our written instructions.

Our Information Officer under POPIA is name and title to be supplied.

Privacy contact for all requests and questions: sarah@niaimpactinvest.com

This provision is being finalised with our legal counsel and will be published in a later version.

2. Who this policy covers

The Platform is invitation-only. You will only have an account because a fund manager (a "GP") or Nia invited you. This policy covers:

• GP staff — people who work at a fund that uses the Platform to report to its investors;
• Portfolio-company (investee) staff — people whose data a GP uploads on their behalf, or who use the WhatsApp assistant from a number the GP registered (they do not hold accounts);
• LP contacts — people at investors who receive reports or are recorded as a contact;
• Visitors to the public website.

If you are an LP contact or an investee contact, some of your information (typically your name and work email) is entered by the GP you deal with, not by you (see section 4).

3. What we collect

We collect and hold the following categories of personal information. We list categories, not every field; the full inventory is available on request.

Supply is generally mandatory for the fields marked with an asterisk in our forms (name and email are required to hold an account). If you do not provide them we cannot create or maintain your account. Nothing in this policy is collected under a specific law that requires it.

Please do not upload special personal information (POPIA section 26 / GDPR Article 9 — health, religion, race, biometrics and similar) about identifiable individuals, or information about children (POPIA section 34). The Platform is designed for organisational impact data; free-text documents are stored as you upload them, and we ask you to remove personal details that are not needed. The South African references in this paragraph are under review by our legal counsel following the move to a Mauritius entity

4. Where your information comes from

Most information comes directly from you or is generated by your use of the Platform. Three kinds come from someone else:

1. Invitations — the administrator who invites you provides your email address.
2. Contact records — a GP may record your name and work email as an LP or portfolio-company contact so that reports and reminders reach you.
3. WhatsApp registration — a GP administrator registers a phone number so that the person using it can talk to the assistant.

If we hold information about you that you did not provide, this policy is our notice to you under POPIA section 18(1) and GDPR Article 14. We will provide it as soon as reasonably practicable after we receive your details (POPIA section 18(2)) and, where GDPR applies, at the latest when we first contact you and in any event within one month of receiving them (GDPR Article 14(3)). The South African references in this paragraph are under review by our legal counsel following the move to a Mauritius entity

5. Why we use your information, and on what basis

Our legitimate interest is operating a secure reporting service for the fund or company that invited you, which is also that organisation's interest and, in most cases, yours. We do not use your information for marketing, profiling or advertising, and we do not sell it. The South African justifications in the table above are under review by our legal counsel following the move to a Mauritius entity

This provision is being finalised with our legal counsel and will be published in a later version.

Automated decision-making. The Platform uses AI to draft narratives, flag data-quality issues, suggest KPI mappings, assess whether evidence looks sufficient and answer questions in the assistant. Every such output is advisory: outputs that feed the reporting workflow are reviewed and accepted (or rejected) by a person before they take effect, and assistant answers are shown to you as information for you to judge and have no automatic effect. We do not make decisions about you by automated means that have legal or similarly significant effects (POPIA s 71 / GDPR Art 22). The South African reference in this paragraph is under review by our legal counsel following the move to a Mauritius entity

6. AI processing and the external document parser — please read

We tell you this plainly because it is the part of the Platform most likely to matter to you.

a) AI models. When you use the assistant, generate a narrative, run a data-quality check or upload documents for indexing, the relevant text — which can include passages from your organisation's documents — is sent through OpenRouter, Inc. (United States), an AI routing service, to one of the following model hosts: Anthropic, Google (Vertex AI), Amazon Web Services (Bedrock), Microsoft (Azure OpenAI) or OpenAI. Requests are configured so that they may only be served by endpoints that do not retain the content and do not use it for training ("zero data retention"). The models in use today are Anthropic's Claude models (served on Amazon Bedrock or Google Vertex AI zero-retention endpoints); Nia can switch a task to a Google Gemini or OpenAI GPT model from a short vetted list. Embeddings (numerical representations used for search) are sent only to a zero-data-retention endpoint through the same routing service; today that endpoint is at Microsoft Azure, the only one listed for the embedding model. A request that cannot be served under these rules fails rather than being sent elsewhere.

b) Document parser. When you upload an LP reporting template or a data submission as a PDF, image or scanned file — or as a Word file whose text the Platform cannot read itself, or as a PDF or Word data submission in which the Platform's own reader finds no reportable figures — the complete file is sent to LlamaIndex Inc. (LlamaCloud / LlamaParse) to be converted into text and tables. We instruct the service not to cache the document for reuse. Documents are processed in LlamaCloud's European Union region (api.cloud.eu.llamaindex.ai). Spreadsheet and CSV files, Policy Hub and knowledge documents, and files attached to an assistant conversation are always read on the Platform itself, and Word and PDF files are read on the Platform first; text from them may still be sent to the AI models described in (a). A plain-language explanation is in How the platform uses AI.

c) What we keep. The extracted text and tables, and the assistant's answers, are stored on the Platform (sections 3 and 10). Nia and Trigger Consulting do not train AI models on your data.

7. Who receives your information

We share personal information only with the service providers listed below, each of which processes it on our instructions under written data-processing terms (section 8 records the terms that have been accepted), and with your own organisation's administrators, who can see the members and content of their organisation. We publish and maintain a full sub-processor list and will notify organisation administrators before adding a provider.

We may also disclose information where the law requires it, to a regulator, or to establish or defend legal claims. We do not share your information with any other third party.

8. International transfers

Because our providers operate outside South Africa, and some outside the European Union, your information will be transferred across borders.

• From South Africa (POPIA s 72): we transfer only to providers bound by a written agreement that upholds protections substantially similar to POPIA, including limits on onward transfer (s 72(1)(a)). Nia has accepted the standard data-processing terms of each provider listed in section 7, as at 4 September 2026. The South African transfer ground relied on in this bullet, and the framing of transfers as leaving South Africa, are under review by our legal counsel following the move to a Mauritius entity
• For people in the EU (GDPR Chapter V): transfers to countries without an adequacy decision rest on the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914) incorporated into each provider's data-processing agreement, together with the technical measures described in sections 6 and 9. Where a provider is certified under the EU-US Data Privacy Framework we may also rely on that adequacy decision. Provision to be finalised in a later version

You may ask us for a copy of the safeguards in place by writing to the privacy contact.

9. How we protect your information

• All traffic is encrypted in transit (HTTPS); providers encrypt stored data at rest.
• Sign-in is protected by rate limiting; two-factor authentication is available to every user and is required for platform administrators; passkeys are supported.
• Each organisation's data is isolated in the application, which checks your organisation membership on every request; the WhatsApp assistant only answers numbers an administrator has registered, and derives the organisation from that registration alone.
• Sensitive operations (deleting your account, changing your email, enabling 2FA) require a recent sign-in.
• Significant actions are recorded in an audit trail. Support access by Nia or Trigger Consulting staff to your organisation's workspace is logged with a stated reason.
• AI requests are restricted to zero-retention endpoints; the document parser is instructed not to cache your files.
• Off-site database copies were taken from 1 September to 3 September 2026; the job that takes them is not running on a schedule at present, so no retention window is promised for database backups. The control for restoring the database is the database provider's continuous 6-hour point-in-time recovery window.

No system is perfectly secure. If we become aware of a security compromise affecting your personal information, we will notify the Information Regulator and affected people as soon as reasonably possible (POPIA s 22) and, where GDPR applies, the competent supervisory authority within 72 hours (GDPR Art 33) and you without undue delay where the risk to you is high (Art 34). Our incident procedure is documented in our internal incident-response runbook and is owned by our Information Officer (section 1). The South African regulator named in this paragraph and the notification duty relied on are under review by our legal counsel following the move to a Mauritius entity

10. How long we keep your information

The periods below are the settings and controls on the Platform today; where a control is not yet operating, the table says so.

When you delete your account (section 11), your sign-in, credential, membership and notification records are removed immediately. Audit-trail entries recorded in your name are kept, with your name removed: the entry keeps what was done and when, and you are replaced by a non-identifying label (for example "deleted admin #a1b2c3d4") — never your name and never your email address. Content you created on behalf of your organisation remains part of that organisation's records with your name removed, and any organisation or platform setting you changed keeps the value you gave it, with the setter's name removed. Administrator accounts are deleted the same way, in Settings or on request. A deleted record persists in the file backup copies until they are deleted 35 days after they were taken, and in any database backup copy that exists until that copy is deleted; we will tell you this when we answer a deletion request.

11. Your rights and how to exercise them

You have the right to:

• Access the personal information we hold about you and receive a copy (POPIA s 23; GDPR Art 15) and, under GDPR, to receive it in a portable format (Art 20);
• Correct or complete it (POPIA s 24; GDPR Art 16) — you can edit your name, picture and email in Settings;
• Delete it (POPIA s 24; GDPR Art 17) — you can delete your own account in Settings after a recent sign-in, or ask us to do it;
• Object to processing based on legitimate interests (POPIA s 11(3); GDPR Art 21) and restrict processing in the circumstances GDPR Art 18 allows;
• Withdraw consent where processing rests on consent (none of the purposes in section 5 do);
• Complain to a regulator (section 14). The South African references in this list of rights are under review by our legal counsel following the move to a Mauritius entity

To exercise any right, email sarah@niaimpactinvest.com from the address on your account, or via your organisation's administrator. We will confirm receipt, may ask you to verify your identity, and will respond within one month (30 days); where GDPR applies and a request is complex we may extend this by up to two further months and will tell you why (GDPR Art 12(3)). Access to information that also concerns other people (for example an organisation's full member list) is prepared by Nia staff so that other people's information is not disclosed to you.

This provision is being finalised with our legal counsel and will be published in a later version.

If you are an employee of a GP or portfolio company, your organisation may also hold rights and obligations in respect of your work data under its own policies.

12. Cookies

The Platform sets only cookies that are strictly necessary to run it: a sign-in session cookie (30 days from last use), a language-preference cookie and an interface-preference cookie (sidebar state). The public website sets no cookie unless you change its language. We use no analytics, advertising or third-party cookies. Details are in our Cookie Notice.

13. Children

The Platform is a business tool for people acting in a professional capacity. It is not directed at, and we do not knowingly collect information from, anyone under 18.

14. Complaints and regulators

We would like the chance to resolve any concern first — write to sarah@niaimpactinvest.com or to our Information Officer (section 1). You also have the right to complain to:

• South Africa — Information Regulator: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 · +27 (0)10 023 5200 · POPIAComplaints@inforegulator.org.za · https://inforegulator.org.za The South African complaints body named here is under review by our legal counsel following the move to a Mauritius entity
• European Union: the supervisory authority in the EU member state where you live or work, or where you believe the infringement occurred. A list is at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.

15. Changes to this policy

We will post any change here with a new version number and effective date, and will notify organisation administrators (and, for material changes, all users by email or in-app notice) before it takes effect. The version you accepted — at sign-up, when accepting an invitation, or on the re-acceptance screen after a change — is recorded against your account with the date, the language shown and the screen it was accepted on.

---

Related documents: Terms of Service · Data Processing Agreement for organisations (available on request) · Sub-processor list · How the platform uses AI · Cookie Notice · Breach procedure, Information Officer and retention schedule (in preparation).

Who we are and how to reach us

Nia Impact (trading as Nia Impact Invest) · company number 221851
Lot 02, Floor 1, CentrePoint, Trianon, Mauritius

Legal and privacy: sarah@niaimpactinvest.com · Support: hello@niaimpactinvest.com

Version history

1. v1.4Across the legal set — Version 1.4, effective 11 September 2026: the company you contract with changes. The contracting company is now Nia Impact, company number 221851, registered at Lot 02, Floor 1, CentrePoint, Trianon, Mauritius, still trading as Nia Impact Invest; the Terms, the Privacy Policy and the sub-processor list carry its details in place of the previous South African company's; that company's tax-registration number is removed from clause 1.1 and from the signature block, and the sentence in the fees clause that stated fees exclusive of that tax is removed, with nothing put in its place. The clauses that rest on South African law — governing law, jurisdiction and notice timing, the intellectual-property indemnity, the fee currency and interest rate, the electronic-acceptance and consumer-protection provisions, and the data-protection framing of the Privacy Policy — are unchanged in wording and now carry a visible note that they are under review by our legal counsel following the move; counsel's pass on that text is a separate step. Because the company you contract with is not the one named in version 1.3, the acceptance-registry identifiers change to terms-2026-09-11-draft, privacy-2026-09-11-draft and ai-notice-2026-09-11-draft, and everyone is asked to accept the re-issued documents once on their next sign-in. The product name is unchanged from 1.3; all seven documents are re-issued as 1.4 so the set shares one version.
2. v1.3Across the legal set — Version 1.3, effective 9 September 2026: the product is renamed. The application these documents govern is now called Nia Within, and every document is re-issued with the new name; the wording is otherwise unchanged, and the company you contract with at this version is still the South African company named in the documents. Because the Terms, the Privacy Policy and the AI-processing notice are re-issued under a new name, their acceptance-registry identifiers change to terms-2026-09-09-draft, privacy-2026-09-09-draft and ai-notice-2026-09-09-draft, and everyone is asked to accept the renamed documents once on their next sign-in. The Terms, the Privacy Policy, the Cookie Notice and the sub-processor list carry the new name; the AI-processing page and the German summaries carry no text change; all are re-issued as 1.3 so the set shares one version.
3. v1.2Across the legal set — Version 1.2, effective 7 September 2026: a factual correction to what version 1.1 said about embeddings. Embeddings — the numerical representations of your text used for search — are now sent only to an endpoint that keeps no copy of the input and does not train on it; today that is Microsoft Azure, the only such endpoint offered for the embedding model we use. Version 1.1 said that no zero-retention endpoint existed for embeddings and that they were sent to Microsoft Azure or OpenAI. Both statements are corrected: Privacy Policy section 6(a) and the section 7 table, the AI-processing page and the sub-processor list now say that embeddings go only to the zero-data-retention endpoint at Microsoft Azure, and that OpenAI remains a permitted host under our routing rules but receives no requests today. This tightens how your text is handled; nothing is taken away and nothing new is asked of you, so no one is asked to accept again. The Cookie Notice, the Terms and the German summaries carry no text change and are re-issued as 1.2 so the set shares one version. Privacy Policy and Terms of service — Version 1.2, effective 7 September 2026: two statements in section 10 of the Privacy Policy are replaced because the Platform now does what they said it could not yet do. Deleting your account no longer deletes the audit-trail entries recorded in your name: each entry keeps what was done and when, and your name is replaced by a label that does not identify you, such as "deleted admin #a1b2c3d4" — never your name and never your e-mail address. Administrator accounts can now be deleted the same way as any other account; a setting an administrator changed for an organisation keeps its value, with the setter's name removed. The sentences saying the trail was deleted with the account, and that some administrator accounts could not yet be deleted, are removed because they are no longer true. Nothing is taken away, nothing new is asked of you, and you are not asked to accept again. Clause B8 of the Terms of service (closing your account) is corrected to match: it no longer says that audit entries recorded in your name are deleted when you delete your account yourself, or that you should ask your administrator to remove you instead — whichever way your account is closed, the entries are kept under the same non-identifying label. The other five documents carry no text change and are re-issued as 1.2 so the set shares one version.
4. v1.1Across the legal set — Version 1.1, effective 6 September 2026: a wording and link tidy-up of version 1.0. Nothing is taken away and nothing new is asked of you; the only change to what the Terms require is one new commitment by Nia, in clause 21.1, which section 21.3 makes effective on publication, so no one is asked to accept again. Privacy Policy section 7: the GitHub row now says the database backup job is not running on a schedule at present, as sections 9 and 10 already said; the opening sentence of section 7 is reworded by one word. Privacy Policy sections 9 and 10: the database-backup sentences now say the off-site copies were taken from 1 to 3 September 2026 and the job is not running on a schedule; the promise itself is unchanged. Sub-processor list: Resend's legal entity is written as Plus Five Five, Inc. Terms 21.1: Nia still provides a copy of any earlier version on request, and now commits to 10 business days where the request is made in writing — the same turnaround as an export under 7.8. All documents: the legal hub and the versions page are linked from the site footer. The Cookie Notice, the AI-processing page and the German summaries carry no text change and are re-issued as 1.1 so the set shares one version.
5. v1.0Version 1.0, effective 4 September 2026: the first published version, adopted by Nia Impact Invest. It supersedes the draft of 2 September 2026. Later revisions will be listed here with a summary of what changed.

All versions