DRAFT – requires SA legal review
Privacy Policy
EmploySaffas processes personal information under the Protection of Personal Information Act 4 of 2013 (POPIA). This policy explains what we collect, why, who receives it, how long we keep it and your rights.
1. Who we are (responsible party)
EmploySaffas (Pty) Ltd, company registration number 2024/468658/07. Physical address: [DRAFT – registered physical address still to be supplied]. Email: employsaffas@gmail.com or info@employsaffas.co.za.
Information Officer: Jan Harm, employsaffas@gmail.com or info@employsaffas.co.za. [DRAFT – registration of the Information Officer with the Information Regulator still to be confirmed]
2. What we collect
Candidates: identity and contact details (name, email, phone, optional ID number), location, CV, employment history, qualifications, skills, industries, salary expectation, notice period and availability, consent records. Employers: company details (name, optional registration number, country, address, phone, industry, website) and the details of the people who use the account (name, position, email). Electronic signatures: signer name, position, email, agreement version and its fingerprint, time, IP address and browser details. Technical: login session cookies (see section 9) and server logs.
3. Why we use it, and the lawful basis
- To assess candidates, publish anonymised profiles to approved employers, and coordinate interviews and placements – to perform our agreement with you (POPIA s11(1)(b)) and with your consent (s11(1)(a)).
- To share a candidate’s details with a named employer for a specific interview – only with the candidate’s consent for that request (s11(1)(a); s72 where the employer is outside South Africa).
- To verify and contract with employers, record electronic signatures and invoice fees – to perform the agreement (s11(1)(b)) and to comply with tax and company-law record-keeping duties (s11(1)(c)).
- Optional automatic CV reading – with the candidate’s express consent (s11(1)(a); s72(1)(b)).
- Optional monthly candidate updates to employers – with the employer’s opt-in consent (s69).
- Security, fraud prevention and audit logging – our legitimate interests (s11(1)(f)).
4. Voluntary or mandatory
Supplying information is voluntary. However, candidates must supply the fields marked as required, a CV and the required consents before a profile can be submitted, and employers must supply company and contact details to register and sign the Recruitment Terms. If you do not supply them, we cannot provide the service. Some records (for example invoices and accounting records) must be kept under tax and company law.
5. Who receives it
Employers see anonymised profiles only. A candidate’s identity, contact details and CV are shared with a named employer only when the candidate agrees to that employer’s interview request. Where an employer uses an Employer of Record (EOR) provider, the employer may share the candidate’s information with that provider for the engagement. CVs and contact details are otherwise accessible only to authorised EmploySaffas staff. We use these operators (service providers): Supabase (database, storage and authentication; Ireland/EU), Cloudflare (website hosting; global network), Resend (email; EU), OpenAI (optional CV reading; USA) and Google (email account; employsaffas@gmail.com).
6. Cross-border transfers (POPIA s72)
Our operators store or process information outside South Africa, and employers may be located outside South Africa. We transfer information on the basis of your consent (s72(1)(b)) and of binding agreements requiring the recipient to protect it to a standard substantially similar to POPIA (s72(1)(a)): the operators’ data-processing terms, and clause 13 of our Recruitment Terms for employers. [DRAFT – acceptance of each operator’s data-processing agreement still to be confirmed]
7. How long we keep it
| Information | Retention |
|---|---|
| Active candidate profile and CV | While the account is active; deleted or anonymised after 24 months of inactivity (reminder email at 23 months) |
| Unsuccessful candidates for a specific role | Profile as above; interview correspondence 12 months |
| Placed candidate records | 5 years after placement |
| Signed agreements and signature evidence | Life of the agreement plus 5 years |
| Invoices and accounting records | 5 years from submission of the relevant tax return (Tax Administration Act 28 of 2011); company records 7 years (Companies Act 71 of 2008) |
| Consent records | Life of the consent plus 3 years |
| Audit logs | 2 years |
| Email delivery logs | 12 months |
| AI CV-processing logs (no CV text) | 12 months |
[DRAFT – automated deletion is not yet implemented; records are currently reviewed and deleted manually. Retention periods required by the Employment Services Act regulations are still to be confirmed.]
8. Security
Information is encrypted in transit (HTTPS). CVs and signed agreements are kept in private storage that only authorised staff can open, through links that expire after 60 seconds. Database access is restricted by role, and access to CVs is logged.
9. Cookies
We use only strictly necessary cookies: the login session cookies set by our authentication provider (Supabase) so that you stay signed in. We do not use analytics, advertising or tracking cookies.
10. Your rights
You may ask for access to your information (s23), ask us to correct or delete it (s24), object to its processing (s11(3)), and withdraw your consent at any time. Withdrawal does not affect processing that took place before it. Employers can unsubscribe from monthly updates through the link in each email or in their dashboard. Contact the Information Officer at employsaffas@gmail.com or info@employsaffas.co.za.
If you are unhappy with how we handle your information, you may complain to the Information Regulator (South Africa): https://inforegulator.org.za.
11. Automatic CV reading
If a candidate opts in, the text of their CV is sent to a third-party AI service (currently OpenAI) to pre-fill their professional information. Before sending, we remove email addresses, phone numbers, ID numbers, links and the candidate’s name where we can detect them. The candidate must review and confirm the result; no decision about a candidate is made by automated means. Each processing event is logged. The provider’s API terms state that API data is not used to train its models.
Our PAIA manual is available at /paia-manual.