POPIA Privacy Policy

1. Responsible Party & Operator

Responsible Party: PeopleIQ SA (Pty) Ltd processes personal information collected through its website (peopleiqsa.co.za) and platform (app.peopleiqsa.co.za) as the responsible party in its own right.

Operator: When subscriber organisations upload employee data to the PeopleIQ SA platform, PeopleIQ SA acts as an operator processing that data on behalf of the subscriber (the responsible party). Processing is carried out only as instructed by the responsible party and as described in the platform's Data Processing Agreement.

2. Information Officer

[TO BE COMPLETED BEFORE PUBLICATION]
Information Officer Name: _______________________
Email: privacy@peopleiqsa.co.za
Phone: _______________________

The Information Officer is responsible for ensuring PeopleIQ SA's compliance with POPIA and handling data subject requests and complaints.

3. Categories of Personal Information Processed

3.1 Website and Platform Users

• Names, email addresses, phone numbers
• Company name and role
• IP addresses and usage data
• Payment and billing information

3.2 Employee Data (Processed on behalf of subscriber organisations)

• Personal identifiers: name, ID number, date of birth, gender
• Contact information: address, phone, email
• Employment information: position, department, remuneration, leave
• Performance and KPI records
• Skills, qualifications and training records
• Disciplinary and grievance records

3.3 Special Personal Information

POPIA provides heightened protection for "special personal information," which includes race, health, biometric, religious and criminal information. PeopleIQ SA may process race and employment equity data as part of BEE compliance features. Processing of special personal information is done only:

• With the explicit consent of the data subject, or
• Where required by law (e.g. Employment Equity Act reporting), or
• As otherwise permitted under POPIA section 27

4. Purposes of Processing

Personal information is processed for the following specific, explicit and legitimate purposes:

• Providing and improving HR and workforce intelligence platform services
• Responding to enquiries and managing customer relationships
• Processing subscription payments
• Complying with BEE, Employment Equity Act and other legal requirements
• Generating AI-powered workforce insights and analytics
• Sending marketing communications (with consent)
• Fraud prevention and security monitoring

5. Lawful Grounds for Processing

We process personal information on one or more of the following lawful grounds under POPIA:

• Consent where the data subject has given specific, informed consent
• Contractual necessity processing required to perform our subscription contract
• Legal obligation where required by South African law (e.g. SARS, Employment Equity Act)
• Legitimate interest where processing is necessary for our legitimate business interests and does not outweigh the data subject's rights

6. Data Subject Rights

All data subjects have the following rights in terms of POPIA:

• Right to be notified of collection and purpose
• Right of access to request a copy of personal information we hold
• Right to correction to request correction of inaccurate information
• Right to deletion to request deletion (subject to retention obligations)
• Right to object to object to certain types of processing
• Right to complain to lodge a complaint with the Information Regulator

Submit requests to: privacy@peopleiqsa.co.za. We will respond within 30 days.

7. Security Safeguards

We implement appropriate, reasonable technical and organisational measures to prevent loss, damage, unauthorised access, or processing of personal information. These include:

• Encrypted data in transit (HTTPS/TLS) and at rest
• Role-based access controls
• Regular security assessments
• Incident response procedures
• Employee confidentiality obligations

In the event of a material data breach, we will notify affected parties and the Information Regulator as required by POPIA.

8. Data Retention

Personal information is retained only for as long as necessary for the purpose for which it was collected, or as required by law. Thereafter, it is securely deleted or anonymised. Specific retention periods are documented in our Privacy Policy.

9. Cross-Border Transfer of Personal Information

Some personal information may be transferred to and processed in countries outside South Africa (including the United States and European Union) where our service providers operate. We ensure that:

• The recipient is subject to a law or binding agreement providing an adequate level of protection, or
• The data subject has consented to the transfer, in accordance with POPIA section 72

10. AI Processing Disclosure

PeopleIQ SA uses artificial intelligence and machine learning to analyse workforce data and generate insights. All AI processing is conducted in accordance with POPIA's purpose limitation and minimisation principles. AI-generated outputs are used only for decision-support purposes no AI system makes final binding decisions about individuals without human review and authorisation.

11. Complaints

If you believe your POPIA rights have been infringed, you may lodge a complaint with:

• PeopleIQ SA Information Officer: privacy@peopleiqsa.co.za
• The Information Regulator (South Africa): www.justice.gov.za/inforeg/ | inforeg@justice.gov.za