Template notice. This document is provided as a structural starting point for South Assistants (Pty) Ltd and should be reviewed by qualified counsel before it is relied upon for compliance purposes under POPIA, GDPR, or any other applicable regime.
1. Who we are
South Assistants (Pty) Ltd ("South Assistants", "we", "us") is a private company registered in the Republic of South Africa. We operate the website at southassistants.com and provide talent-placement and workforce-management services to business clients.
We are the responsible party (POPIA) and data controller (GDPR) for the personal information processed through our website and service platform.
2. The personal information we process
We collect and process the following categories of personal information:
- Identity and contact data — name, email, phone number, role, company, LinkedIn URL.
- Account and billing data — login credentials, subscription plan, payment-card reference (tokenised; we do not store full card numbers), billing address, invoice history.
- Candidate data (for applicants to our talent network) — CV, employment history, qualifications, skills assessments, references, right-to-work status.
- Usage and device data — IP address, browser type, pages visited, referral source, and similar telemetry collected via cookies and server logs.
- Communications data — emails, call recordings (only where you have been notified), support tickets, and meeting transcripts produced by Kamva and our notetaker.
3. How we use it
We process personal information for the following purposes:
- To provide the services you have requested (e.g. matching a client with a vetted candidate).
- To administer your account, bill your subscription, and deliver customer support.
- To communicate with you about product updates, security notices, and (where you have opted in) marketing.
- To improve our service — including training internal quality models — using de-identified, aggregated data only.
- To comply with legal obligations, resolve disputes, and enforce our terms.
4. Lawful basis
Where GDPR applies, we rely on contract necessity (to deliver the service you have signed up for), legitimate interest (product improvement, fraud prevention, direct B2B marketing to existing customers), and consent (cookies other than strictly necessary ones, and marketing to prospects).
Under POPIA we rely on the conditions of consent, contract performance, legitimate interest, and compliance with an obligation of law.
5. Who we share it with
We share personal information only with parties that have a need to know and who are bound by appropriate contractual protections:
- Subprocessors (hosting, email, analytics, billing, calendaring). The current list is published at /legal/subprocessors.
- Clients and candidates engaged in an active placement, limited to what is necessary for that placement.
- Professional advisors (lawyers, auditors, insurers) under confidentiality obligations.
- Government authorities where required by law or to protect our legal interests.
We do not sell personal information, and we do not share it for cross-context behavioural advertising.
6. International transfers
We store customer data primarily in South African and European Union data centres. Where we transfer data outside of the EEA, UK, or South Africa, we rely on Standard Contractual Clauses (SCCs), the UK Addendum, and POPIA's cross-border transfer rules.
7. Your rights
Depending on your jurisdiction, you may have the right to access, correct, delete, port, or restrict the processing of your personal information, and to object to certain processing or withdraw consent.
To exercise any of these rights, email privacy@southassistants.com. We will respond within 30 calendar days.
8. Retention
We retain personal information only for as long as necessary for the purpose for which it was collected, after which we delete or de-identify it. Billing records are retained for seven years as required by South African tax law.
9. Security
We maintain SOC 2 Type II aligned controls: encryption in transit and at rest, role-based access, quarterly third-party penetration testing, and 24/7 infrastructure monitoring. In the unlikely event of a security incident affecting your data, we will notify the Information Regulator and affected individuals in line with POPIA section 22 and GDPR Article 34 where applicable.
10. Children
Our services are not directed at individuals under 18, and we do not knowingly collect their personal information.
11. Changes to this policy
We will post any material changes to this policy on this page and update the "Effective" date at the top. Where changes affect how we process your data, we will notify you by email.
12. Contact
Information Officer South Assistants (Pty) Ltd privacy@southassistants.com
Complaints may also be lodged with the Information Regulator of South Africa at inforegulator.org.za.