Employee Privacy Policy

1. Introduction

This Privacy Policy explains how we collect, use, and protect your personal information in accordance with the Protection of Personal Information Act (POPIA) of South Africa. By providing your consent, you acknowledge that you have read and understood this policy.

2. Information We Collect

We collect the following personal information:

• Name: For identification and employment records
• Email (if applicable): For receptionists only - system access and communication
• Work Performance Data: Jobs assigned, completed, performance metrics for tracking and reporting
• Consent Records: Date, version, and text of consent given for compliance purposes

3. Purpose of Processing

We process your personal information for employment purposes including:

• Job Assignment: Assigning work tasks and jobs to employees
• Performance Tracking: Monitoring job completion and work metrics
• Internal Reporting: Management reporting and business analytics
• System Access: Authentication and system access (receptionists)
• Employee Management: General employment administration
• Business Operations: Day-to-day operational requirements

4. Legal Basis for Processing

We process your personal information based on your explicit consent and for legitimate business interests. This data is used solely for business operations including employment management, job assignment, performance tracking, and internal reporting. Processing is necessary for the performance of employment contracts and compliance with legal obligations.

5. Data Security and Where It Is Stored

Your personal information is held in a managed PostgreSQL database operated by DigitalOcean. Files you or your employer upload — such as signatures and job photographs — are stored in DigitalOcean Spaces. The application itself runs on Vercel. We also use Resend to send system emails and Sentry to record technical errors.

Data is encrypted in transit. Passwords are stored only as cryptographic hashes and are never held in a readable form. Access to the underlying systems is restricted to authorized personnel, and automated backups are kept so that data can be recovered after a failure.

Processing outside South Africa: the infrastructure described above is hosted outside South Africa, which means your personal information is stored and processed abroad. We use these providers on the basis that they are contractually required to protect the information they hold on our behalf.

6. Data Retention

We retain your personal information for as long as you remain employed with us and for a period of 5 years thereafter for legal and regulatory compliance purposes. You may request earlier deletion of your data where legally permissible.

7. Your Rights Under POPIA

You have the right to:

• Access: Request copies of your personal information
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your personal information subject to legal requirements
• Objection: Object to certain types of processing
• Portability: Request your data in a portable format
• Withdraw Consent: Withdraw your consent at any time (may affect employment)

8. Use of Information

Your personal information is used solely for business operations as described in this policy. Internal access is limited to authorized personnel for legitimate business purposes including management reporting, job assignment, and performance tracking. Information may be disclosed where required by law or with your explicit consent.

9. Changes to This Policy

We may update this privacy policy from time to time. When we do, we will notify you and request your consent to the updated policy. The version number and last updated date will be clearly indicated.