This Privacy Policy explains how Workley (Pty) Ltd collects, uses, shares and protects your personal information, and your rights, under the Protection of Personal Information Act, 2013 ("POPIA"). It forms part of our Terms & Conditions.
On this page
1. Responsible Party
Workley (Pty) Ltd (Registration Number [•]) is the Responsible Party (data controller) for the personal information processed through the Platform. Our Information Officer can be reached at privacy@workley.co.za.
2. Information we collect
- Account information: name, email address, mobile number, password (stored only as a secure hash), account type (Client or Talent) and location/province.
- Identity-verification information: South African ID number and related identity details submitted for verification against Department of Home Affairs records (see clause 5).
- Profile information: for Talent - field, skills, education, portfolio, work samples, rate and bio; for Clients - organisation name, industry and hiring needs.
- Engagement information: projects, invitations, messages and files exchanged, meetings scheduled, signed Service Agreements, and payment status (paid/unpaid) recorded against Engagements.
- Technical information: device, browser, IP address, log and security data used to operate and protect the Platform.
We collect information directly from you, from your use of the Platform, and (for identity verification only) from the Department of Home Affairs or an accredited verification partner.
3. Why we process it (purpose limitation)
We process personal information only for these purposes: creating and managing your account; verifying identity and preventing fraud; matching Talent with Clients; enabling messaging, file sharing, meetings, contracts and payment records; providing support; complying with law; and keeping the Platform safe and improving it. We do not sell your personal information.
4. Lawful basis & consent
We process personal information where it is necessary to perform our agreement with you, to comply with a legal obligation, to pursue our legitimate interests (such as security and fraud prevention) in a balanced way, or with your consent. Where we rely on consent (for example, identity verification or direct marketing), you may withdraw it at any time, though some features may then be unavailable.
5. Identity verification (Home Affairs)
To confirm that Talent are who they say they are, we verify submitted identity details against records held by the South African Department of Home Affairs, either directly or through an accredited verification operator acting on our written instruction. We collect the minimum information needed, use it only to confirm identity and prevent fraud, and protect it with appropriate safeguards. We do not use your ID number for any purpose other than verification, fraud prevention and legal compliance.
6. Sharing & operators
We share personal information only as needed to run the Platform, under written contracts that require confidentiality and POPIA-compliant security:
- Hosting & infrastructure: Google Firebase (authentication, database, storage and hosting).
- Identity verification partner: to verify identity against Home Affairs records.
- Payment providers: licensed providers that process payments you choose to make.
- Other Users: the information you choose to publish (such as your public profile and reviews) and information necessary for an Engagement is shared with the counterparty. Contact details are shared only when you are working together.
- Authorities: where required by law, court order, or to protect rights and safety.
These recipients act as our Operators where they process on our behalf and may not use your information for their own purposes.
7. Cross-border transfers
Some of our service providers (for example, cloud hosting) may store or process personal information on servers located outside South Africa. Where this happens, we transfer information only in accordance with section 72 of POPIA - that is, to recipients subject to laws or binding agreements that provide an adequate level of protection, or with your consent, or where the transfer is necessary to perform our agreement with you.
8. Security safeguards
In line with section 19 of POPIA, we apply appropriate technical and organisational measures, including encryption in transit and at rest, hashed passwords, two-factor authentication, strict database and storage access rules, access controls and monitoring. No system is perfectly secure; you must keep your credentials confidential. If a security compromise affecting your personal information occurs, we will notify you and the Information Regulator as required by law.
9. Retention
We keep personal information only for as long as necessary for the purposes above, or as required by law (for example, signed agreements and transaction records may be retained for statutory periods), after which we delete or de-identify it. When you delete your account, we remove your public profile and personal information, subject to records we are legally required to retain.
10. Your POPIA rights
- Access the personal information we hold about you.
- Correct or delete information that is inaccurate, irrelevant, excessive, out of date or obtained unlawfully.
- Object to processing, and withdraw consent, on reasonable grounds.
- Not be subject to a decision based solely on automated processing that significantly affects you, without safeguards.
- Complain to the Information Regulator.
To exercise your rights, contact privacy@workley.co.za. You can manage much of your information, and delete your account, directly in your dashboard.
11. Direct marketing
We will only send you electronic marketing where the law permits - for example, with your consent, or to existing users about similar services, always with an easy way to opt out. You can unsubscribe at any time.
12. Cookies & analytics
We use cookies and similar technologies that are necessary to run the Platform (such as keeping you signed in) and, where used, to understand usage and improve the service. You can control cookies through your browser settings; disabling some may affect functionality.
13. Children
The Platform is intended for users aged 18 and over. We do not knowingly process the personal information of children without the consent of a competent person as required by POPIA.
14. Changes
We may update this Policy from time to time. We will post the updated version with a new "last updated" date and, for material changes, take reasonable steps to notify you.
15. Contact
Information Officer, Workley (Pty) Ltd
Email: privacy@workley.co.za
Information Regulator (South Africa)
Website: inforegulator.org.za · Email: enquiries@inforegulator.org.za
This Policy is a carefully drafted template aligned with POPIA and Workley's actual data flows (Firebase, identity verification and payment providers). Items marked [•] must be completed, and we recommend a final review by an admitted South African attorney and registration of your Information Officer with the Information Regulator.