Privacy Policy

1. Introduction & Scope

This Policy applies to all individuals who register, apply for positions, or otherwise interact with the Platform, including active candidates and talent pool members. By using the Platform you acknowledge that you have read and understood this Policy.

Retailability operates across Southern Africa. Our hiring and data-processing activities are primarily conducted in, and governed by the laws of, the Republic of South Africa. This Policy does not cover third-party websites linked from the Platform.

2. Who We Are

Retailability (Pty) Ltd is the Responsible Party as defined under POPIA. Our registered head office is at Mount Edgecombe, KwaZulu-Natal, South Africa.

Platform Operator

Solum Technology (Pty) Ltd is our appointed Operator as defined under POPIA. Solum provides, hosts, and stores the Platform and all personal information on it on Retailability’s behalf and solely on Retailability’s instructions, under a binding Data Processing Agreement (POPIA S.20–21). Retailability remains the Responsible Party and determines the purposes for which your personal information is processed.

3. Personal Information We Collect

We collect only the personal information necessary for the recruitment purposes described in this Policy (POPIA S.9 — minimum information principle).

Categories we collect

• Identity: full name, date of birth, national ID or passport number
• Contact details: email address, phone number, physical address
• Professional background: CV/résumé, employment history, qualifications, certifications, skills
• Application data: job preferences, cover letters, screening responses, interview notes, assessment results
• Technical data: IP address, device and browser type, cookies, session identifiers
• Optional EEO data: race/ethnicity, gender identity, disability status (see Section 5)

4. How We Use Your Personal Information

We process your information only under a valid lawful basis per POPIA S.11:

• Evaluating suitability and matching your profile to vacancies — contract / pre-contractual steps
• Communicating about applications, interviews, and employment offers — contract
• Maintaining recruitment records required by South African labour legislation — legal obligation
• Preventing fraud and ensuring platform security — legitimate interest
• Retaining your profile in a talent pipeline, with your explicit consent — consent
• Sending opt-in communications about future vacancies — consent

We will not use your information for a purpose incompatible with the original collection purpose without your prior consent.

5. Special Personal Information (EEO)

Under POPIA S.26, categories such as race, ethnic origin, gender identity, and disability status require heightened protection. We may invite you to voluntarily provide this information for Equal Employment Opportunity (EEO) reporting.

• Providing EEO information is entirely voluntary — declining has no effect on your application
• Stored separately from your main profile using field-level encryption
• Never visible to recruiters, hiring managers, or interviewers
• Used exclusively for aggregated statistical reporting (minimum cell size k=5 to prevent re-identification)
• Processed under POPIA S.27 with your explicit written consent
• Deletable at any time by submitting a DSAR (see Section 12)

6. Automated Processing & Profiling

We use automated tools to assist recruiters in matching profiles to vacancies and ranking candidates against stated criteria. These tools generate recommendations — they do not make final hiring decisions without human review.

Under POPIA S.71, you have the right to request human review of any automated recommendation that significantly affects you. Contact us (see Section 16) to exercise this right.

7. Sharing with Third Parties

We do not sell your personal information. We share it only in the following circumstances (POPIA S.20):

• Retailability group companies — for cross-brand opportunities, with your consent
• Solum Technology (Pty) Ltd — our Operator, which hosts and stores the Platform on our behalf, bound by a Data Processing Agreement
• Background screening providers — only at advanced stages and with your explicit consent
• Cloud hosting and email delivery providers — acting as operators under binding agreements
• Regulatory authorities or courts — only where required by law

8. Cross-border Transfers of Information

Your personal information is hosted and stored within South Africa, in our Operator’s secure cloud infrastructure located in the AWS Africa (Cape Town) region. We do not routinely transfer your information outside South Africa.

Where a limited cross-border transfer is necessary for an ancillary service (for example, email delivery), all such transfers comply with POPIA S.72. We transfer personal information to third countries only where:

• The recipient country's laws provide an adequate level of protection, or
• The recipient is bound by equivalent contractual obligations, or
• You have provided informed consent to the transfer

9. Cookies & Online Tracking

The Platform currently uses only strictly necessary cookies. We do not use analytics, advertising, or other non-essential tracking cookies.

• Strictly necessary cookies: session authentication, CSRF protection, security tokens — no consent required under POPIA S.11(3)

If we introduce non-essential cookies in future, we will request your opt-in consent and provide a cookie-preferences control before any such cookie is set. Disabling non-essential cookies will not affect core Platform functionality.

10. How Long We Keep Your Information

We retain personal information only for as long as necessary or as required by law (POPIA S.14). After these periods, information is anonymised or securely deleted.

11. Your Rights as a Data Subject

Under POPIA S.23 and S.24, you have the following rights:

• Right of access (S.23): obtain a copy of the personal information we hold about you
• Right to correction (S.24): request that inaccurate or incomplete information be corrected
• Right to deletion (S.24): request erasure where processing is no longer lawful
• Right to object (S.24): object to processing based on our legitimate interest
• Right to data portability: receive your information in a structured, machine-readable format
• Right to withdraw consent: at any time, without affecting the lawfulness of prior processing
• Right to human review (S.71): request human review of any automated processing decision

We will not discriminate against you for exercising these rights. Some restrictions may apply where legal obligations require us to retain certain information.

12. How to Exercise Your Rights (DSAR)

Submit a Data Subject Access Request to us using the contact details in Section 16. Please include:

• Your full name and the email address linked to your Platform account
• A clear description of your request (access, correction, deletion, portability, or objection)
• A copy of a valid identity document for verification

We will respond within 30 days of receiving your verified request (POPIA S.23). There is no charge for submitting a DSAR.

13. Security Safeguards

We implement technical and organisational measures proportionate to the risk, in compliance with POPIA S.19:

• Encryption in transit: TLS 1.2+ for all data transmission
• Encryption at rest: field-level encryption for sensitive personal information
• Access controls: role-based access — only authorised staff may process personal data
• Security monitoring: continuous monitoring and regular vulnerability assessments
• Incident response: documented breach procedure aligned to POPIA S.22 notification obligations

In the event of a security compromise affecting your information, we will notify you and the Information Regulator as soon as reasonably possible after discovery (POPIA S.22).

14. Children's Personal Information

This Platform is intended for individuals aged 18 and older. Under POPIA S.34–35, we do not knowingly collect personal information from children under 18 without verifiable consent from a parent or legal guardian.

If you believe we have inadvertently collected information from a minor, please contact us immediately using the contact details in Section 16. We will take prompt steps to delete such information.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law (POPIA S.18(2)(f)). Where changes are material, we will publish a prominent notice on the Platform before the changes take effect.

Continued use of the Platform after the effective date of an updated Policy constitutes your acceptance of the updated terms. We encourage you to review this Policy periodically.

16. Contact Us & Regulator Complaints

For questions about this Policy, to exercise your rights, or to raise a complaint about how we handle your personal information:

Retailability — Legal & Compliance

• Department: Legal & Compliance, Retailability (Pty) Ltd
• Email: enquiries@retailability.co.za
• Address: Head Office, Mount Edgecombe, KwaZulu-Natal, South Africa

Information Regulator — South Africa

If you are not satisfied with our response, you may lodge a complaint with the Information Regulator under POPIA S.74:

• Website: www.inforeg.org.za
• Email: inforeg@justice.gov.za
• Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001