Data Protection Policy

1. Roles Under POPIA

Where an employer uses VulaJobs to record the people they employ, the employer is the responsible party for that information and VulaJobs is the operator, as POPIA defines those terms. We process it only on the employer's instructions and only to provide the service, under the Operator Terms in Annex A of our Terms of Service.

For an employer's own account, billing and contact information, and for anyone who contacts us, VulaJobs is the responsible party.

2. What the Employer Is Responsible For

As the responsible party, the employer must have a lawful basis for the information they record, must tell their worker about it as section 18 of POPIA requires, and must answer their worker's requests about it. Our POPIA notice sets out those duties for employers in plain language.

Worker information

VulaJobs stores the following about a worker, as entered by their employer or confirmed by the worker:

• full name, identity number, contact numbers, and whether each number is reachable on WhatsApp;
• residential address, and whether the worker lives at the workplace;
• bank name, account type, branch code and account number;
• the worker's confirmation of their details, and their signature on contracts and contract changes;
• employment records: job, start and end dates, contracts, schedule, shifts missed, cancelled, moved or worked late, leave, pay terms, pay runs, deductions, payslips, timesheets, payments and wage advances;
• UIF information: what is declared for the worker each month, and the reason recorded when an employment ends.

Section 33(2) of POPIA requires information about personnel to be processed in accordance with labour legislation, and the employer remains responsible for that.

Special personal information

Leave records can reveal information about a worker's health — sick leave, maternity and parental leave, and injury on duty — which is special personal information under section 26 of POPIA. It is recorded only so that leave can be granted and paid as the law requires, and the employer is responsible for its lawful basis under section 27 and for not sharing it further. VulaJobs records whether a medical certificate was provided, but does not store the certificate itself.

Workers under 18

The information of a worker under 18 is a child's information under section 34 of POPIA. (A South African identity number reveals its holder's date of birth.) Processing it is permitted under section 35(1)(b) where it is necessary to establish, exercise or defend a right or obligation in law — which includes the employer's duty under section 31 of the Basic Conditions of Employment Act to record the date of birth of an employee under 18. The employer is responsible for that basis, and for the limits the law places on employing a person under 18, including the prohibition on employing a child under 15.

3. Processing Principles

• personal information is processed lawfully and only to provide the service;
• we do not sell personal information or use it for unrelated purposes;
• we collect and keep only what the employment and the law require;
• we help keep information accurate: a worker can confirm their own details, and when an employer changes details the worker has already confirmed, the worker is asked to confirm them again.

4. Security Safeguards

We maintain appropriate, reasonable technical and organisational measures, as section 19 of POPIA requires, including:

• encryption at rest of identity numbers, residential addresses and bank account and branch numbers;
• encrypted connections (HTTPS) between the app, this website and our servers;
• sign-in with expiring access tokens, and access controls that limit each employer to their own records;
• payslips and timesheets sent to a worker are protected with the worker's identity number as the password;
• the links sent to workers are unique and single-purpose, and bank details are verified against the worker's identity number before a payment can be made to them;
• a record of who signed each contract, when, and from which device.

No system is completely secure, and we cannot guarantee that information will never be lost or compromised — see section 12 of our Terms of Service.

5. Sub-Operators

We use a small number of trusted providers to deliver VulaJobs. They act as our sub-operators. We require each to protect personal information and to process it only as needed to provide its service to us, and we remain responsible for their processing.

We may add or change a sub-operator from time to time. When we do, we will update this list, and an employer who objects on reasonable data-protection grounds may raise it with us.

6. Data Subject Rights

Everyone whose information is on VulaJobs can ask to see it, ask for it to be corrected or deleted, object to its processing and complain to the Information Regulator. How to do that — and that objecting and asking for a correction are free — is set out in our POPIA notice. A worker's request about information their employer holds is answered by the employer, with our help.

7. Retention and Deletion

• Employment records are kept for three years after the employment ends. Section 31 of the Basic Conditions of Employment Act and Sectoral Determination 7 require an employer to keep records of hours worked, pay and written particulars for three years. We keep them for that period on the employer's behalf, including after the employer closes their account, and the employer can ask us for copies during it. They are then permanently deleted.
• Tax records may need to be kept for five years under the Tax Administration Act, 2011. That is the employer's obligation; employers should export and keep their own copies of payslips and pay records.
• An employer's account is kept while it is open, and after it is closed for as long as any employment records on it are still kept.
• Deletion on request. We delete information on request within 30 days, except records the law requires to be kept, which are deleted when that period ends. Where we cannot delete something yet, we tell you why and until when.
• Our own billing records are kept for as long as tax law requires.
• Deleted information is removed from the live Platform immediately. Copies may remain in our hosting provider's encrypted backups for a short period until they are overwritten. Backups are used only to recover from a disaster.

8. Security Compromises

If there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we investigate and contain it, and:

• for information we are responsible for, we notify the Information Regulator through its eServices portal, as required since 1 April 2025, and the people affected, as section 22 of POPIA requires;
• for workers' information, we notify the employer immediately, and in any event within 24 hours, as section 21(2) requires of an operator, and help them notify the Regulator and their worker.

9. Processing Outside South Africa

VulaJobs and the information stored in it are hosted in South Africa, so hosting is not a transfer of personal information out of the country. The providers marked above as processing outside South Africa receive only what they need — a worker's number and message, an employer's email address, a device token. For those transfers we rely on section 72(1)(a) of POPIA: each provider is bound by a written agreement requiring protection substantially similar to POPIA's conditions, including on onward transfer. Where a transfer is necessary to perform our contract with an employer, we also rely on section 72(1)(c).

10. Information Officer and Contact

Our Information Officer is Marné van Zyl. For any question, request or notification about data protection, contact our Information Officer at: